Release v0.8.0: SID Resolution

SID Resolution Release

Major New Features

• SID Resolution: Automatically resolve Windows SIDs to human-readable usernames if encountered during collection
• BloodHound Integration: SID lookup using existing BloodHound data (no network traffic)
• LDAP Fallback: Queries domain controller when BloodHound data is insufficient
• OPSEC: New --no-ldap flag to disable LDAP queries

SID Resolution Features

• Smart Detection: Automatically identifies domain SIDs (S-1-5-21---*-RID format)
• Graceful Degradation: Clear messaging when SIDs cannot be resolved

Display Improvements

• Enhanced looks_like_domain_user() to recognize domain SIDs as domain accounts
• SIDs now properly included in Tier 0 and high-value analysis
• Comprehensive error messages with explanatory context
• Maintains both resolved username and original SID for analysis

Technical Implementation

• New taskhound/utils/sid_resolver.py module with comprehensive resolution logic
• Enhanced engine.py integration for both online and offline processing
• Updated CLI with --no-ldap parameter
• Full ldap3 library integration with robust error handling

Upgrade Notes

• SID resolution is enabled by default
• Use --no-ldap flag for OPSEC-friendly operation (disables LDAP but keeps BloodHound resolution)
• Existing BloodHound data files work seamlessly with SID resolution
• New dependency: ldap3 library (automatically installed)