Predefined filters update

modules/analyze/html/index.html

@@ -354,8 +354,8 @@
                 mode="Normal" depth=99 methods="default">Who can DCsync?</li>
               <li class="dropdown-item" query="(out=MachineAccount,(&(_unconstraineddelegation=1)(!(userAccountControl:1.2.840.113556.1.4.803:=8192))))"
                 mode="Normal" depth=1>How to reach machines that have computer accounts with unconstrained delegation (non-DCs)</li>
-              <li class="dropdown-item" query="(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304))"
-                mode="Reverse" depth=1>What can accounts with no Kerberos preauth requirement reach?</li>
+              <li class="dropdown-item" query="(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304)(accountActive=true))"
+                mode="Reverse" depth=1>What can accounts with no Kerberos preauth requirement reach? (ASREPROAST)</li>
               <!-- Domain Controller stuff -->
               <li class="dropdown-item"
                 query="(distinguishedname=CN=MicrosoftDNS,CN=System,DC=*),(|(objectSid=S-1-5-32-544)(objectSid=S-1-5-21-*-512)(objectSid=S-1-5-21-*-519))"
@@ -396,7 +396,7 @@
                 mode="Reverse" depth=99 methods="default">New accounts with initial password</li>
               <li class="dropdown-item" query="(&(type=Person)(memberOf=CN=Protected Users,*))"
                 mode="Normal" depth=99 methods="default">Who can pwn Protected Users?</li>
-              <li class="dropdown-item" query="(&(type=Person)(servicePrincipalName=*))" mode="Normal"
+              <li class="dropdown-item" query="(&(type=Person)(servicePrincipalName=*)(accountActive=true))" mode="Normal"
                 depth=1 methods="HasSPN">Users with SPNs (can be Kerberoasted)</li>
               <li class="dropdown-item" query="(&(type=Group)(member:count:>100))" mode="Normal"
                 depth=99 methods="default">Groups that have more than 100 direct members</li>