Skip to content

v1.2.0

Latest
Latest

Choose a tag to compare

View all tags
@danti1988 danti1988 released this 22 Jul 11:36
· 5 commits to main since this release
v1.2.0
110ce06

First release since the public launch. Mostly ADCS and SCCM coverage, plus a fix for a performance regression that was on main for a couple of weeks.

New checks

  • ESC6a — pre-patch CA EDITF_ATTRIBUTESUBJECTALTNAME2 abuse. The existing ESC6 check is now ESC6b for symmetry.
  • ESC3 victim template — matches Certipy's criteria, gated on a paired enrollment-agent template and on the agent and victim ACLs actually overlapping, so it no longer fires on templates you can't chain.

SCCM

  • SCCM_Site targets now surface in builtin and common group analysis, as do the SCCM collector's Coerce edges.
  • SCCMTakeover6 requires a distinct site server before firing.
  • Relay findings use the raw edge type names rather than renamed ones.
  • Path chains render scope separately instead of folding it into the path. Previously scope nodes were appended with > and no edge label, which read as hops that don't exist; SCCM_AssignAllPermissions is now visible in the chain.

MSSQL

  • ExecuteAs chains enumerate all branches instead of stopping at the first.
  • Dropped the no-target fallback in the NTLM relay check.

Fixes

  • Escalation path performance. A disabled-victim guard added on 9 July made the escalation batch query roughly 3.5x slower with no change to the findings it produced. It was reverted — if you cloned main between 9 and 22 July you were getting correct results, just slowly. Pull to get the speed back; there is nothing to re-run.
  • NTDS lookups for single-domain runs route through the audit context partition; the legacy NTDS parser is gone.
  • Stale RID for LAB-SQL01$ in the sample NTDS.

Housekeeping

  • requirements.txt for anyone who prefers pip install -r over an editable install. pyproject.toml remains the source of truth.
  • Interesting/abuse relationship lists consolidated into modules/relationships.py. CoerceAndRelayToADCS added; CoerceAndRelayNTLMToLDAP and LDAPS dropped from the abuse-edge allowlist.
  • Fixture-test docs pinned to neo4j:4.4, matching CI and the Neo4j version BloodHound CE ships.
  • Refreshed sample data and regenerated sample reports.
Assets 2
Loading