ADPathFinder: OpenGraph Attack Path Mapping in BloodHound CE

ForceHound graph data powers two Salesforce scenarios: transitive escalation from a standard user to ModifyAllData via ManageUsers or AssignPermissionSets, plus Connected App exposure analysis.

AD-PathFinder maps attack paths from low-privileged users to Domain Admins using SharpHound and OpenGraph data, natively covering AD, ADCS, SCCM, and MSSQL, including password risk audits.

ForceHound is an open-source Python collector that renders Salesforce profiles, permission sets, and sharing rules as a BloodHound CE identity graph, bringing AD-style attack path analysis to CRM.

Presents an ADCS takeover path: from a MSSQL virtual account, enroll a machine certificate with certreq, recover the machine account NTLM hash via PKINIT, then use S4U2SELF for a silver ticket.

Webinar recap with BloodHound co-creator Andy Robbins: Active Directory is a soft target because deployment misconfigurations and risky defaults—not code flaws—open its widest doors to attackers.

As AI-assisted offensive security evolves from simple prompting to multi-agent architectures, SpecterOps standardizes security craft into declarative skills and MCP interfaces, allowing operators to safely orchestrate complex red team tradecraft and reverse engineering directly through LLM agents.