<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-identity-attack-path-analysis
description: >-
  Analyze identity attack paths using graph-based techniques to identify
  privilege escalation routes, lateral movement opportunities, and high-risk
  identity relationships in Active Directory and cloud environments.
domain: cybersecurity
subdomain: identity-security
tags:
  - attack-path-analysis
  - bloodhound
  - graph-analysis
  - privilege-escalation
  - lateral-movement
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - T1078
  - T1098
  - T1069
  - T1087
  - T1550
---

# Performing Identity Attack Path Analysis

## Overview

Identity attack path analysis uses graph theory to map relationships between
identities, permissions, group memberships, and resources. It identifies paths
an attacker could traverse from initial access to high-value targets like
Domain Admin or Global Administrator. Tools like BloodHound, AzureHound, and
custom graph queries expose these paths for remediation.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Python 3.10+ | Agent tooling |
| SIEM access | Log correlation |
| IdP API access | Identity provider queries |
| `pip install msal` | Microsoft auth library |
| `pip install okta` | Okta SDK |

## Key Concepts

### Attack Path Graph Model

```
[Compromised User]
    │
    ├── MemberOf ──▶ [IT Admins Group]
    │                    │
    │                    ├── HasRole ──▶ [Helpdesk Admin]
    │                    │                   │
    │                    │                   └── CanResetPassword ──▶ [Global Admin]
    │                    │
    │                    └── Owns ──▶ [Service Principal]
    │                                    │
    │                                    └── AppRoleAssignment ──▶ [Mail.ReadWrite.All]
    │
    └── HasSession ──▶ [Server-01]
                          │
                          └── AdminTo ──▶ [Domain Controller]
```

### High-Value Targets

| Target | Risk | Common Paths |
|---|---|---|
| Global Administrator | Critical | Nested group membership, PIM abuse |
| Domain Admin | Critical | Kerberoasting, DCSync rights |
| Key Vault access | High | Service principal chain |
| Conditional Access bypass | High | Legacy auth, excluded accounts |

## Workflow

```
1. COLLECT    — Gather identity graph data (AD, Entra ID, AWS IAM)
2. INGEST     — Load into graph database (Neo4j / BloodHound)
3. ANALYZE    — Run shortest-path queries to high-value targets
4. PRIORITIZE — Rank paths by length, probability, and impact
5. REMEDIATE  — Break highest-risk paths (remove edges)
6. VALIDATE   — Re-run analysis to confirm path elimination
```

## Verification

```bash
# Validate agent script
python3 -m py_compile scripts/agent.js && echo "OK" || echo "FAIL"
ruff check scripts/agent.js

# Run agent help
node scripts/agent.js --help
```

## References

- [MITRE ATT&CK — Identity Techniques](https://attack.mitre.org/tactics/TA0006/)
- [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-3/)
- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [CIS Controls v8](https://www.cisecurity.org/controls/v8)
