Breaking the Attack Graph: How to Leverage Graphs to Strengthen Security in a Domain Environment
summary
Describes using graphs built from domain group memberships, local admin lists and domain controller logs to find and cut attack paths; demonstrates Bloodhound mapping paths and go fetch automating lateral movement, and builds a weighted logon graph from a month of behavior to flag low-probability edges. Produces a ranked list of vulnerable computers/users, recommends removing redundant local admins and enforcing network logon/Remote Credential Guard, and verifies detection by finding a two-edge lateral chain where a credential-dumping found on the intermediary machine.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:56BLOODHOUND
- 1:47GOFETCH
- 2:24ATTACKERS VS. DEFENDERS ATTACKERS
- 4:07HOW CAN DEFENDERS USE GRAPHS?
- 4:57DATA SOURCES
- 8:52PREVENTION: VULNERABLE NODES
- 11:57PREVENTION: DISCONNECTING NODES
- 15:08DETECTION: LOGON GRAPH
- 15:45DETECTION: WEIGHTED LOGON GRAPH
- 19:41DETECTION: EXAMPLE
- 22:37DETECTION: PROS & cons
- 24:34INVESTIGATION
related talks
45mFinding Our Path: How We're Trying to Improve Active Directory Security
20mAttack of the Graph: Visual Tools for Cyber Analysis
05mDefenders Think in Lists. Attackers Think in Graphs.
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
38mLight in the Labyrinth: Breach Path Analysis for Anyone
45mHacking Heuristics
45mConnecting the dots to go from tabular security incident data to behavioral graph understanding
50mTelling Fairy Tales to the Board: Turn Attack Graphs into Business Stories