(1/2) One common strategy is to isolate sensitive accounts into certain OUs. Consider this: we have two OUs, "Normal Accounts" and "Sensitive Accounts". Are there attack paths from the normal accounts to the sensitive accounts? 
(2/2) With some cypher magic and #BloodHound's visualizations, we can discover, analyze, measure, and start to remediate those attack paths. Check out these attack paths from a real environment.
Of course, OUs aren't the only "groups" of nodes we can find attack paths between. Domains, geographic locations, business entities, subsidiaries, or a combination of any of those. It's crucial for defenders to enumerate, analyze, and mitigate such attack paths.
Setting any *other* OU as our starting point, we can see what objects from other OUs can compromise our "sensitive accounts", but this quickly starts to outgrow the #BloodHound interface. Combine this with a radial sankey diagram to see *all* attack path flows between *all* OUs.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
