rpcscope/docs/CHECKER_POLICY.md

Checker and CVE policy

Result states

Every implemented check must return an explicit state:

Compression capability checks additionally use not-exposed for a valid negotiation that did not select compression. This is not a not-vulnerable patch verdict.

• vulnerable: the dedicated checker returned its documented positive marker;
• not-vulnerable: the checker completed and returned its documented negative marker;
• suspected: the checker found a capability or permission indicator requiring independent validation;
• exposed: the selected RPC interface accepted a bind; no coercion or exploitation was demonstrated;
• observed: inventory information was returned, such as registered spooler endpoints or advertised network interface addresses;
• inconclusive: the probe completed without enough evidence, including silence, access denial or an unsupported response;
• precondition-met, precondition-not-met, precondition-borderline: an empirical prerequisite estimate, not a vulnerability or patch verdict;
• skipped-*: the check could not run, for example because credentials were required.
• pending: the selected checker has not finished; used by live report checkpoints.

An exposed RPC UUID, OS banner, open port, or legacy protocol is an EXPOSURE, not a confirmed vulnerability.

NOT VULNERABLE (SELECTED CHECKS) is permitted only when selected vulnerability checks produced explicit negatives, no selected checks were skipped or unknown, and collection completed without evidence conflicts. Inventory and precondition results cannot independently produce that verdict. Result markers must match the expected module and host. Nonzero exits, contradictory messages, and silence cannot produce definitive results.

Execution completion and evidence certainty are separate: suspected and inconclusive count as completed checks, with uncertainty printed explicitly. Ordinary skipped-* results are excluded from the execution denominator and counted as SKIPPED; they never imply a negative. Failed processes, pending stages and cancellation still mark the scan partial. Closed/timed-out discovery services are completed reachability outcomes, not failed vulnerability checks; no host pipeline is queued without a reachable TCP/135 or TCP/445 service.

PrintNightmare's driver-permission probe and noPac's PAC-size heuristic produce suspected results. SMB compression is now measured through a bounded native, pre-login SMB2 negotiation: exposed / not-exposed describe only capability negotiation, never SMBGhost patch status. Both complete execution; neither is a vulnerability verdict. NetExec's legacy compression positive is also normalized to exposure, not critical CVE suspicion. The removed NetExec NTLM reflection module is disabled pending an adapter for its replacement.

An explicit failed SMB login without module output is skipped-auth-denied; RPC bind access denial is skipped-access-denied. Neither proves patched. Zerologon's exact exhausted-attempts message yields a probabilistic not-vulnerable for that checker run. Its generic DCERPC exception does not prove the host is not a DC. Failed processes still yield unknown, even if partial output contains a result marker. Duration and bounded failure diagnostics are retained for troubleshooting.

Catalog synchronization

Metadata and executable checks have different lifecycles:

1. CVE metadata should be refreshed from the NVD CVE API.
2. Exploitation-in-the-wild priority should be overlaid from CISA's Known Exploited Vulnerabilities JSON feed.
3. Microsoft Windows applicability and remediation should link to the MSRC Update Guide.
4. RPC interface identity should link to the relevant Microsoft Open Specifications document.
5. A new CVE remains metadata-only until a deterministic positive and negative probe, fixtures, and target-version notes exist.

Keyword searches for “RPC,” “Netlogon,” or “spooler” are discovery aids only. They cannot safely create executable rules because CVE descriptions do not consistently identify a wire protocol, endpoint UUID, remotely observable patch signal, or non-destructive probe.

The implemented sync-cves command refreshes curated Microsoft CNA records only. The downloaded dataset is explicitly review-only with scanner_coverage=false. It never expands executable CVE/patch detection coverage or labels an individual host vulnerable. LongLogon has a precondition-only adapter included in recommended; its existence does not turn this metadata into a patch detector.

LongLogon boundary

--checks recommended includes LongLogon's minimal CLDAP DC-locator queries on UDP/389; --checks longlogon selects just that adapter. It first validates an EX identity response, then conditionally measures a fixed one-character-user legacy response after a conservative baseline-size guard. It never sends a maximum-length user field or an overflow trigger. The upstream response-size extrapolation is an empirical heuristic, retained as PRECONDITION only. Invalid, mismatched, unsupported, timed-out or EX-only responses are UNKNOWN, not negative. No remote patch-state claim is made. Default TCP discovery does not cover UDP-only domain controllers whose TCP/135 and TCP/445 are both unavailable.

Validation and exploitation

Future proof-of-execution adapters should live behind a separate command, not the scan command. The intended guardrails are:

• exactly one host and one check per invocation;
• a second explicit authorization flag;
• no CIDRs, target files, arbitrary shell commands, persistence, payload listeners, or credential dumping;
• a fixed proof that returns identity and OS/build only;
• no proof text in the report unless the target returned it;
• a target-change and cleanup declaration for every adapter;
• disabled adapters for checks whose only reliable proof risks corruption, password changes, denial of service, or persistent artifacts.

This keeps the resume project useful for validation while preventing a routine audit from silently becoming an exploitation campaign.