
AI-Powered Active Directory Attack Path Analysis with BloodHound - By Ayi NEDJIMI https://ayinedjimi-consultants.fr
+---------------------------+
| BloodHound JSON Export |
| (users, groups, ACLs) |
+-------------+-------------+
|
v
+-------------+-------------+
| Graph Analyzer |
| - Parse BH v3/v4 format |
| - Build NetworkX DiGraph |
| - Detect attack paths |
| - Identify Tier 0/1/2 |
+-------------+-------------+
|
+------+------+------+
| | |
v v v
+-------+ +--+------+ +---+--------+
| Risk | | LLM | | Report |
| Scorer | | Advisor| | Generator |
+---+----+ +---+----+ +---+--------+
| | |
v v v
[Scores] [MITRE Map] [HTML/JSON]
| | |
+------+-----+-----+---+
|
v
+--------+---------+
| CLI Interface |
| analyze | paths |
| score | report |
+------------------+
ADBloodHound-AIはBloodHoundのJSONエクスポートを解析し、グラフ解析と**AI(OpenAI GPT)**を組み合わせて以下を実行します。
git clone https://github.com/ayinedjimi/ADBloodHound-AI.git
cd ADBloodHound-AI
pip install -e ".[dev]"
# オプション:AI機能のためにOpenAI APIキーを設定
export OPENAI_API_KEY="sk-..."
# HTMLレポート付きの完全分析
adbloodhound-ai analyze bloodhound_export.json -d CORP.LOCAL -o report.html
# 特定のユーザーから経路を検索
adbloodhound-ai paths bloodhound_export.json -s "[email protected]"
# 全ノードをスコアリングし、上位20のリスクを取得
adbloodhound-ai score bloodhound_export.json -n 20
# LLM分析付きの完全レポート生成
adbloodhound-ai report bloodhound_export.json -d CORP.LOCAL --llm
[+] Loaded 15423 objects
[+] Graph: 15423 nodes, 47891 edges
[+] Kerberoastable accounts: 23
[+] AS-REP Roastable accounts: 5
[+] DCSync principals: 3
[+] Found 156 attack paths to Domain Admin
[+] Overall domain risk score: 78.5/100
[!] Top 5 riskiest paths:
1. [95.2] SVC_BACKUP -> DOMAIN ADMINS (2 hops)
2. [89.1] HELPDESK1 -> DOMAIN ADMINS (3 hops)
3. [84.7] SVC_SQL -> DOMAIN ADMINS (2 hops)
4. [76.3] IT_ADMIN2 -> ENTERPRISE ADMINS (4 hops)
5. [71.8] WS042.CORP.LOCAL -> DOMAIN ADMINS (5 hops)
ADBloodHound-AIはBloodHoundのJSONエクスポートを解析し、グラフ解析と**AI(OpenAI GPT)**を組み合わせて以下を実行します。
git clone https://github.com/ayinedjimi/ADBloodHound-AI.git
cd ADBloodHound-AI
pip install -e ".[dev]"
# HTMLレポート付きの完全分析
adbloodhound-ai analyze export_bloodhound.json -d CORP.LOCAL -o rapport.html
# 特定のユーザーから経路を検索
adbloodhound-ai paths export.json -s "[email protected]"
# 全ノードをスコアリング
adbloodhound-ai score export.json -n 20
# LLM分析付きの完全レポート生成
adbloodhound-ai report export.json -d CORP.LOCAL --llm
pytest tests/ -v --cov=adbloodhound_ai
Ayi NEDJIMI - サイバーセキュリティ&AIコンサルタント
MITライセンス - LICENSEを参照
| 手法 | MITRE ID | 検出 |
|---|
| Kerberoasting | T1558.003 | ユーザーアカウント上のSPN |
| AS-REP Roasting | T1558.004 | 事前認証無効 |
| DCSync | T1003.006 | GetChangesAll権限 |
| GenericAllの悪用 | T1078 | フルコントロールACE |
| WriteDACLの悪用 | T1078 | DACL変更権限 |
| シャドウ認証情報 | T1078 | KeyCredentialLinkアクセス |