Tool Demo: ImproHound - Identify AD Tiering Violations
Jonas Knudsen introduces ImproHound, an open-source tool built on BloodHound data to automatically detect Active Directory tiering violations and dangerous access paths.
Summary
The Challenge of Enforcing Active Directory Tiering
Microsoft's Enterprise Access Model divides Active Directory into three distinct security tiers (Tier 0, Tier 1, Tier 2) to prevent workstation compromise from escalating to domain controllers.
Identifying Lateral Movement Paths in Complex AD Graphs
Jonas Knudsen explains why manual auditing fails in large enterprise directories containing thousands of overlapping ACL permissions and service accounts.
Introducing ImproHound for Automated Tiering Analysis
Knudsen demonstrates ImproHound, an open-source analytical tool that ingests BloodHound graph data to automatically identify tiering violations and high-risk privilege paths.
Remediating Critical Exposure Paths
The author provides administrators with prioritized remediation steps to decouple tiering violations and eliminate dangerous credential exposure.
Related talks
Blue Team Village·41 min
Project Obsidian
Project Obsidian demonstrates detecting SharpHound and BloodHound reconnaissance by hunting anomalous LDAP queries and Active Directory enumeration patterns.
Password Village·51 min
Hank Leininger
Presents PathWell, an open-source engine for evaluating password complexity and enforcing dynamic strength policies in real time.
Blue Team Village·41 min
Scoubi
BloodHound was originally built for Pentesters to easily identify highly complex attack paths but it can also be used to improve the overall security posture of your Active Directory. We will start with a short introd...