# Qianlitp/WatchAD

AD Security Intrusion Detection System

Repository: https://github.com/Qianlitp/WatchAD
Canonical: https://ross.abutalabs.com/products/watchad
Language: Python
License: GPL-3.0
License Family: copyleft
Topics: security, active-directory, python3, defcon27, intrusion-detection-system, kerberos, event-log, ntlm, blue-team, watchad
Archived: true
Last push: 2023-03-31T14:42:00+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 2505, "days_push": 1251, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1321, forks 299 (observed 2026-08-28T04:04:21.818618+00:00)

## What it is
WatchAD is an open-source Active Directory security intrusion detection system that analyzes Windows event logs (and optionally Kerberos network traffic) from domain controllers to detect AD attacks. It covers detections across discovery, credential dumping, lateral movement, privilege escalation, persistence, and defense evasion using rule matching, honeypot accounts, and historical behavior analysis.

## Use cases
- detect kerberoasting and golden ticket attacks in active directory
- monitor domain controller event logs for intrusions
- detect ntlm relay and dcsync attacks
- set up honeypot accounts to catch attackers in AD
- blue team active directory threat detection
- detect privilege escalation and persistence in windows domains

## When to choose
- you run a Windows Active Directory environment and need open-source AD-specific intrusion detection
- you want detection coverage for common AD attack techniques like Kerberoasting, DCShadow, and Skeleton Key
- you are a blue team looking for free alternatives to commercial AD monitoring

## When to avoid
- you need the network-traffic-based (Kerberos traffic) detections, which are not included in the open-source release
- you need a actively developed tool - the project has seen limited recent activity
- your environment is not Windows Active Directory

## Facets
- artifact type: application
- maturity: maintenance
- function: monitoring, alerting, security, logging
- domain: security, monitoring, self-hosted
- platform: python, self-hosted
- tags: active-directory, intrusion-detection, blue-team, kerberos, event-log-analysis, ids, linux, docker

## Member repositories
- Qianlitp/WatchAD (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:21.818618+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:47:16.116922+00:00, confidence not recorded.
  - readme: https://github.com/Qianlitp/WatchAD (fetched 2026-08-28T04:04:21.818618+00:00, sha 6362701e6cb5)
- Data as of 2026-08-30T08:39:29.467469+00:00.