TR19: BloodHound and the Adversary Resilience Methodology

### Overview In this presentation, Andrew Robbins and Rohan discuss how defenders can leverage BloodHound—historically an offensive Active Directory (AD) permissions mapping tool—to improve enterprise AD security posture through graph-based analysis. Grounded in John Lambert's quote that 'defenders think in lists, attackers think in graphs,' the speakers present practical auditing methodologies, real-world case studies, and new analytical tooling designed to identify and eliminate systemic attack paths.

### Key Topics - **BloodHound 2.1 Release Features**: Recent additions include support for resource-based constrained delegation (using the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute and Will Schroeder's Rubeus research), an edge UI for exploitation and abuse info, a database warm-up button to load graphs into Neo4j RAM, optimized Cypher queries, improved data ingestion speed, and SharpHound collector updates (such as improved ACL parsing logic and detection fallback). - **Active Directory Auditing via Graphs**: Using Cypher queries in Neo4j to audit complex permissions, including inbound AD object control (who can control Domain Admins), Group Policy Object (GPO) abuse paths (non-DA principals controlling GPOs linked to DAs), and least-privilege violations (identifying hosts with thousands of local admins). - **Eliminating Stale Object Control (PrivExchange Case Study)**: Addressing excessive AD permissions granted by default Exchange installations. Exchange servers often inherit `WriteDacl` rights over the domain head from legacy installers (e.g., Exchange Server 2003), allowing attackers to perform DCSync. The speakers outline how to safely remove these permissions by deploying targeted System Access Control Lists (SACLs) and monitoring for Windows Event 5136. - **Cross-Domain and Forest Attack Paths**: Demonstrating that Active Directory domain trusts are not security boundaries. Organizations often suffer from foreign local administrators and cross-domain group nesting, allowing low-privileged domain users to pivot through multiple trusts to forest-level compromise. - **BloodHound Analytics Tooling**: The introduction of two open-source (GPLv3) tools to measure and monitor AD resilience: a Power BI workbook (`BloodHoundAnalytics.pbix`) and a QA verification script (`bloodhound_analytics.py`).

### Technical Details - **Auditing GPOs**: Manual enumeration requires tracing linked OUs, inheritance blocks, WMI filters, and GUID lookups in ADUC. BloodHound maps these relationships natively, allowing single Cypher queries to isolate foreign groups or users with write/edit access to GPOs affecting Domain Admins. - **SACL Validation Workflow**: To address fears that revoking dangerous permissions will cause operational outages, defenders can configure an auditing ACE in the target object's SACL (such as success auditing on the `modify_permissions` right for the Exchange Trusted Subsystem). If no Event 5136 is generated over a chosen evaluation period (e.g., 14 months in the speakers' client case), the corresponding discretionary ACE (`WriteDacl`) can be safely deleted without breaking service functionality. - **BloodHound Analytics Suite**: - `BloodHoundAnalytics.pbix`: Connects directly to Neo4j to generate visual dashboards, highlighting metrics such as the percentage of users with an attack path to Domain Admin, high-risk groups, and distributions of local admin rights across endpoints. - `bloodhound_analytics.py`: Performs data completeness quality checks (noting that most environments only capture ~5% of user sessions), audits universal critical asset risks (e.g., RDP or local admin rights on Domain Controllers), and maps cross-domain exposure.

### Takeaways Defenders cannot secure modern Active Directory environments using traditional flat lists and static spreadsheets. By viewing AD relationships as an attack graph, blue teams can locate critical bottleneck permissions, safely validate revocation through Windows event SACLs, and systematically sever attack paths before adversaries can exploit them.