Full transcript
0:00Alrighty. Thanks so much for tuning in everyone. Look, I am super excited to get together again with some incredible friends over at Spectre Ops. Andy Robbins, Justin Kohler, you guys are wizards. You're geniuses. I know. I've seen all the incredible stuff you've been up to and I'm pretty stoked to hear about all the new sweet stuff coming out
0:18for what is it Blood Hound 8 now? Is that right? Can you let me know what have you all been up to? >> Uh, a lot. Uh, so there's been a lot that we've pumped into this release. our team at Spectre Ops that's working on Blood Hound and and the research team. Like we've we've exploded our engineering and research team. So like
0:33we're really excited about all the new stuff that we get to show off. We probably won't get into every bit of it cuz we have to fit into such like a short amount of time. But I also want to just call out Andy like version 8 is kind of crazy. You know, it's been quite some number of years since they you know
0:47him, Andy and Rohan. Sorry, him, Rohan, and Will released Blood Hound, you know, back at the Defcon stage. So >> 2016, it's been nine years. Yeah, >> but this is a we're super stoked. There's one there's one in particular that we've um had a lot of fun with internally and the early um reaction from the community that have been able
1:07to dig into what we call Blood Hound open graph. They've been doing some incredible stuff like faster than we expected to and so I'll I'll be happy to dig into that as well. >> Before we dive in, would you mind I don't know kind of setting the stage, letting folks know, hey, I don't know even just zooming way out. What the heck
1:23is Blood Hound? What did it start with? what did it has it changed now over time in history? Uh and then yeah, really just set that context of what that what do you use this thing for? What's it all about? >> I could maybe give like kind of like the red team perspective and my perspective on that. So like Justin said, we
1:37released Blood Hound in 2016 on the Defcon stage. Anybody who was there knows that Rohan unlocked his password manager on the on the projector screen at Defcon. It was a fun moment, like top 10 Defcon moment for me. At that time, Blood Hound was basically Google Maps for Active Directory. So, if I'm on the red team and I compromise a user or a
1:59computer, I want to get to domain admin. So, I'll say like I start at JSON, for example, like what we see on the screen here. And then I target domain admins in the Phantom Corp domain. And then if there is a path, if there's more than one path, we will see the shortest paths come up. Just like when you navigate in
2:17Google Maps, if I want to go from Seattle to Portland, you know, it'll say get on I5, drive south, do this, do that. Same idea. Since then, the way the product has changed, well, one significant change is that the version of the software that we put out in 2016, we we now refer to as Blood Hound Legacy. And now the current free
2:36open-source version of Blood Hound is called Blood Hound Community Edition. And we've brought in way more attack primitives, way more relationships in Blood Hound for Active Directory. And then we've also brought in intra and Azure attack paths and hybrid attack paths that can go from compromising maybe a synchronized intra user and
2:56turning that into control of the on-prem user or the other way around as well. And yeah, that that that's probably kind of like the 30,000 foot level view of of the history of the product. >> Yeah. So that was like uh so that's all the the red team use case like I'm I'm in I need to complete my objective
3:12whether it's getting to domain admins or global admins or something else right that's we we get to those those top level admins and then we can do whatever we want because we are the the owners of the domain or the tenant at that point but so this this kind of created another problem we can find these paths all day
3:28but what if you're a defender right what if you're a company like no no penetration testing has and red teaming has a specific use and it's to you know test your systems test your teams but if you're trying to like squash all these at scale. It's not really efficient to remove like a he used the map analogy
3:42earlier like remove a road at a time, right? Like think of the United States and how many roads there are. It's very similar when you think of like identity in a modern enterprise. So that's why we created Blood Hound Enter uh Blood Hound Enterprise. Um we released this back in 2021 to find all those attack paths at
3:58scale and you know isolate your super admins, what we call tier zero principles. So that could be like domain admins in a active directory environment, global admins, but there's so much more. I mean like schema admins, key admins, privilege off admins, like there's so many things that people don't understand that can be used to take over and target your environment. So that's
4:17what Enterprise does for folks and it shows them, you know, what is the problem, how can they fix it and then shut down those at scale. So that's a delineation between the two products. Yeah, I'll be the first to admit I have been I poked and played with Blood Hound and maybe in some of the earlier days
4:31while I was going through oh what was it silly I don't know OCP or OSP some of the like oh training certifications just to learn and get your skills sharp but now I think it's just the go-to de facto hey this is what everyone will reach for for literally genuinely a map and a compass hey looking around in that
4:48active directory environment and now so cool to see a transition from on premise uh but now keeping up with the times everybody whatever buzz word bingo but no genuinely ID and now it sounds like there's even more moving back and forth and as you need to so man it's I am so so excited but hey the floor is yours
5:10I'm sorry I'll let you take it wrong >> no you're good I I think like uh there's so much in blood hound like we have a blog post that goes super in-depth on like all of the new stuff I'm not I won't be able to cover I'm just going to cover three so we're going to start small and we'll go into like a little
5:22bit bigger of a thing and then we'll end on something specific for enterprise if you're an enterprise customer, but if you're an open source user um or an enterprise user, one of the things that we found is the way that we represent data in Blood Hound sometimes is maybe a little inefficient. And what I mean by that is when we're trying to find a path
5:39like from a start and an end point, it's useful to look at that in a graph. So we looked at JSON to domain admins, you know, and some of these this built-in cipher queries we have. So like principles with DC sig privileges look you know it's really easy to understand that and we can say like okay what is
5:55this principle and learn more about it. So one one thing is what if you are searching for something that doesn't have any relationships. So I'm going to find this query is looking for all users that don't have to use a password to log in. And so there's there's six, but like pretend that there's, you know, 50,000 of them in a, you know, big environment
6:13or or even 500 or 50. You know, how would you un like try to figure out which one of these to address first? And today, what you'd have to do is kind of click in each one of these and say, okay, you know, what who is this person? What kind of privileges do they have? It's just not very useful. Now, we have
6:30a table view. So for those who are used to looking at things in more of like a a table or a CSV or Excel, right, there's certain things that are just better represented by this view. So I can see I can manage the columns that we pull into this. I can say like the level of privilege that I have enabled. Yes,
6:47exactly. Uh the last time they logged in so that I can get this and then download it, you know, send that off to somebody else, drop that to CSV and and send that to somebody to go work on remediation. So this seems small but it is a hugely impactful thing for interrogating very large scale uh even I mean again even if
7:04you have a domain with or or Azure tenant with a hundred users it's going to be a lot more useful to look at it in this view specifically when there's no like relationships between the objects. >> Yeah I I think it's it's it's good for remediation. I think it's also good for like red team target selection. If I've
7:20got 50 kerbar roastable users I could kerost all of them you know why not? But maybe I'm GPU limited and I need to prioritize and figure out which one is actually worth, you know, the GPU time to spend cracking the the password for that user. I could filter out and I could just say like, well, I don't want
7:37to try this against any user that is not enabled, for example. So for target selection, it it can be a lot faster to go to go this way, too. >> Yeah. And so like one thing is, you know, we have these built-in queries that we've been building over the years, right? So whether it's an active directory or Azure or hybrid or what you
7:54name it, we have all these queries, but then a lot of times people will write their own queries, you know, for those that have taken the time to learn cipher. But what if you're not those people? So we recently released this. So there's all these like lists of queries everywhere, GitHub, blog posts, you name it, right? And we're trying, we release
8:12blood queries.specops.io as kind of a repository for anybody to submit queries that are interesting um in any platform that we cover. And these are all automatically checked. So if you submit something and it is accepted, it automatically gets checked to make sure it's formatted correctly and returns data. So let's say I want to find users
8:32uh let's say passwords not rotated in over a year, right? It's kind of like a a hygiene check. So I get this query. I can also if I'm if I have a Blood Hound Community Edition or Enterprise Tenant, I can put my URL in here and just hit play. So now I find the query that I want to run. I hit it and say here now
8:49we have this ridiculous uh result right that we can't make any sense out of I'll I'll make it even harder to see. So like this again is an example of this is useful. I mean I'm I'm getting results of what I want to see search but what I really want is that table view. So here I can say like okay when was the last
9:06time let's let's pull in the password last reset date and let's do the last log on and then we can also sort and filter. So like this one has been set in 2005. maybe we should target that person first. They're they also are a tier zero user. So I can drop this to CSV, send it to somebody and then they start
9:24remediating. So this is kind of the two things working together. We can find interesting queries. Uh then we can you know use table view to represent that data a little bit better. >> This is awesome. I know it sounds I don't know you'll present it oh here's a table and that seems a little small because everyone will oh laugh and he haha at Excel but
9:43genuinely I know that is invaluable during even analysis yeah hygiene just incident response sometimes the case may be I remember again maybe I'm dating myself years back when again using blood hound in practice uh >> I could be wrong maybe I'm misremembering but there weren't a lot of built-in queries so I'd take stuff randomly off of oh what I'd seen on
10:05GitHub. Some folks that just said, "Oh, try use these." Um, there were resources and things available, but a lot of them either wouldn't work, you know, cipher query syntax wasn't right. Something was just jank. Um, but that's just cool. I love that queries database and you just click it and go even in your own environment. That's awesome.
10:23>> Yeah. And we we want to enhance this too. Like we have a we have another release coming up soon where there's going to be a little bit different interface to the save queries and the two will tie together even even tighter. We have a joke internally that like you know we've always used the attackers think in graphs and then defenders think
10:38in lists right um but we always say too like sometimes uh defenders interpret things in list too so it's it's easy but once you know once you find using the power of the graph what you're looking for sometimes getting that list back is actually useful >> especially when there's 500 of them. Yeah. >> Yeah. So prioritize them. Yeah.
10:56>> Sometimes it turns out a list is the right tool for the job when when a graph is not. >> Exactly. The second major thing that we released again second of many but the second one that I'm going to talk about today is you know primarily blood hound has always been an active directory or Microsoft centric uh tool. So we started
11:13with active directory there's only three edges and three objects. Uh and then over time that's exploded and now I think we have over I don't know 60s something objects and 100 plus different ways we can connect them. But it's always been Microsoft. It's always been active directory certificate services, NLM, uh, you know, active directory or Azure and enter ID. We know that people
11:35have, you know, the the same way that we can attack users or identities in active directory is the same way we can attack them in AWS or GCP or or any SAS application. What we can do is not necessarily unique to the platforms we cover today. So one thing that we released primarily at this point for researchers is the ability to model and
11:54create attack paths in any platform and this is extremely open. I mean uh Andy has some examples that he's talked about in a recent webinar but I'm just going to give you some examples that we have here in this database. So I have a couple custom ones. This is a one password vault that we've modeled out. Now this is particularly cool cuz we can
12:12see like a user is a member of a group that has access to these different vaults. Right now, this in itself is powerful. So, think of the I don't know if you saw remembered a cube hound example where the data dog team modeled out attack paths in Kubernetes. That was super cool. Uh the real power comes when
12:31you can connect this to other things. And what I mean by that is, you know, usually you're using an identity to SSO into other providers. Like I I log into my machine and I have access to a bunch of different things. And so understanding that extent, you know, if you're only modeling one at a time, you don't really get that hybrid picture or
12:49the really scary thing like we bolted these things together and now what problems did we create? Fun fact, that one password example we did in like 4 hours. So the speed at which we can do this is insane. Uh Andy, you could probably throw anecdotes on that. >> I want to hear the story for this. Yeah. >> Yeah. I mean, I I can give you a quick a
13:08quick example, which would be a couple of years ago, I did some of the code changes to implement like logic apps and logic app attack paths in Blood Hound. And so, in order to achieve that, I had to modify this file, that file, this file. Long story short, I had to pick up some Golang. I'm not a Golang developer,
13:26but I had to because the product was very rigidly defined, you know, like like the source code dictated exactly the behavior and the performance of the product. There's no flexibility. whatsoever. So if you wanted to add a new node or a new edge, it actually required a ton of work. Now the difference is I don't have to open up
13:46any source code for Blood Hound. All I do is I make API endpoint queries to the Blood Hound API. So I supply a JSON payload to the file upload API and that's about it. That's that's almost it. you know I I do a different query to define what color do I want the node to be and what icon do I want it to be and
14:07that applies to the entire class of nodes. So you do that one time and then you can start shoving data into the product with the open graph APIs. So compare you know a matter of days or weeks for me to figure out go laying and copy and paste and and you know modify the files figure out how to do a a pull
14:25request in GitHub again you know figure out how to do all that stuff. Compare that versus in 4 hours. You know, Justin said they had the one pass PC done. I I had an npm repo dependency tree PC done in maybe about 3 or 4 hours as well. Uh just lightning fast. That's incredible. We released this like uh Thursday before
14:45Black Tuesday, whatever. We released it before Black Hat and we were like we we were curious if somebody by Black Hat was going to create something cuz we did internal, you know, we were going really quickly. But that's our research team and we we work on this stuff all day. We had somebody tweeted out an image of a
15:01new attack path that had never been covered within about 4 hours of our release. Like they did it themselves, which was insane. And I'll I'll showcase like where we're categorizing all these new extensions into Blood Hound. So if you don't want to go through the process of modeling it out yourself, you can actually go try what other people did.
15:19And I'll kind of talk about how we we'll take that forward. >> Do these new custom attack paths just live fully encapsulated in JSON? And then that's just what's spat at the blood hound API that that's it. Live and die in that JSON blob. >> Yes. So you just supply the JSON and then that's it. >> This opens the floodgates for you all
15:39which is incredible. Uh I'm super happy for you. >> Does that mean that there's going to be like cuz I you know liken to old sharpound or old you know the binary you drop and on the box and then query and get all the data just to shove it into blood hound. Does this mean there's going to be
15:57GitHub hound, one password hound, all these prefix suffix hound things? >> Oh yeah, there already there actually already is. So in the new section in our open graph right here on that's what we call this concept of like arbitrary attack path analysis. We have an open graph library of different things that
16:18people have made. Now these ones are all done by spectrops people. We have that one password. We have a GitHub. We have Jamfound that we released last week which is super cool. Uh we but the one that we had we got right before Black Hat was Ansible. So you can click on the and navigate to the GitHub repo and this
16:34is the whole thing. They even included some example data. So like you can just draw and download their example data set throw it at your existing tenant or or BHE instance or platown community edition instance and it just returns. It just works which is super cool. Our fun fact like our training team uses Anible to spin up some of the big ranges that
16:52we do kind of at Black Hat and like our our big red team operations trainings. Uh they were they were really curious about this. They're like, "Oh man, we want to go to Anible Watchtowwer. This is going to really help us." >> Yeah. >> You guys have just like moved the needle, you know what I mean? You guys
17:06have genuinely pushed like industry forward. This is phenomenal. Everything could do this now. >> Yeah. Yeah. Yeah. And any anybody too like this and this is this is also this is part of BHCE. This is free. >> Yes, this is free. >> So anybody anybody can do this. This is not limited to just Bloodtown Enterprise. >> All right, I'll shut up. I'll I'm sorry.
17:27I'll I'll let you guys. >> So So this is like there's a whole big road map that we're going to we just kind of set ourselves on. We actually committed to this about a year and a half ago. We just released this first functionality. We have so many updates planned for probably the next 6 to 9 months to build out the rest of support
17:44like you know use these new custom objects and pathf finding and for blood hound enterprise be able to model those attack paths and shut them down at scale automatically. But the uh this is primarily for researchers but we had somebody internally who's not on the research team not on the engineering team just kind of like vibecoded up a
18:02Cisco Duo attack path like just in a few hours. It really opens the door to kind of whatever you want. Now, I do want to show you the kind of the cool power again of like, you know, modeling one thing is interesting, but when you get into hybrid or how these cross, that gets really interesting or scary
18:21depending on who you are at your company. Um, so we'll go ahead and say like, okay, this is GitHub organizational admins. Now, Jared uh Atkinson did a PC of this. He actually showed this at our conference. Soon earlier in the year and then he uh redid this for open graph in I don't know a couple days. So then we can also look at
18:38like who has right access over the repo in blood hound or in GitHub. Now we're still in GitHub and that's that's kind of interesting. Now the thing that we think is super cool is synced users. So this is that will Schroeder Azure Entra ID user who synced to Harmjoy the GitHub user. This is the same human but it's
18:59two different identities crossing that plane. Right? This is the cloud plane and now this we're cross into SAS. Now it gets even better. I'm doing my like >> infomercial thing. Yeah. >> So now we have Will Schroeder, right? An enter ID user who has the ability to write to these branches. Well, let's throw that in pathfinding. Let's say
19:20well who can let's back to our early example. Let's use Jason. Jason was that active directory user that I was talking about with when Andy was kind of telling that story. Pull up Jason and we'll pull up Will and we have an attack path from Jason also to Will. So what that means is we have an attack path from active
19:40directory on prim all the way through to Azure enter ID and then to GitHub write access. >> It opens up pretty exciting possibilities like imagine so we like this attack path starts in on-prem active directory. it pivots up into Intra and then it pivots over to GitHub. So, three different platforms. I imagine
20:00like if if I'm a red teamer on an assessment and I'm able to like pull in data from different data sources that maybe Blood Hound doesn't model because it's it's something that's maybe kind of niche or maybe it's a technology that is hard to get your hands on to do to to do attack research on a mainframe like an
20:16AS400 possibly >> or a custom application, right, that they built internally. >> Yeah. like niche uh systems that are that are important but not that well understood like HP non-stop for example very critical piece of technology not that well studied not that well understood there's not a whole lot of like red team tradecraft around HP non-stop but if you're if you're on the
20:36red team and you want to find like how do how can I get to my objective why not start to like pull in the data from those different platforms model it in such a way that you know an attack path could surface put it into Blood Hound and then boom from my initial access user to whatever like whatever my
20:53objective is. Is there an attack path? Like that that to me is a really really exciting possibility. And this and this enables that possibility to be real. >> I don't want to sound like I'm overreacting or anything, guys. I'm not I'm not trying to like act and make this dramatized to it. This is just mindblowing. >> It's pretty awesome. I mean so again
21:11primarily today this is going to be for anybody who wants to build those uh or or use these um with you know like use the the queries that we've uh promoted now a lot of these are coming in like it's really exciting if you want to join the blood hound slack and there's an open graph channel there was an example
21:27of VMware vsenter you know think of like a a private cloud and they host their domain controllers for active directory on that that means like if I have admin access on vsenter then I have physical access to a domain controller so it's like it they all play together. Really interestingly, there's all different types of examples that people are
21:44working on. Again, you can see all of the published ones or the ones that have been linked to us in this. And then this is just get it built out over time. >> I'm I'm also curious to see what people do with this like outside of just identity based attacks or like you know stealing an identity, stealing a token
22:00off a system or whatever using some kind of privilege. Like there there are attack paths that have nothing to do with identity at all like software supply chain attacks for example. So if I can compromise a particular npm repo, what is the potential fallout of that? Or if I have a target repo that I want to make some kind of malicious commit
22:19to, what are like what is the dependency chain and where could I insert myself in that dependency chain based on bad security practices by a developer somewhere that's like 8 n degrees of separation away in a software dependency chain. That to me is a really exciting possibility. I'm not a subject matter expert with software supply chain attacks, but I know that the possibility
22:41is there for sure to map those attacks with this technique. >> Man, I wonder even like on the end point like, hey, you're trying to think, oh, what's what's my way to prives? What's my way to get to one other Linux >> 100%. >> Yeah, SSH keys. Yeah, I'm working now on Windows Prees stuff. So, what are the
22:59permissions on every task installed? The services. Uh what about the binaries that those services start? What principles do those services start as? Maybe they start as a domain principle. Maybe it's a local principle. There's a lot of really really exciting possibilities there on the on the prek side that are kind of like bread and butter pentest 101 pre 101 stuff. I
23:18think there's also a really really exciting opportunity for more let's say arcane or not commodity level stuff. So more advanced debugging techniques that if I have a a GEDra instance and I'm able to decompile a binary and I'm able to see like okay this binary actually is calling this function from this DLL over
23:39here. Okay, well this DLS function is actually you know executing a com application somehow and it's reading from this registry key and like all of these different interactions that are happening in the operating system that I just imagine you know think about like lol bins and you know think about like if I double click on a hta file there is
24:00a certain logical step-by-step process that happens in the operating system that can result in powershell running with a command that I had control of when I created the hta file. Okay. What if we were able to map out all of those different components of the operating system? So the the file handler, the the registry, the com applications, the DLS,
24:20the executables that are all involved in that chain. What if I could map not just HTA to PowerShell? What if I could map everything to PowerShell or everything to CMD? What if I knew every lol bin in Windows? Not just like onesy twoosy here or there. What if I knew all of them? Okay, congratulations Spectre Ops. You've completely revolutionalized
24:41everything. >> I think like you know I think on the you know who would that be useful for? I think on you know on the red team side so often we don't really have the privileges necessary to collect a lot of a lot of that or you have to make so much noise to collect all of that. It's
24:56like forget it. It's not worth it. Just see if there's GPP passwords out there instead. But imagine for like golden image uh analysis um the vendor themselves like if Microsoft themselves if they knew every lul bin that'd be useful for for Microsoft and for every customer of Microsoft. So yeah there's there god there's tons of exciting possibilities. Yeah. How easy is it to
25:18build out what would be JF Hound or Ansible Hound or etc? Cuz normally I think oh you can like map out an API oh you get schema from what what software would provide. But these are like you're trying to get the surface of roles and capabilities and access permissions. How do you get that in a now completely
25:38open-ended blank canvas of anything ever in existence? You know what I mean? >> Yeah. I can kind of give you, you know, my own perspective, my own answer on that, which is there is another identity platform that I have a fill-in-theblank hound ready for. I don't have permission to talk about it publicly yet, but let's just call it Justin's IDP. And so
26:00Justin's IDP is kind of like Intra or AWS or GCP, like they have a an identity provider. And so I have users, applications, groups, all that kind of fun stuff. Now just like any other modern technology they have a APIs that I can query that I can get JSON formatted information about all those different objects. So I can pull down
26:19the groups that can pull down the users the roles the role assignments you know from Justin's IDP service. Now to a large degree I can just take the JSON from the platform's API and then I can send that JSON somewhat modified but not not that much to the ingest endpoint and it will start to create the nodes
26:42>> endpoint. >> Yeah, the blood hub the bot injust. Yeah. So I'll have a user node, I'll have a group node, I'll have a ro node and all that kind of stuff. So that that part is like super super accessible, super super easy. Where things can get a little more complicated is in the edges. So, you know, there is another endpoint
26:59in Justin's IDP platform for pulling down group memberships. So, for a given group, here are the principles that have been added to that group. That also returns JSON. But if I send that payload to the ingest endpoint, it's not really going to know what to do with it. You know, it's naive in that way. And so I
27:18have to define I am creating an edge and the starting point is this node ID and the ending point is that node ID. Now creating that payload couldn't be simpler. It is so simple if you can you you don't even have to manipulate the JSON if you don't want to. So we have a a PowerShell suite of functions. We have BH operator
27:38and we have BH open graph created by processor aka Walter Legowski aka JD. And so in a couple of lines of PowerShell, I can just format my nodes and my edges. So to to kind of finally answer your question, John, about like how easy is it to actually create your own fill-in-theblank hound u PowerShell guy and my PowerShell proof of concept
27:57inester or or data collector for just an IDP hound. you know, after understanding how the system worked and after understanding some limitations about like, okay, well, group membership doesn't really matter in this in this circumstance and all that kind of stuff. Getting to the point where I actually could sit down, write the data collector, write the ingest code, quote
28:15unquote, which is like three lines of PowerShell. It took me a day to write that, you know, after studying the system and becoming getting up to speed on the system. Took me a day and most of that was waiting for my for my coffee to finish making as I was like thinking about what to do next. Like actual like
28:31hands- on keyboard. You're talking you're talking maybe 3 or 4 hours. >> Yeah. The guy I was talking about who who threw in the Cisco uh like the Duo I I believe attack paths. He's outside of engineering, outside of research. He knew that this thing was coming but didn't really know how to use it in any of that. And like he's a good technical
28:50person but again not an engineer, not a researcher. And he again used like chatgp or I think he used claude to to code up this thing. He he knew how the users and the roles functions worked within the platform. So then he was just like okay how do I get it to spit it out and then put it back into blood hound.
29:07And then once he started seeing it he was like oh that's really you know so like uh again you don't have to do any of this. what you're going to see. If you're just a Blood Hound user, you're like, "Look, I don't have the time to figure it out." Even though we're saying it's easy in in in, you know, in
29:22perspective, you don't have to worry about it. We're going to have a lot of of these in the library. We're going to have more and more. I mean, people are really excited about like all the different stuff that they're building. Uh we're going to crank out a bunch more, too. So, if you don't want to experiment on your own, take a look at
29:37the library, download them, use them, and that support is just going to increase over time. >> It's super exciting. It's it's super exciting and you know I think maybe the last thing I would say about it is uh over the years Blood Hound started it was it was me Rohan and Will and Rohan was the developer Rohan is the one who
29:55actually built Blood Hound and I would you know copy and paste his commits and then like make a little change to like pretend that I was making code contributions to the product as well but it was just Rohan. And so when you have like one developer working on a thing for part-time, things take time. And you know it's it's been true for a long time
30:10that like putting new nodes, putting new edges into the product has has taken time. Even for us internally because you know we have to like tear open the code base and like make changes here and there. With generic ingest, it doesn't just enable, you know, people outside of Spectre Ops to start using Blood Hound for what they want to explore as far as
30:26attack paths go. It's going to make it faster for us to make improvements and additions and extensions to Blood Hound. So, it's like win-win-win all around. >> There's also like uh if you do want if you are one of those researchers who want to play around with it, we have an incentive program. You can get like free
30:42like we're thinking about having a talk track dedicated to all these new extensions at our conference in the spring. Um so, jump in, join, talk about it, or just wait and use it when it's packaged and ready to go. >> Now, I want to make one. >> Yeah. I mean, I need the idea of like, oh, what could we what could we map out?
30:59I was going to so right before Black Hat was starting I was actually I was going to vibe code up Atlassian permissions and like confluence like who can see like what you know centers of the organization somebody did that also internally but they beat me to it and let's just say that we were like oh man we have a lot of permissions are like
31:18interesting yeah the last thing and this is uh if now is a good point to transition and the last thing I want to show is is kind of a big update for enterprise users. So, I'm going to switch over to PowerPoint deck because, you know, I'm talking to Enterprise. So, now I got to have a deck to explain it.
31:34So, Blood Hound Enterprise, we talked about this before, but like it was designed to instead of trying to pick out one attack path at a time, let's do it all at scale. Let's find all like all those critical identities or those tier zero principles, identities, resources, you name it. And then find every path that we can find, right? Every road
31:49throughout the United States, every bridge, whatever. Now, we do that because we want to find those choke points, like those concentrations where we can like fix or sever millions of attack paths with one fix because again, we're not going to fix things by, you know, if there's millions of them. We're not going to make any ground one by one.
32:04Now, that is great and and a lot of times that's that's all that people need. But some organizations want to go further, right? So, not just super admins because honestly, nobody the company cares about domain admins except for the security team and the active directory team. Nobody cares. what they do care about is data or IP or you name
32:24it. Uh like if your PCI processing goes down. So how how can I understand how that stuff can be attacked? Well, that's why we included we just released this concept called privilege zones. So you can actually arbitrarily create classes of identities and resources in a blood hound enterprise instance and then model all the attack paths to that because
32:43attack paths are just the violations of segmentation of privilege or lease privilege. You know, the goal of lease privilege is to make sure that like I as a regular user can't like take over the bank's information. And so this makes sure that that's not possible by understanding how all those obscure privileges in yes Microsoft but again open graph anything you think of can
33:04collide and give me as a user access to things that you don't want me to have or an adversary. So I'll show you what this looks like in the product. This is a new window within a Blood Hound Enterprise instance and this is called privilege zone management. This is where we create new zones. So they're in a like a
33:21hierarchy or north south like what's my crown jewel tier and then what's my you know second. Now you could implement right now in this example we have tier zero and tier one. That's that stereotypical tiered administration model. People might in in the Microsoft ecosystem might understand but it doesn't have to be labeled that way. You can create PCI or VIPs or executives or
33:41you name it. Isolate those assets and then map the attack paths to them. So in our attack paths page, it's quite the same. You just see this other assets that you've defined and now we automatically create all of those uh remediations for you. The same thing with the posture page. Just like we can model out all the improvements to tier
34:00zero, we can do the same thing for any arbitrary collection of assets. So I Andy and I were talking right before we released this and it's like this year is the 50th anniversary of the principle of lease privilege, which is bananas by the way. Nobody is doing it. zero people are doing it because there's not a way to do
34:16it. There's I'm not a finance user so I shouldn't have access to finance things. That's great but that's one degree. What if I can reset the password of Andy who is in finance and then I now have access to finance. Does that make sense? So this is that how those cascading or those identity takeover attacks can lead
34:32a unprivileged user into something sensitive you don't want me to take. >> And like you get to set the guard rails, right? Like you can you can decide determine what that listing is. And I mean I know even just I don't know thinking of folks that oh yeah I've got the marketing department I got the sales department I got whatever the these
34:48individuals here and there whatever but >> or or or let's say you have a bunch of code in in GitHub right or or or you name it right like how can I get >> PC PCI data >> yeah I mean >> like PHI Yeah and especially when we're ssoing across identities how can I as an onprem lowprivilege user get access to
35:06Salesforce data so the the how it's it's important to understand how I can escalate into Salesforce super admin. But what if I don't need that? What if I just want to dump all the records >> or a particular record? Yeah, Salesforce Hound. Not Salesforce Hound. Yeah. >> Even just the fact that like I know so many folks are going to say, "Oh, hey,
35:23this is incredible because my organization architecture, structure, and logical components of thing XYZ is just so bespoke. It's so custom. >> This really lets >> you don't have to color in the lines. You choose where the lines are, man." >> Exactly. It's funny. Uh Andy has the story. I I like uh Andy has a story. We're talking about uh talking to an
35:45early potential customer to Blood Hound. >> So great organization, great security posture, take security really seriously. And I was in the early stages of trying to figure out what BHE was even going to be in the first place. And you know, my pitch was not that great, let's say. And the feedback that I got from from one of
36:06our early design partners was uh you know well we we do lease privilege, we do tiered administration, we find the attack paths, we get rid of them before anybody else can. We do network segmentation and we do you know some secret stuff that I can't really talk about right now that you know just makes it so that we don't really need your
36:23thing. So why do we need your thing? And my response was because it will prove that everything you just said is true. We've we've had people that go through big like um big consulting engagements with like you know big four or or Microsoft themselves that you know put in a lot of effort to try to segment out
36:39users from let's say server admins or you know these these different parts of the organization and they're doing it blindly like they can't see the attack paths that we use. So that's that's what it is. >> The problem is the problem is so pervasive and it is so obvious to anybody who's ever tried to do a a
36:56privilege audit. You know, walk into a shop as a third party auditor to any organization and say, "Okay, tell me how how privileged every Active Directory user is." Like it's it's a non-starter. Like tell me how privileged any Active Directory user is. It's you can't do it. So if you have no clue how privileged any principle is, you can't trim their
37:17privilege down to what it needs to be. You're just you're just flying 100% blind. And it's nobody's fault. It's just it's just the way things are. >> Yeah. Nobody can keep up with it, especially on the cloud side. Nobody can keep up with all the changes, right, with all the different privileges and and updated application and roles that I
37:33don't know what they do and but I'm getting forced to deploy this application now because it's business critical, but I have no idea what it's going to open up. This is the answer to that. Yeah, that's that's it. Again, this is the three things that we wanted to talk about. So that's table view, open graph, and privilege zones. There's
37:48actually more. There's all new trust edges. There's new ACE inheritance tracking. There's new integrations. There's just tons of other stuff. Uh so if you have if it's been a while since you looked at Blood Hound or uh if you're a user, make sure you get that new update because it's pretty uh significant. >> We'll be sure to link the blog post and
38:06maybe hopefully get some visuals up on the screen to be able to showcase some of those. But I mean, everything that we've got a chance to chat about and see here and now, it seems like privilege zones is the only one with a little bit of a I don't know, a charge, cost, pay wall to everything else that we've
38:23discussed is still free in community edition. >> That's right. >> Correct. Correct. >> That's right. Yep. That's right. So the automatic attack path analysis and the privilege zones where you can isolate different things that's all um enterprise but the ability to explore new and interesting platforms and the ability to represent in a table or look at those ACE inheritance that I was
38:42talking about. All of that's free like Jamfound and and you name it Hound and Huntress Hound when John builds it that'll be free. >> Free and open source. >> Wow. Incredible guys. Hey you know I always love hanging out with you. It's just so much fun. so cool. You everything that you do is so stinking cool. Uh but thank you. Thank you. Thank
39:00you for driving onward and forward with you know that community first kind of hey let's let's just raise the industry into this kind of whole new thing where like the information is really the power here. But that's just so cool to see it mapped and molded and put in the way that anyone can access it attacker or
39:19defender. So thank you. Thank you. Thank you again and again. Thank you for having