Object & ACL Security
Attack path management with BloodHound for defenders
Use BloodHound defensively: tag Tier Zero correctly, find choke points, fix attack paths in the right order, and track exposure over time with safe collection.
Advanced
Guides tagged
#acl
Object & ACL Security
AdminSDHolder and SDProp: cleanup and monitoring
Baseline the AdminSDHolder ACL, find orphaned adminCount=1 accounts, reset their ACLs safely, trigger SDProp on demand, and alert on AdminSDHolder changes.
Intermediate
Group Policy & SYSVOL
Auditing GPO permissions and gPLink rights
Find who can edit, create and link GPOs in Active Directory: GPO ACLs, gPLink rights on OUs and sites, Group Policy Creator Owners and WMI filters.
Intermediate
Object & ACL Security
Finding and removing DCSync rights in Active Directory
Audit who holds DS-Replication-Get-Changes-All and equivalent rights on the domain root, remove the ones that should not exist, and alert on DCSync.
Foundation
Object & ACL Security
Auditing Active Directory ACLs before an attacker does
How to find dangerous AD ACLs like GenericAll and DCSync rights, clean up stale adminCount flags, and use BloodHound defensively.
Foundation