38. Active Directory Attacks and Defence
38.6 BloodHound Attack-Path Analysis
BloodHound graph edges (ideas):
| Edge | Meaning (simple) | Blue action |
|---|---|---|
MemberOf |
User/group nesting | Flatten crazy nesting; remove stale groups |
AdminTo |
Local admin rights on a computer | Least privilege; LAPS; no DA on workstations |
HasSession |
User session on a host (cred theft risk) | Privileged users avoid Tier-2; RDP jump hosts |
GenericAll / WriteDacl |
Dangerous ACL rights on object | ACL reviews; remove unnecessary rights; AdminSDHolder awareness |
ForceChangePassword |
Can reset user password | Limit helpdesk scope; audit 4724 |
Attacker query: "Shortest path to Domain Admins from owned user." Blue query: "Same – then delete edges (rights) until path gone." BloodHound = Red and Blue tool. He khup important aahe.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Imports SharpHound zip; chases path to DA | Monthly Blue BloodHound; ticket to remove AdminTo/GenericAll edges |
Abuses GenericAll on group/user |
ACL change auditing; privileged access workstations; Just-In-Time admin |
Waits for DA HasSession on messy PC |
Block DA on Tier-2; Privileged Access Workstation (PAW) |
Ravindra Bagale's Tip
Students see a red path in the GUI, panic and delete the Domain Admin. Remove the path's edge – don't delete the user. Example: if helpdesk has GenericAll on an OU, shrink those rights. The graph is a map for remediation, not a panic button.
Ravindra Bagale's Tip – मराठी
Students GUI मध्ये red path बघून घाबरून Domain Admin delete करतात. Path चा edge remove करा – user delete नको. Example: helpdesk ला OU वर GenericAll असेल तर rights कमी करा. Graph = remediation साठी map, panic button नाही.
Ravindra Bagale's Tip – हिंदी
Students GUI में red path देखकर घबराकर Domain Admin delete कर देते हैं. Path का edge remove करो – user delete नहीं. Example: helpdesk को OU पर GenericAll हो तो rights कम करो. Graph = remediation के लिए map, panic button नहीं.
Lab
BloodHound madhe query: shortest paths to Domain Admins. Jar path asel (tumhi lab madhe shahrukh la local admin on a server dile asel) tar edge note kara → remove that local admin → re-collect → path gayab? Yes/No screenshot. Path nahi asel tar ek intentional weak edge add (lab only), collect, then fix.