BloodHound-Legacy

Defenders also think in graphs. Matter of fact, good defenders think like attackers. Case in point, to contradict the author of this post directly: https://github.com/BloodHoundAD/BloodHound BloodHound is primarily a defender tool, that uses graph theory to help defenders find attack paths. But attackers also use it to help them find the shortest path to owning an AD domain. BloodHound is used in by a lot of threat actors as part of those news stories where the entire company is ransomwared. But what you don't see is, in a lot of companies that don't get totally ransomwared, there is a chance defenders are also using BloodHound to find and fix attack paths.

You know active directory? It's basically a graph of objects, accounts and computers all with their own complex permissions and relationships. During pentests it's VERY common to use a tool called bloodhound which imports an active directory graph into neo4j. You then use graph algorithms to find miss configuration and paths to traverse to become domain admin, which pretty much always reveals something "unexpected". https://github.com/BloodHoundAD/BloodHound

Lending Club has also done a lot of work in this area: https://github.com/LendingClub/mercator https://www.youtube.com/watch?v=xMsx5pS_VNo And Sacha of Lyft was previously using similar techniques on the red team at Microsoft. The awesome Bloodhound project productizes some of the red team use cases: https://github.com/BloodHoundAD/Bloodhound/wiki