Active Directory attack paths
A graph relationship describes possible control. It does not prove current session state, usable credentials, authorized traversal, or the best route for an operation. Keep those claims separate.
When to Use
- An authorized red-team operation when reviewing AD graphs, nested groups, ACL abuse, delegation, sessions, GPO control, or routes to Tier Zero.
- Use only within explicit authorization and the stated rules of engagement.
When NOT to Use
- Do not treat this skill as permission to access, test, or change a target.
- Do not convert missing evidence into a clean result or a stronger claim.
Workflow
- Confirm the owned starting principals, high-value objectives, allowed evidence reads, allowed traversal actions, and acceptable operational noise.
- Inventory relevant users, groups, computers, GPOs, domains, and trusts. Record whether user and computer accounts are enabled and when volatile evidence was collected.
- Normalize group membership, administrative rights, object-control rights, delegation, GPO-derived control, trusts, and session observations as directed edges. Resolve nested membership before declaring an effective path.
- Give every node and edge an evidence reference and disposition. Current LDAP or security-descriptor evidence can establish a configuration relationship; stale session evidence remains a candidate.
- Enumerate materially distinct paths from each owned principal to each stated objective. Include blocked branches when they explain why a visually connected graph is not viable.
- For every edge, record required actions and operational noise. A structurally proven path may still require separate approval for a password reset, host access, credential interaction, authentication, ticket request, or state change.
- Add remediations that sever every objective path. Prefer the smallest set of relationships or principals that removes the largest amount of reachability.
- Report graph confidence and execution disposition separately. State that coverage applies to the supplied graph, not necessarily the whole domain.
Path decision table
| Evidence state | Path disposition |
|---|---|
| Current configuration evidence, met prerequisites, and every action authorized | Validation candidate; still not achieved access until executed |
| Current configuration evidence but an active transition lacks approval | Structurally proven, approval required |
| Stale session or unverified credential availability | Plausible candidate, not a current path |
| Disabled principal, unmet prerequisite, explicit deny, or prohibited action | Blocked at the named edge |
| Missing graph segment or unknown evidence freshness | Unknown; preserve the gap |
For each objective, report materially distinct paths, the weakest edge in each, required actions, operational signal, authorization state, and the smallest remediation set that severs all reported routes.
Interpretation rules
- A disabled user can retain group membership while blocking a current authentication path. Preserve both facts.
HasSessionis volatile. Its age, logon type, and credential availability determine whether it is evidence or only a lead.- Object control establishes authority over the object. It does not establish that changing the object is authorized or operationally quiet.
- Membership, GPO application, credential access, authentication, and downstream impact are separate transitions.
- An edge after the objective may show business impact without belonging to the path used to reach that objective.
Rationalizations to reject
- "BloodHound drew a line, so the path works." Graph data can be stale, incomplete, or dependent on disabled principals and unmet prerequisites.
- "The shortest path is the best path." A short password reset can be more disruptive and detectable than a longer read-only validation route.
- "Membership proves authentication." Disabled accounts and missing credential material can make a valid membership edge operationally useless.
- "AdminTo proves credentials are available." Host control and a session observation are separate claims; session material may be absent or protected.
- "Read-only authorization covers harmless validation." Resets, logons, ticket requests, host access, credential interaction, and policy changes are active actions regardless of intent.
- "Fixing the first edge closes the domain." Every distinct objective path needs an explicit severing control and evidence after remediation.
