CopperHound

Open-source Active Directory, ADCS and Entra ID / Azure attack-path analysis, built in Rust for very large environments. CopperHound ingests SharpHound, bloodhound-python, ldapdomaindump and AzureHound output, raw LDIF dumps and Sysinternals AD Explorer snapshots into a memory-mapped graph store and runs path, exposure and CHQL queries directly on it, with no graph database. One container serves the web UI and REST API.

_{Screenshots use fabricated demo data (scripts/demo_data.py).}

Documentation: User guide · Deployment · Data sources · REST API · CHQL · Edge reference · Performance · Architecture

Quick start (Docker)

docker compose up -d --build
docker compose logs copperhound | grep "Initial admin password"

Open http://127.0.0.1:8090, sign in as admin, drop your SharpHound / AzureHound .zip or .json files on the Data tab and press Rebuild graph. COPPERHOUND_ADMIN_PASSWORD sets the password, and COPPERHOUND_PORT / COPPERHOUND_HOST change the published address (default 127.0.0.1:8090, so it can run next to BloodHound on 8080).

No data yet? python scripts/demo_data.py demo/ writes a fabricated environment (AD, ADCS and Entra ID with deliberate weaknesses) to upload; see Try it with demo data.

Without Docker: cd web && npm ci && npm run build, then cargo run --release -- serve (defaults: 127.0.0.1:8080, data in ./data, UI from ./web/dist).

Accounts, API tokens, the watch folder, scheduled reports, change alerts, HTTPS and single sign-on (OpenID Connect, SAML 2.0): docs/DEPLOYMENT.md.

Risk analysis

Computed in the background after every ingest:

• Attack-path findings — 30 finding types across AD, ADCS, Entra ID and hybrid (DCSync outside Tier Zero, control of Tier Zero, rights of broad groups, delegation to Tier Zero, ESC escalations, tenant-takeover Graph permissions, synced accounts holding Entra Tier Zero roles, …), each with severity, impact, remediation guidance and MITRE ATT&CK techniques. Every edge finding is measured: "fixing this removes N principals' paths to Tier Zero", computed by re-running the exposure analysis without its edges.
• What-if simulation — remove any set of edges, edge kinds or nodes (or add targets) and see before/after exposure per kind, instantly.
• Remediation planner — a dominator tree over every attack path finds the choke object whose fix cuts the most principals off from the zone entirely. The plan is recomputed after each step, so the cumulative reduction curve is exact. Members of zone groups are treated as part of the zone, so it never proposes "remove the admins from Domain Admins".
• Remediation hand-off — turn fix-list edges or plan steps into a PowerShell script (one suggested command per edge, objects named by SID / object id) or into Jira issues, ServiceNow records or signed webhook events with the guidance and command for each edge.
• Privilege zones — define your own target sets with a CHQL selector ("Tier 1 servers", "Finance file servers", …) and get exposure, choke points and remediation plans for each. In a zone's member review you certify the members that belong and revoke ones the rule picked up by mistake (they drop out of the zone); new matches show as pending.
• Posture over time — one snapshot per ingest (exposure %, findings by severity, per-finding counts) and a diff between any two snapshots listing exactly which finding items appeared or were resolved.

CLI equivalents: copperhound findings corp.chg, copperhound plan corp.chg --steps 10.

Web UI

A WebGL graph canvas (sigma.js) with search, pathfinding, node details, "How was this derived?" for every derived edge, the CHQL editor and query library, and pages for findings, remediation, zones, posture, reports, data and administration. Walkthrough with screenshots: docs/USER_GUIDE.md.

CHQL

A read-only Cypher dialect compiled to native graph operations — multiple patterns and MATCH clauses, OPTIONAL MATCH, WITH, aggregation, ORDER BY/SKIP/LIMIT, UNION, undirected and variable-length hops, path functions and pattern predicates. Most BloodHound CE and legacy queries run unchanged; see the CHQL reference and Cypher compatibility table.

MATCH p = shortestPath((u:User {name:'[email protected]'})-[*1..]->(t {tier0:true})) RETURN p
MATCH p = allShortestPaths((g:Group)-[*1..]->(t {tier0:true})) WHERE g.name STARTS WITH 'DOMAIN USERS@' RETURN p
MATCH (u:User {hasspn:true, enabled:true}) WHERE u.pwdlastset < 1600000000 RETURN u.name, u.pwdlastset
MATCH (g:Group)-[:AdminTo]->(c:Computer) RETURN g.name, count(c)
MATCH (p)-[r:ADCSESC1|ADCSESC6a]->(d:Domain) RETURN p, r, d
MATCH (n {owned:true}), (m:Group) WHERE m.objectid ENDS WITH '-512' MATCH p = shortestPath((n)-[*1..]->(m)) RETURN p
MATCH (dc)-[:MemberOf*0..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH collect(dc) AS dcs
  MATCH (c:Computer {unconstraineddelegation:true}) WHERE NOT c IN dcs RETURN c

On the command line: copperhound query corp.chg "MATCH …". days_ago(n) gives relative timestamps, e.g. WHERE u.lastlogontimestamp < days_ago(90).

The UI ships with 159 prebuilt queries in 15 categories (Domain Information, Dangerous Privileges, Kerberos, Delegation, ACL Abuse, Sessions & Lateral Movement, GPO & OU, Hygiene, Shortest Paths, Tier Zero, Owned, ADCS, Azure / Entra ID, Azure Resources and Hybrid), each tagged and tested against a synthetic graph. Your own queries can be saved server-side.

Performance