attack-paths

Bloodhound Reporting for Blue and Purple Teams

Tool for building Kubernetes attack paths

Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.

Neo4LDAP is a query and visualization tool focused on Active Directory environments. It combines LDAP syntax with graph-based data analysis in Neo4j, offering an alternative approach to tools like BloodHound.

Detection-aware BloodHound attack-path scoring - the quietest route to your objective, calibrated across five detection tiers (audit/EDR/Elastic/MDI/WDAC) plus Azure.

Based on Lightspin proprietary data, research, and our tracking of cloud security trends in the market, our research team has compiled a list of the 2022 Top 7 Cloud Attack Paths across AWS, Azure, GCP, and Kubernetes as seen on the Lightspin Cloud Native Application Protection Platform.

An enhanced version of Microsoft CyberBattleSim incorporating an embedding model to support continuous spaces for the RL task, an extended scenario generation pipeline, and a unified framework for RL training and evaluation [Black Hat Asia 2026 Arsenal]

Shows which attack chains are complete end to end on your Linux host, not just a list of findings: audit, an ordered plan of what to cut first and what it costs, apply, then prove only what you intended changed. 109 CIS checks, 52 Ansible roles, SARIF and Prometheus output.

Azure AD based infra APM

Security for AI agents & MCP — map how MCP servers, skills, and memory chain into exposure paths. Toxic-flow detection, cross-surface graph, drift & policy-as-code. Local-only, no telemetry.

Find the routes to Domain Admin your monitoring would not catch — without your Active Directory data ever leaving the machine.

Active Directory attack path enumerator — single binary, no BloodHound required

Static analysis for authorization policies. Finds who can get access the policy is meant to refuse: by writing the data a decision reads, setting part of the request, or writing a relationship. Works on OPA policies and SpiceDB schemas, locally or in CI, and can export what it finds to BloodHound.

🔍 Identify Active Directory vulnerabilities and attack paths quickly with Hackles, a fast CLI tool featuring 166 security queries for effective assessments.

macOS security analysis: local collection, modeled attack paths, scoped CVE scans, and offline incident response.

Security assessment for Active Directory, Microsoft Entra ID and Microsoft 365. 800+ checks across on-prem AD, AD CS, Entra ID, Intune, Exchange, SharePoint, Teams, Defender and Azure, with attack-path analysis, threat hunting and executive and technical reports.

AI-Powered Active Directory Attack Path Analysis with BloodHound - By Ayi NEDJIMI

AttackPathCanvas — Visualize Identity Attack Paths in Active Directory

Maps the blast radius of a single Entra ID identity — if this account is phished, what does the attacker reach? Roles held, roles one step away (PIM), permissions inherited from owned apps, groups it can modify. Read-only, one page, no tenant needed.

Open-source CNAPP blueprint: security graph, attack paths & issue triage on a realistic simulated multi-cloud estate. 100% free, Apache-2.0.