attack-path-analysis

To map attack paths from BloodHound exports, this Skill ingests the topology data and constructs a directed graph to enumerate routes from compromised accounts to sensitive assets, scoring each path to pinpoint critical choke points for security hardening.

Attack path analysis models an IT environment as a directed graph to visualize and score adversarial lateral movement routes. By mapping relationships between identities and assets, graph theory identifies critical choke points that, if secured, block multiple high-risk paths to crown jewels.

Yes, you can analyze attack paths across both Active Directory and AWS IAM. The Skill models Active Directory, Azure AD/Entra ID, and AWS IAM environments together to map potential privilege escalation and lateral movement routes from low-privilege users to domain controllers or sensitive cloud resources.

To prioritize security hardening efforts, the Skill enumerates and scores all potential attack paths to identify critical choke points. Securing these specific intermediate configurations or assets blocks multiple high-risk routes simultaneously, enabling focused threat modeling and red team prioritization.

To perform graph analysis for threat modeling, you need to ingest environment topology, BloodHound exports, and cloud identity data. This input is required to construct the directed graph that enumerates and scores adversarial attack paths from initial access to crown jewels.

The best way to visualize lateral movement routes is by constructing a directed graph from your environment topology and identity data. This Skill uses graph-theoretic principles to model and map adversarial attack paths, providing actionable hardening recommendations by identifying critical choke points.