attack-paths

Bloodhound Reporting for Blue and Purple Teams

Tool for building Kubernetes attack paths

Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.

Neo4LDAP is a query and visualization tool focused on Active Directory environments. It combines LDAP syntax with graph-based data analysis in Neo4j, offering an alternative approach to tools like BloodHound.

Detection-aware BloodHound attack-path scoring - the quietest route to your objective, calibrated across five detection tiers (audit/EDR/Elastic/MDI/WDAC) plus Azure.

Based on Lightspin proprietary data, research, and our tracking of cloud security trends in the market, our research team has compiled a list of the 2022 Top 7 Cloud Attack Paths across AWS, Azure, GCP, and Kubernetes as seen on the Lightspin Cloud Native Application Protection Platform.

An enhanced version of Microsoft CyberBattleSim incorporating an embedding model to support continuous spaces for the RL task, an extended scenario generation pipeline, and a unified framework for RL training and evaluation [Black Hat Asia 2026 Arsenal]

Shows which attack chains are complete end to end on your Linux host, not just a list of findings: audit, an ordered plan of what to cut first and what it costs, apply, then prove only what you intended changed. 109 CIS checks, 52 Ansible roles, SARIF and Prometheus output.

Azure AD based infra APM

Security for AI agents & MCP — map how MCP servers, skills, and memory chain into exposure paths. Toxic-flow detection, cross-surface graph, drift & policy-as-code. Local-only, no telemetry.

Active Directory attack path enumerator — single binary, no BloodHound required

Find the routes to Domain Admin your monitoring would not catch — without your Active Directory data ever leaving the machine.

🔍 Identify Active Directory vulnerabilities and attack paths quickly with Hackles, a fast CLI tool featuring 166 security queries for effective assessments.

macOS security analysis: local collection, modeled attack paths, scoped CVE scans, and offline incident response.

Maps the blast radius of a single Entra ID identity — if this account is phished, what does the attacker reach? Roles held, roles one step away (PIM), permissions inherited from owned apps, groups it can modify. Read-only, one page, no tenant needed.

AI-Powered Active Directory Attack Path Analysis with BloodHound - By Ayi NEDJIMI

AttackPathCanvas — Visualize Identity Attack Paths in Active Directory

Open-source CNAPP blueprint: security graph, attack paths & issue triage on a realistic simulated multi-cloud estate. 100% free, Apache-2.0.

Everyone tells you your blast radius. This computes the minimum-cost set of actions that provably severs a compromised identity from the crown jewels — with a max-flow optimality certificate.

Read-only Microsoft Entra application relationship explorer for IAM attack paths, evidence, and remediation