[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFHAJ6SFRTR289TFBKYBBC":3,"skill-same:01M6AFHAJ6SFRTR289TFBKYBBC":118},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":62,"ownerHtmlUrl":63,"ownerBlogUrl":64,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M6AFHAJ6SFRTR289TFBKYBBC","mapping-attack-paths-with-bloodhound-ce",null,"Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths using built-in queries and custom Cypher. Use during authorized red-team or penetration-test engagements to map privilege-escalation chains toward domain\u002Ftenant compromise.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-attack-paths-with-bloodhound-ce\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"mapping attack paths with bloodhound ce","bloodhound","entra-id","cypher","azurehound","sharphound","bloodhound-ce","escalation","hybrid-identity","attack-paths","directory","data","privilege-escalation","active-directory","red-team","collect","entra id","identity","test","cybersecurity","2026-11-10 10:12:30",false,"---\nname: mapping-attack-paths-with-bloodhound-ce\ndescription: Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths using built-in queries and custom Cypher. Use during authorized red-team or penetration-test engagements to map privilege-escalation chains toward domain\u002Ftenant compromise.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- bloodhound-ce\n- sharphound\n- azurehound\n- active-directory\n- entra-id\n- attack-paths\n- cypher\n- hybrid-identity\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.AM-03\nmitre_attack:\n- T1069\n---\n# Mapping Attack Paths with BloodHound CE\n\n> **Legal Notice:** This skill is for authorized security testing, red-team engagements, and educational purposes only. Active Directory and Entra ID reconnaissance reveals privilege-escalation chains that lead to full domain\u002Ftenant compromise. Use only against environments you own or have explicit written authorization (rules of engagement) to test. Unauthorized use violates the Computer Fraud and Abuse Act and equivalent laws.\n\n## Overview\n\nBloodHound Community Edition (CE) is SpecterOps's graph-based attack-path-management platform. It models security principals (users, computers, groups, OUs, GPOs, Entra ID users\u002Fgroups\u002Fapps\u002Froles) as nodes and the permissions, group memberships, sessions, trusts, and ACLs between them as edges. By framing Active Directory and Entra ID as a directed graph, BloodHound turns the question \"can this low-privileged account reach Domain Admins \u002F Global Administrator?\" into a shortest-path query that finds escalation chains a human reviewer would miss.\n\nBloodHound CE replaced the legacy Neo4j-only BloodHound with a containerized stack: a Go API server, a PostgreSQL relational store, and a Neo4j graph database, all behind a modern web UI and REST API. Data is gathered by two collectors maintained by SpecterOps:\n\n- **SharpHound** (the CE\u002F.NET collector, run on or against a domain-joined Windows host) gathers on-prem AD: objects, group membership, ACLs, sessions, local-admin rights, trusts, GPOs, certificate services (ADCS), and LAPS readability. It emits a ZIP of JSON.\n- **AzureHound** (a cross-platform Go binary) gathers Entra ID and Azure Resource Manager data via the Microsoft Graph and Azure REST APIs: users, groups, app registrations, service principals, directory roles, subscription\u002Frole assignments, and key vaults. It emits a single JSON file.\n\nAs of recent CE releases, when both an AD domain and its synced Entra ID tenant are ingested, BloodHound automatically renders **Hybrid Attack Paths** — chains that cross the on-prem\u002Fcloud boundary (for example, an on-prem user synced to a cloud account that holds a privileged Entra role). Mapped to MITRE ATT&CK, the core activity is **T1069 – Permission Groups Discovery**, supported by T1087 (Account Discovery), T1482 (Domain Trust Discovery), and T1018 (Remote System Discovery).\n\n## When to Use\n\n- During an authorized internal penetration test or red-team engagement after obtaining any domain foothold or Entra credentials\n- When you need to prioritize escalation routes from owned principals to Tier-0 assets (Domain Admins, Global Administrator)\n- When assessing hybrid identity risk where on-prem AD is synced to Entra ID\n- During purple-team exercises to validate that detections fire on collection and on path-execution steps\n- When producing attack-path evidence and remediation guidance for a defensive client\n\n## Prerequisites\n\n- Authorized scope covering AD\u002FEntra reconnaissance\n- A foothold: any valid domain user (for SharpHound) and\u002For valid Entra credentials or a token (for AzureHound)\n- Docker + Docker Compose on the analysis workstation\n- The collectors:\n  ```bash\n  # Deploy BloodHound CE (pulls Postgres, Neo4j, and the BloodHound API)\n  curl -L https:\u002F\u002Fghst.ly\u002Fgetbhce -o docker-compose.yml\n  docker compose pull\n  docker compose up -d\n  # Reveal the randomly generated initial admin password\n  docker compose logs bloodhound | grep -i \"Initial Password\"\n\n  # AzureHound (download the release binary for your OS from the GitHub releases page)\n  #   https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FAzureHound\u002Freleases\n  chmod +x .\u002Fazurehound\n\n  # SharpHound CE collector: download SharpHound.zip from the BloodHound CE\n  # web UI (Administration -> Download Collectors), transfer to a domain-joined host.\n  ```\n\n## Objectives\n\n- Deploy BloodHound CE and authenticate to the web UI and API\n- Collect AD data with SharpHound and Entra data with AzureHound\n- Ingest both datasets and mark compromised principals as Owned\n- Run built-in analysis (Shortest Path to Domain Admins, Kerberoastable accounts, ADCS abuse)\n- Author custom Cypher queries for bespoke and hybrid attack paths\n- Prioritize and document escalation routes for the engagement report\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Application in this skill |\n|----|-----------|---------------------------|\n| T1069 | Permission Groups Discovery | Enumerating AD\u002FEntra group memberships and the permissions between principals to build the attack graph |\n| T1087 | Account Discovery | SharpHound\u002FAzureHound enumeration of users, computers, and service principals |\n| T1482 | Domain Trust Discovery | Collecting and analyzing domain\u002Fforest trust relationships as graph edges |\n| T1018 | Remote System Discovery | Enumerating domain computers and their relationships (sessions, local admin) |\n\n## Workflow\n\n### Step 1: Deploy BloodHound CE and log in\nBring up the stack, retrieve the generated password, and reset it on first login.\n\n```bash\ndocker compose up -d\ndocker compose logs bloodhound 2>&1 | grep -i \"Initial Password\"\n# Browse to http:\u002F\u002Flocalhost:8080  (default user: admin)\n```\n\n### Step 2: Collect on-prem AD data with SharpHound\nOn a domain-joined Windows host (or via `runas`\u002Ftoken of a domain user), run the CE collector. `-c All` gathers every collection method; `--outputdirectory` controls where the ZIP lands.\n\n```powershell\n# Full collection\n.\\SharpHound.exe -c All --outputdirectory C:\\Temp\n\n# Stealthier LDAP-only collection (no host touch for sessions\u002Flocal-admin)\n.\\SharpHound.exe -c DCOnly --outputdirectory C:\\Temp\n\n# Looped session collection to map logged-on Tier-0 users over time\n.\\SharpHound.exe -c Session --loop --loopduration 02:00:00 --outputdirectory C:\\Temp\n```\n\nFrom Linux, the Python collector (`bloodhound-ce-python`) is an alternative when you only have credentials and network access:\n\n```bash\npip install bloodhound-ce\nbloodhound-ce-python -u 'jdoe' -p 'Passw0rd!' -d corp.local -ns 10.0.0.10 -c All --zip\n```\n\n### Step 3: Collect Entra ID \u002F Azure data with AzureHound\nRun AzureHound `list` with credentials, a JWT, or a refresh token, writing a single JSON file.\n\n```bash\n# Username\u002Fpassword (where allowed by CA\u002FMFA policy)\n.\u002Fazurehound list -u \"user@corp.com\" -p \"$PASSWORD\" -t \"corp.com\" -o entra.json\n\n# Using a previously acquired JWT (e.g., from roadtx \u002F device-code phishing)\n.\u002Fazurehound list --jwt \"$JWT\" -o entra.json\n\n# Using a refresh token\n.\u002Fazurehound list --refresh-token \"$REFRESH_TOKEN\" -t \"\u003Ctenant-id>\" -o entra.json\n```\n\n### Step 4: Ingest data into BloodHound CE\nUpload the SharpHound ZIP and the AzureHound JSON through **Administration -> File Ingest**, or POST to the API.\n\n```bash\n# API ingest (after obtaining a JWT from \u002Fapi\u002Fv2\u002Flogin)\nTOKEN=$(curl -s http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv2\u002Flogin \\\n  -H 'Content-Type: application\u002Fjson' \\\n  -d '{\"login_method\":\"secret\",\"username\":\"admin\",\"secret\":\"\u003Cpassword>\"}' \\\n  | python -c \"import sys,json;print(json.load(sys.stdin)['data']['session_token'])\")\n\n# Start a file-upload job, then PUT the collector ZIP\u002FJSON to it\nJOB=$(curl -s -X POST http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv2\u002Ffile-upload\u002Fstart \\\n  -H \"Authorization: Bearer $TOKEN\" | python -c \"import sys,json;print(json.load(sys.stdin)['data']['id'])\")\ncurl -s -X PUT \"http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv2\u002Ffile-upload\u002F$JOB\" \\\n  -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\u002Fzip' \\\n  --data-binary @C:\u002FTemp\u002FBloodHound.zip\ncurl -s -X POST \"http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv2\u002Ffile-upload\u002F$JOB\u002Fend\" \\\n  -H \"Authorization: Bearer $TOKEN\"\n```\n\n### Step 5: Mark owned principals\nIn the UI, search for each compromised account\u002Fcomputer, open the node, and toggle **Mark as Owned**. Owned principals seed pathfinding queries (`{owned:true}`).\n\n### Step 6: Run built-in analysis queries\nOpen the **Cypher** tab or use the pre-built queries in the search panel:\n\n- Shortest Path to Domain Admins\n- Kerberoastable accounts with a path to high value\n- AS-REP roastable users\n- Principals with DCSync rights\n- ADCS misconfigurations (ESC1-ESC8 edges in CE)\n- Computers with unconstrained delegation\n\n### Step 7: Author custom Cypher for bespoke paths\nUse Cypher for paths the built-ins do not cover, including hybrid AD-to-Entra chains.\n\n```cypher\n\u002F\u002F Shortest path from any owned principal to Domain Admins\nMATCH p=shortestPath((n {owned:true})-[*1..]->(g:Group))\nWHERE g.objectid ENDS WITH \"-512\"\nRETURN p\n\n\u002F\u002F Kerberoastable users (SPN set) with a path to Domain Admins\nMATCH (u:User {hasspn:true})\nMATCH p=shortestPath((u)-[*1..]->(g:Group))\nWHERE g.objectid ENDS WITH \"-512\"\nRETURN p\n\n\u002F\u002F Principals who can DCSync the domain\nMATCH (n)-[:MemberOf*0..]->()-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)\nRETURN n.name, d.name\n\n\u002F\u002F ACL abuse from owned principals (GenericAll\u002FWriteDacl\u002FWriteOwner\u002FForceChangePassword)\nMATCH p=(n {owned:true})-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(t)\nRETURN p\n\n\u002F\u002F Hybrid: on-prem user synced to an Entra account holding a privileged directory role\nMATCH p=(u:User)-[:SyncedToEntraUser]->(:AZUser)-[:AZHasRole|AZGlobalAdmin*1..]->(r)\nRETURN p\n```\n\n### Step 8: Prioritize and document\nRank paths by hop count, stealth (avoid noisy edges like HasSession requiring host touch), and tooling availability. Record each path with the principals, edges, required actions, and a remediation note (e.g., remove the abusable ACL, tier the account).\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| BloodHound CE | Graph attack-path platform (Docker stack) | https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FBloodHound |\n| SharpHound (CE) | On-prem AD collector | https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FSharpHound |\n| AzureHound | Entra ID \u002F Azure RM collector | https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FAzureHound |\n| bloodhound-ce-python | Linux Python AD collector | https:\u002F\u002Fgithub.com\u002Fdirkjanm\u002FBloodHound.py |\n| CE Quickstart | Official deployment docs | https:\u002F\u002Fbloodhound.specterops.io\u002Fget-started\u002Fquickstart\u002Fcommunity-edition-quickstart |\n| BloodHound Cypher refs | Edge\u002Fquery documentation | https:\u002F\u002Fbloodhound.specterops.io\u002F |\n\n## Key Edge \u002F Path Types\n\n| Edge \u002F Path | Meaning | Escalation example |\n|-------------|---------|--------------------|\n| MemberOf | Group membership | Nested group reaches Domain Admins |\n| GenericAll \u002F WriteDacl | Full\u002FACL control over an object | Reset a privileged user's password |\n| ForceChangePassword | Can reset another principal's password | Take over a Tier-0 account |\n| HasSession | A user is logged into a computer | Steal a DA token from a compromised host |\n| ADCSESC1..ESC8 | Certificate services misconfig | Enroll a cert as a privileged principal |\n| SyncedToEntraUser \u002F AZGlobalAdmin | Hybrid identity edges | On-prem foothold -> cloud Global Admin |\n\n## Validation Criteria\n\n- [ ] BloodHound CE deployed and reachable; default admin password rotated\n- [ ] SharpHound data collected from all in-scope domains\n- [ ] AzureHound JSON collected for the in-scope tenant (if hybrid\u002Fcloud in scope)\n- [ ] Both datasets ingested successfully (no failed upload jobs)\n- [ ] Compromised principals marked as Owned\n- [ ] Shortest paths to Domain Admins \u002F Global Administrator identified\n- [ ] ADCS and ACL-abuse paths enumerated\n- [ ] At least one custom Cypher query (including a hybrid query where applicable) executed\n- [ ] Paths prioritized by hops\u002Fstealth and documented with remediation\n","# Mapping Attack Paths with BloodHound CE\n\n> **Legal Notice:** This skill is for authorized security testing, red-team engagements, and educational purposes only. Active Directory and Entra ID reconnaissance reveals privilege-escalation chains that lead to full domain\u002Ftenant compromise. Use only against environments you own or have explicit written authorization (rules of engagement) to test. Unauthorized use violates the Computer Fraud and Abuse Act and equivalent laws.\n\n## Overview\n\nBloodHound Community Edition (CE) is SpecterOps's graph-based attack-path-management platform. It models security principals (users, computers, groups, OUs, GPOs, Entra ID users\u002Fgroups\u002Fapps\u002Froles) as nodes and the permissions, group memberships, sessions, trusts, and ACLs between them as edges. By framing Active Directory and Entra ID as a directed graph, BloodHound turns the question \"can this low-privileged account reach Domain Admins \u002F Global Administrator?\" into a shortest-path query that finds escalation chains a human reviewer would miss.\n\nBloodHound CE replaced the legacy Neo4j-only BloodHound with a containerized stack: a Go API server, a PostgreSQL relational store, and a Neo4j graph database, all behind a modern web UI and REST API. Data is gathered by two collectors maintained by SpecterOps:\n\n- **SharpHound** (the CE\u002F.NET collector, run on or against a domain-joined Windows host) gathers on-prem AD: objects, group membership, ACLs, sessions, local-admin rights, trusts, GPOs, certificate services (ADCS), and LAPS readability. It emits a ZIP of JSON.\n- **AzureHound** (a cross-platform Go binary) gathers Entra ID and Azure Resource Manager data via the Microsoft Graph and Azure REST APIs: users, groups, app registrations, service principals, directory roles, subscription\u002Frole assignments, and key vaults. It emits a single JSON file.\n\nAs of recent CE releases, when both an AD domain and its synced Entra ID tenant are ingested, BloodHound automatically renders **Hybrid Attack Paths** — chains that cross the on-prem\u002Fcloud boundary (for example, an on-prem user synced to a cloud account that holds a privileged Entra role). Mapped to MITRE ATT&CK, the core activity is **T1069 – Permission Groups Discovery**, supported by T1087 (Account Discovery), T1482 (Domain Trust Discovery), and T1018 (Remote System Discovery).\n\n## When to Use\n\n- During an authorized internal penetration test or red-team engagement after obtaining any domain foothold or Entra credentials\n- When you need to prioritize escalation routes from owned principals to Tier-0 assets (Domain Admins, Global Administrator)\n- When assessing hybrid identity risk where on-prem AD is synced to Entra ID\n- During purple-team exercises to validate that detections fire on collection and on path-execution steps\n- When producing attack-path evidence and remediation guidance for a defensive client\n\n## Prerequisites\n\n- Authorized scope covering AD\u002FEntra reconnaissance\n- A foothold: any valid domain user (for SharpHound) and\u002For valid Entra credentials or a token (for AzureHound)\n- Docker + Docker Compose on the analysis workstation\n- The collectors:\n  ```bash\n  # Deploy BloodHound CE (pulls Postgres, Neo4j, and the BloodHound API)\n  curl -L https:\u002F\u002Fghst.ly\u002Fgetbhce -o docker-compose.yml\n  docker compose pull\n  docker compose up -d\n  # Reveal the randomly generated initial admin password\n  docker compose logs bloodhound | grep -i \"Initial Password\"\n\n  # AzureHound (download the release binary for your OS from the GitHub releases page)\n  #   https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FAzureHound\u002Freleases\n  chmod +x .\u002Fazurehound\n\n  # SharpHound CE collector: download SharpHound.zip from the BloodHound CE\n  # web UI (Administration -> Download Collectors), transfer to a domain-joined host.\n  ```\n\n## Objectives\n\n- Deploy BloodHound CE and authenticate to the web UI and API\n- Collect AD data with SharpHound and Entra data with AzureHound\n- Ingest both datasets and mark compromised principals as Owned\n- Run built-in analysis (Shortest Path to Domain Admins, Kerberoastable accounts, ADCS abuse)\n- Author custom Cypher queries for bespoke and hybrid attack paths\n- Prioritize and document escalation routes for the engagement report\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Application in this skill |\n|----|-----------|---------------------------|\n| T1069 | Permission Groups Discovery | Enumerating AD\u002FEntra group memberships and the permissions between principals to build the attack graph |\n| T1087 | Account Discovery | SharpHound\u002FAzureHound enumeration of users, computers, and service principals |\n| T1482 | Domain Trust Discovery | Collecting and analyzing domain\u002Fforest trust relationships as graph edges |\n| T1018 | Remote System Discovery | Enumerating domain computers and their relationships (sessions, local admin) |\n\n## Workflow\n\n### Step 1: Deploy BloodHound CE and log in\nBring up the stack, retrieve the generated password, and reset it on first login.\n\n```bash\ndocker compose up -d\ndocker compose logs bloodhound 2>&1 | grep -i \"Initial Password\"\n# Browse to http:\u002F\u002Flocalhost:8080  (default user: admin)\n```\n\n### Step 2: Collect on-prem AD data with SharpHound\nOn a domain-joined Windows host (or via `runas`\u002Ftoken of a domain user), run the CE collector. `-c All` gathers every collection method; `--outputdirectory` controls where the ZIP lands.\n\n```powershell\n# Full collection\n.\\SharpHound.exe -c All --outputdirectory C:\\Temp\n\n# Stealthier LDAP-only collection (no host touch for sessions\u002Flocal-admin)\n.\\SharpHound.exe -c DCOnly --outputdirectory C:\\Temp\n\n# Looped session collection to map logged-on Tier-0 users over time\n.\\SharpHound.exe -c Session --loop --loopduration 02:00:00 --outputdirectory C:\\Temp\n```\n\nFrom Linux, the Python collector (`bloodhound-ce-python`) is an alternative when you only have credentials and network access:\n\n```bash\npip install bloodhound-ce\nbloodhound-ce-python -u 'jdoe' -p 'Passw0rd!' -d corp.local -ns 10.0.0.10 -c All --zip\n```\n\n### Step 3: Collect Entra ID \u002F Azure data with AzureHound\nRun AzureHound `list` with credentials, a JWT, or a refresh token, writing a single JSON file.\n\n```bash\n# Username\u002Fpassword (where allowed by CA\u002FMFA policy)\n.\u002Fazurehound list -u \"user@corp.com\" -p \"$PASSWORD\" -t \"corp.com\" -o entra.json\n\n# Using a previously acquired JWT (e.g., from roadtx \u002F device-code phishing)\n.\u002Fazurehound list --jwt \"$JWT\" -o entra.json\n\n# Using a refresh token\n.\u002Fazurehound list --refresh-token \"$REFRESH_TOKEN\" -t \"\u003Ctenant-id>\" -o entra.json\n```\n\n### Step 4: Ingest data into BloodHound CE\nUpload the SharpHound ZIP and the AzureHound JSON through **Administration -> File Ingest**, or POST to the API.\n\n```bash\n# API ingest (after obtaining a JWT from \u002Fapi\u002Fv2\u002Flogin)\nTOKEN=$(curl -s http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv2\u002Flogin \\\n  -H 'Content-Type: application\u002Fjson' \\\n  -d '{\"login_method\":\"secret\",\"username\":\"admin\",\"secret\":\"\u003Cpassword>\"}' \\\n  | python -c \"import sys,json;print(json.load(sys.stdin)['data']['session_token'])\")\n\n# Start a file-upload job, then PUT the collector ZIP\u002FJSON to it\nJOB=$(curl -s -X POST http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv2\u002Ffile-upload\u002Fstart \\\n  -H \"Authorization: Bearer $TOKEN\" | python -c \"import sys,json;print(json.load(sys.stdin)['data']['id'])\")\ncurl -s -X PUT \"http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv2\u002Ffile-upload\u002F$JOB\" \\\n  -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\u002Fzip' \\\n  --data-binary @C:\u002FTemp\u002FBloodHound.zip\ncurl -s -X POST \"http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv2\u002Ffile-upload\u002F$JOB\u002Fend\" \\\n  -H \"Authorization: Bearer $TOKEN\"\n```\n\n### Step 5: Mark owned principals\nIn the UI, search for each compromised account\u002Fcomputer, open the node, and toggle **Mark as Owned**. Owned principals seed pathfinding queries (`{owned:true}`).\n\n### Step 6: Run built-in analysis queries\nOpen the **Cypher** tab or use the pre-built queries in the search panel:\n\n- Shortest Path to Domain Admins\n- Kerberoastable accounts with a path to high value\n- AS-REP roastable users\n- Principals with DCSync rights\n- ADCS misconfigurations (ESC1-ESC8 edges in CE)\n- Computers with unconstrained delegation\n\n### Step 7: Author custom Cypher for bespoke paths\nUse Cypher for paths the built-ins do not cover, including hybrid AD-to-Entra chains.\n\n```cypher\n\u002F\u002F Shortest path from any owned principal to Domain Admins\nMATCH p=shortestPath((n {owned:true})-[*1..]->(g:Group))\nWHERE g.objectid ENDS WITH \"-512\"\nRETURN p\n\n\u002F\u002F Kerberoastable users (SPN set) with a path to Domain Admins\nMATCH (u:User {hasspn:true})\nMATCH p=shortestPath((u)-[*1..]->(g:Group))\nWHERE g.objectid ENDS WITH \"-512\"\nRETURN p\n\n\u002F\u002F Principals who can DCSync the domain\nMATCH (n)-[:MemberOf*0..]->()-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)\nRETURN n.name, d.name\n\n\u002F\u002F ACL abuse from owned principals (GenericAll\u002FWriteDacl\u002FWriteOwner\u002FForceChangePassword)\nMATCH p=(n {owned:true})-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(t)\nRETURN p\n\n\u002F\u002F Hybrid: on-prem user synced to an Entra account holding a privileged directory role\nMATCH p=(u:User)-[:SyncedToEntraUser]->(:AZUser)-[:AZHasRole|AZGlobalAdmin*1..]->(r)\nRETURN p\n```\n\n### Step 8: Prioritize and document\nRank paths by hop count, stealth (avoid noisy edges like HasSession requiring host touch), and tooling availability. Record each path with the principals, edges, required actions, and a remediation note (e.g., remove the abusable ACL, tier the account).\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| BloodHound CE | Graph attack-path platform (Docker stack) | https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FBloodHound |\n| SharpHound (CE) | On-prem AD collector | https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FSharpHound |\n| AzureHound | Entra ID \u002F Azure RM collector | https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FAzureHound |\n| bloodhound-ce-python | Linux Python AD collector | https:\u002F\u002Fgithub.com\u002Fdirkjanm\u002FBloodHound.py |\n| CE Quickstart | Official deployment docs | https:\u002F\u002Fbloodhound.specterops.io\u002Fget-started\u002Fquickstart\u002Fcommunity-edition-quickstart |\n| BloodHound Cypher refs | Edge\u002Fquery documentation | https:\u002F\u002Fbloodhound.specterops.io\u002F |\n\n## Key Edge \u002F Path Types\n\n| Edge \u002F Path | Meaning | Escalation example |\n|-------------|---------|--------------------|\n| MemberOf | Group membership | Nested group reaches Domain Admins |\n| GenericAll \u002F WriteDacl | Full\u002FACL control over an object | Reset a privileged user's password |\n| ForceChangePassword | Can reset another principal's password | Take over a Tier-0 account |\n| HasSession | A user is logged into a computer | Steal a DA token from a compromised host |\n| ADCSESC1..ESC8 | Certificate services misconfig | Enroll a cert as a privileged principal |\n| SyncedToEntraUser \u002F AZGlobalAdmin | Hybrid identity edges | On-prem foothold -> cloud Global Admin |\n\n## Validation Criteria\n\n- [ ] BloodHound CE deployed and reachable; default admin password rotated\n- [ ] SharpHound data collected from all in-scope domains\n- [ ] AzureHound JSON collected for the in-scope tenant (if hybrid\u002Fcloud in scope)\n- [ ] Both datasets ingested successfully (no failed upload jobs)\n- [ ] Compromised principals marked as Owned\n- [ ] Shortest paths to Domain Admins \u002F Global Administrator identified\n- [ ] ADCS and ACL-abuse paths enumerated\n- [ ] At least one custom Cypher query (including a hybrid query where applicable) executed\n- [ ] Paths prioritized by hops\u002Fstealth and documented with remediation\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"nist_csf":52,"subdomain":54,"description":7,"mitre_attack":55},[30,29,28,37,26,33,27,32],"mahipal","1.0",[53],"ID.AM-03","red-teaming",[56],"T1069","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fmapping-attack-paths-with-bloodhound-ce",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill mapping-attack-paths-with-bloodhound-ce",{"tool":73,"command":74},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill mapping-attack-paths-with-bloodhound-ce",{"tool":76,"command":77},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill mapping-attack-paths-with-bloodhound-ce","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-attack-paths-with-bloodhound-ce\u002FSKILL.md",true,[81,86,92,96,102,106,110,114],{"path":82,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-attack-paths-with-bloodhound-ce\u002FLICENSE",{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fapi-reference.md","REFERENCE","参考文档",2284,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-attack-paths-with-bloodhound-ce\u002Freferences\u002Fapi-reference.md",{"path":93,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fstandards.md",1222,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-attack-paths-with-bloodhound-ce\u002Freferences\u002Fstandards.md",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Fagent.py","SCRIPT","脚本",4842,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-attack-paths-with-bloodhound-ce\u002Fscripts\u002Fagent.py",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fdecision-convert-definition.mjs",1026,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Faddons\u002Fdecision-engine\u002Fskills\u002Fdecision-evaluate\u002Fscripts\u002Fdecision-convert-definition.mjs",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fdecision-evaluate-core.mjs",8507,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Faddons\u002Fdecision-engine\u002Fskills\u002Fdecision-evaluate\u002Fscripts\u002Fdecision-evaluate-core.mjs",{"path":111,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":112,"sourceHtmlUrl":113},"scripts\u002Fdecision-evaluate.mjs",811,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Faddons\u002Fdecision-engine\u002Fskills\u002Fdecision-evaluate\u002Fscripts\u002Fdecision-evaluate.mjs",{"path":115,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":116,"sourceHtmlUrl":117},"scripts\u002Fruntime-root.mjs",2580,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Faddons\u002Fdecision-engine\u002Fskills\u002Fdecision-evaluate\u002Fscripts\u002Fruntime-root.mjs",[119,145,169,197,222,249],{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":126,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[125],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[127,128,129,130,131,43,132,41,133,134,135,136,137,138,139,140,141,142,143,144],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[151],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[153,141,154,155,131,156,43,133,157,158,159,160,161,162,163,164,165,166,167,168],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":179,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[175,178],{"categoryNo":176,"categoryName":177,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,180,181,182,183,43,184,185,157,186,187,188,189,190,191,192,193,194,195,196],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":204,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[203],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[205,206,207,43,208,209,210,211,212,213,214,35,215,216,217,218,160,219,220,221],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":229,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[228],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[230,231,232,43,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":250,"name":251,"nameZh":6,"description":252,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":253,"categories":254,"keywords":256,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[255],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[131,257,43,258,259,260,261,262,263,264,265,192,266,193,267,268,269,270,271,272],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]