38. Active Directory Attacks and Defence
38.6 BloodHound Attack-Path Analysis
BloodHound graph edges (ideas):
| Edge | Meaning (simple) | Blue action |
|---|---|---|
MemberOf |
User/group nesting | Flatten crazy nesting; remove stale groups |
AdminTo |
Local admin rights on a computer | Least privilege; LAPS; no DA on workstations |
HasSession |
User session on a host (cred theft risk) | Privileged users avoid Tier-2; RDP jump hosts |
GenericAll / WriteDacl |
Dangerous ACL rights on object | ACL reviews; remove unnecessary rights; AdminSDHolder awareness |
ForceChangePassword |
Can reset user password | Limit helpdesk scope; audit 4724 |
Attacker query: "Shortest path to Domain Admins from owned user." Blue query: "Same – then delete edges (rights) until path gone." BloodHound = Red and Blue tool. He khup important aahe.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Imports SharpHound zip; chases path to DA | Monthly Blue BloodHound; ticket to remove AdminTo/GenericAll edges |
Abuses GenericAll on group/user |
ACL change auditing; privileged access workstations; Just-In-Time admin |
Waits for DA HasSession on messy PC |
Block DA on Tier-2; Privileged Access Workstation (PAW) |
Ravindra Bagale's Tip
Students GUI madhe red path baghun ghabrun Domain Admin delete kartat. Path edge remove kara – user delete nako. Example: helpdesk la GenericAll on OU asel tar rights shrink kara. Graph = map for remediation, not panic button.
Lab
BloodHound madhe query: shortest paths to Domain Admins. Jar path asel (tumhi lab madhe shahrukh la local admin on a server dile asel) tar edge note kara → remove that local admin → re-collect → path gayab? Yes/No screenshot. Path nahi asel tar ek intentional weak edge add (lab only), collect, then fix.