This goes through the neo4j database and assigned the highvalue attribute to false anywhere that it isn’t already set to true. When running GoodHound on a set of data that has been gathered using SharpHound 4.1 add the parameter –patch41:
This causes an issue with GoodHound as it uses this parameter to ascertain paths from non-highvalue nodes to high value nodes. With the latest release of Bloodhound 4.1 there is a minor bug where nodes that do not have the highvalue attribute set to true do not end up with the attribute at all. This will create a ‘goodhound’ entrypoint that you can call from the CLI: Use pip to install directly from the PyPi library: Then call pipenv run to run GoodHound inside of the virtual environment just created If you don’t want to make any changes to your installed python libraries you can use pipenv:
This could help to demonstrate to management improvements over time using charts.įinally I wanted a way to plumb the paths found back into Bloodhound to be presented with the familiar and easy to read attack path graph that Bloodhound has always done so well. I also wanted to be able to extract some summary management information, in order to be able to log these over time. This meant that I could find the key points in the network that would allow me to advise the remediation teams with actions that would help to mitigate the attack paths that the most users were able to use. I wanted a way to programmatically find attack paths, and to display these in a prioritised order, beginning with the amount of users exposed to each path. I found that when used in a defensive way BloodHound was so good at identifying attack paths in a domain I was faced with several thousand to process with each review, with no way to deduplicate the findings I had already logged in previous reviews. GoodHound came about because I had a need to perform a repeatable assessment of attack paths using Bloodhound.
0 kommentar(er)
