What problem does it solve?
During authorized red team engagements, manually tracing privilege escalation chains through Active Directory ACLs, group memberships, sessions, and delegations is slow and error-prone. This Skill guides the collection of AD relationship data with SharpHound or BloodHound.py and the graph-based analysis needed to reveal hidden attack paths from compromised accounts to high-value targets like Domain Admins.
Core Features & Use Cases
- AD Data Collection: Structured workflow for running SharpHound or BloodHound.py collectors across single and multi-domain environments, including looped session collection.
- Attack Path Analysis: Predefined and custom Cypher queries to find shortest paths to Domain Admins, Kerberoastable and AS-REP roastable accounts, DCSync rights, and ACL abuse edges such as GenericAll, WriteDACL, and AddKeyCredentialLink.
- Exploitation Planning: Prioritization of attack chains with OPSEC considerations, MITRE ATT&CK mapping (T1087.002, T1069.002, T1482, and others), and validation checklists.
- Use Case: During an authorized internal penetration test, an operator compromises a standard user account, collects AD data with SharpHound, marks the account as Owned in BloodHound, and discovers a ForceChangePassword edge chain leading to Domain Admin, which is then verified hop by hop and documented for the report.
Quick Start
Use this skill to plan a BloodHound collection and analysis workflow that finds attack paths from my compromised test account to Domain Admins in the lab domain.
