pCapitan Admiral — the investigation platform

pCapitan Admiral is the full edition of pCapitan. It keeps everything pCapitan does — reading any capture in plain language, with the evidence behind every answer — and adds the tools a full investigation needs. Like pCapitan, it runs entirely on your own computer; nothing leaves your machine.

This page is an overview; the complete step-by-step guide, with a screenshot of every screen, ships inside the app under ❓ Help & guide.

Active Directory and certificate services

• An offline security assessment of your Active Directory and its certificate services (AD CS): misconfigurations, known weaknesses and signs of compromise, explained in plain words with what to fix first. A normal domain account is enough; nothing is ever changed.
• Checked against the Five Eyes advisory. The joint government guidance Detecting and Mitigating Active Directory Compromises lists 17 techniques attackers use against Active Directory, from Kerberoasting to Golden SAML. Admiral assesses your domain against every one of them. Where a technique can be seen in the directory or the traffic it is reported directly; where it happens inside a server’s memory or in the cloud, Admiral flags the weakness that makes it possible and says so plainly.
• Passwords left in Group Policy. Old Group Policy Preferences stored passwords in SYSVOL with a key Microsoft published, so any domain user can read them. Admiral finds and decrypts every one, so you can remove them and change those passwords.
• The whole certificate ladder. Every known certificate-template and CA weakness (ESC1 to ESC16), the inventory of every certificate your CA has issued or revoked, and a live check that your revocation lists and OCSP responders are reachable and current.
• Attacks seen in the traffic: forged Kerberos tickets, a rogue domain controller pushing changes (DCShadow), directory replication from a computer that is not a domain controller (DCSync), certificate-based logons and copies of the Active Directory database.
• A native Active Directory MS-RPC engine that exercises the same paths an attacker would, so you can see what is exposed before anyone else does.
• FreeIPA identity-management servers are assessed the same way as Active Directory.

Audits and compliance

• Every finding mapped to the controls auditors check: NIST SP 800-53 Rev 5, NIST CSF 2.0, ISO/IEC 27001:2022 and PCI-DSS v4.0.1, with a summary of which controls are at risk and the findings behind each.
• Group Policy security benchmarks: the password and lockout policy, dangerous user rights, anonymous access, LAN Manager hashes, User Account Control and security auditing are checked against the CIS and DISA STIG baselines, and each result names the control it fails.
• The printable report includes the compliance summary, ready to hand to an auditor.

Malware and threat analysis

• Malware static-triage sample cards summarise a suspicious file at a glance: what it is, what it touches and why it matters, without ever running it.
• Command-and-control framework fingerprinting spots the tell-tale patterns of common attack frameworks in the traffic.
• Sigma detection-as-code: bring your own detection rules in the open Sigma format and run them across the evidence.

Hunting across a whole case

• Case-level retro-hunt searches every capture you have loaded, together with passive DNS, for an indicator or a pattern — in a single pass.
• Cross-capture baselines learn what is normal for a device or a network, so what is new or rare stands out.
• One analysis across every source: a case made of many captures reads as a single story, analysed together.

Court-ready evidence

• A hash-chained audit log records every step of the investigation, tamper-evident from start to finish.
• Trusted timestamps (RFC 3161) prove when each piece of evidence was handled.
• The result is a chain of custody and an evidence bundle built to stand up in court.

Getting Admiral

Admiral includes everything in pCapitan. It is a separate app with its own licence (there is no upgrade): download it from the pCapitan Admiral page, try every feature free for 14 days, and activate it with an Admiral purchase key. A pCapitan key does not unlock Admiral, and an Admiral key does not unlock pCapitan.