Thread by @_wald0

🧵In May of 2021, we published our manifesto on a new methodology called Attack Path Management - posts.specterops.io/the-attack-pat….

Enough time has passed now that we are starting to see the outcomes of this methodology, which I'd like to talk to you about:

Strip away the brands, the tools, the people, and everything else, and you are left with the only thing that REALLY matters:

The problem.

The problem that APM seeks to solve is the persistent availability and reliability of attack paths.

Pentesters, red teamers, and real attackers have been abusing attack paths, specifically in Active Directory, for over 20 years. AD attack paths are INSANELY reliable. They can be abused with reliable tools, including legitimate admin tools like Powershell and PsExec.

Think about that: 20 years of abusing AD attack paths. 20 years is a generation of people. In the world of computers, 20 years is an eternity of eternities.

We should not be talking about attack paths 20 years from now.

There are various tools implementing Attack Path Management, including BloodHound Enterprise. Our customers are using BHE to knock out millions, even billions of attack paths in their AD environments in a matter of days and weeks.

It has gotten to the point where our own red team, and some of our red team friends in the industry, simply cannot escalate rights in AD anymore where BHE is deployed. That's a huge, huge, huge win for our customers and the methodology itself.

BHE isn't the only tool doing APM.

You can check out ImproHound, which finds tiering violations for you: github.com/improsec/Impro…
I also think @illumio is doing great APM work in layers 2 and 3: illumio.com

Eventually we will put together a formal report sharing the statistics we are seeing with BHE and make it freely available to everyone. Until then, you can learn more about BHE here: bloodhoundenterprise.io