Map ACL attack paths with BloodHound before touching anything

Blind privilege hunting is slow. Collect with a modern ingestor, import, then query the built-in paths from your owned principal to high value targets.

bloodhound-python -u user -p pass -d dom -c All -ns 10.0.0.1 --zip
# or SharpHound.exe -c All

Mark your foothold as owned and read the shortest paths, focusing on ACL edges (GenericWrite, WriteDacl, AddKeyCredentialLink, ForceChangePassword).

MATCH p=shortestPath((n:User {owned:true})-[*1..]->(m:Group {name:"DOMAIN ADMINS@DOM"})) RETURN p

Pro note: prioritize edges that are quiet and reversible (Shadow Credentials, RBCD) over loud ones (password reset, GPO edits). The graph also reveals unrolled nested group membership, which is where most real over-privilege hides.