Comment
Author: Admin | 2025-04-28
Default : 20 * number of CPU -co NB_CORES, --nb_cores NB_CORES Number of cores for parallel neo4j requests. Default : number of CPU --rdp Include the CanRDP edge in graphs --evolution EVOLUTION Evolution over time : location of json data files. ex : '../../tests/' --cluster CLUSTER Nodes of the cluster to run parallel neo4j queries. ex : host1:port1:nCore1,host2:port2:nCore2,...In the graph pages, you can right-click on the graph nodes to cluster them or to open the cluster. EvolutionIf you have multiple AD-Miner reports over time, you can easily track the evolution with the --evolution argument: each AD-Miner report generates a JSON data file alongside the index.html file. You just need to gather these different JSON files into a single folder and specify the path to that folder after the --evolution argument.A tab called 'Evolution over time' then appears on the main page. Also, views by categories 'permissions,' 'passwords,' 'kerberos' also allow you to track changes over time. Smartest pathsAD Miner can compute paths based on their actual exploitability. Indeed, sometimes the shortest path is difficult to exploit (here because of the ExecuteDCOM before the HasSession). While a longer but simpler path exists (here with MemberOf and AdminTo instead of ExecuteDCOM). AD Miner automatically switches to smartest path mode when your neo4j database has the Graph Data Science plugin installed (https://neo4j.com/docs/graph-data-science/current/).The easiest way to install this plugin is to define an environment variable in your neo4j docker: NEO4J_PLUGINS=["graph-data-science"] (it is by default installed with BloodHound Automation).Currently, 10 controls utilize full graph coverage and optimize the smartest paths for analysis.Implemented controlsThe following provides a list controls that have already been implemented in AD Miner :Controls for On-premiseCategoryDescriptionCategoryDescriptionKerberosAS-REP Roastable accountsMiscComputers with obsolete OSKerberosKerberoastable accountsMiscDormant accountsKerberosKerberos constrained delegationMiscFunctional level of the domainKerberosKerberos RBCD against computersMiscGhost computersKerberosKerberos unconstrained delegationsMiscGroups without any memberKerberosOld KRBTGT passwordMiscOUs without any
Add Comment