BloodHound
Graph analysis turns 'we think permissions are fine' into a list of edges to cut, ordered by how much of the graph each cut collapses.
Updated
How I use it
- Shortest-path-to-Domain-Admin analysis
- Hybrid path review across on-prem AD and Entra ID
- Recurring drift detection after remediation
- Evidence for tiered administration proposals
Recurring problems I find
- Running collection without notifying detection teams
- Treating the graph as a one-off report instead of a recurring control
BloodHound Community Edition 8.0 added OpenGraph, extending path analysis beyond AD/Entra ID to sources like GitHub and Okta; legacy BloodHound is now deprecated. BloodHound Enterprise has since added AWS attack path management.
Related
Identity attack paths
Using BloodHound and Entra ID review to find privilege escalation paths across on-premises Active Directory and cloud identity.
Identity & Zero Trust
Entra ID hardening, Conditional Access authentication strengths, privileged access management and identity attack-path analysis with BloodHound.
Microsoft Entra ID
Entra ID hardening: Conditional Access design, PIM, phishing-resistant authentication, app registration governance and agent identity.
Attack path
A chain of legitimate permissions, exposures and vulnerabilities that leads an attacker from initial access to a valuable asset.
Conditional Access baseline
An Entra ID Conditional Access baseline ordered by blast radius: which policies to ship first, how to stage them, the legacy-policy retirement dates that create silent gaps, and the exclusions that quietly undo them.
Where the credential lives
Two shapes of agent isolation, the one that keeps keys out of the process, and the failure both shapes still miss.