What problem does it solve?
Security teams and red teamers often struggle to quickly and comprehensively assess the access scope, compromise risk, and blast radius of individual Active Directory or Azure AD principals during incident response, attack path triage, or access reviews, as manually tracing cross-entity relationships and privilege assignments is time-consuming and error-prone.
Core Features & Use Cases
- Inbound Access Mapping: Identifies all principals that can compromise the target entity, including direct admin rights, group membership inheritance, and Tier Zero associations to highlight high-risk control paths.
- Outbound Access Mapping: Enumerates all resources the principal can access, including local admin rights, RDP, WinRM, DCOM, SQL admin, and constrained delegation targets to quantify potential attack impact.
- Session & Membership Context: Surfaces active logon sessions and direct/transitive group memberships to flag credential theft opportunities and unexpected privilege escalations.
Use Case: A red teamer investigating a newly discovered Tier Zero service account can use this skill to quickly map all machines the account has admin access to and all principals that can take over the account to prioritize high-impact attack paths.
Quick Start
Use the ad-entity-walk skill to investigate the full access scope and blast radius of the AD principal with object ID 7a8b9c0d-1234-5678-90ab-cdef01234567.
