attack-pattern-explore

What problem does it solve?

Manually surveying an unfamiliar BloodHound Enterprise (BHE) deployment for exploitable Active Directory and Azure misconfigurations requires deep specialized knowledge of AD/Azure attack patterns and custom Cypher query authoring, which is time-consuming and prone to oversight for even experienced security analysts.

Core Features & Use Cases

• Curated Attack Pattern Catalog: Includes ~40 pre-built, production-tested Cypher queries covering canonical AD attack patterns (Kerberoasting, unconstrained delegation, SID history abuses) and Azure/PKI patterns (ADCS ESC1-15, ACL abuses, gMSA password reads) to eliminate the need for manual query authoring.
• Finding-Aware Prioritization: Automatically cross-references the attack pattern catalog with your deployment's active findings to run the most relevant patterns first, drastically reducing survey time.
• Impact-Tiered Synthesis: Organizes results into Critical, High, Medium, and Informational buckets with clear context for each finding, enabling rapid prioritization of remediation efforts.
• Use Case: A red teamer or security analyst dropped into an unfamiliar BHE tenant can complete a full self-audit of exploitable misconfigurations in ~30 minutes, a task that would take days to reproduce manually with custom Cypher queries.

Quick Start

Use the attack-pattern-explore skill to conduct a full self-directed survey of your BloodHound Enterprise deployment and get a prioritized list of exploitable AD and Azure attack path findings.