HardeningKitty VS BloodHound

Also Hardening-Kitty. https://github.com/scipag/HardeningKitty

Critically, harden the OS. Like, more than you think you need to. Way more. Consider the jump host capability as a core component of each system/environment/platform/application it's used to access/manage and assess value and risk with all those business processes/functions in mind even though you're using one jump host for each of those use cases because, inevitably, the same template/container/configuration/script will be reused so any misconfigurations will replicate. If you need a Windows OS, consider hardening kitty as it offers a locally executable option for both hardening and auditing. If you need to met regulatory requirements (HIPAA, CMMC, FISMA, PCI, etc.), consider OpenSCAP or whatever paid solution you use for agent-based vuln scans (avoid less intensive solutions that only run unauthenticated scans or network-based audits, they tend to avoid non-CVE vulns that exist in the configuration). If you need to rely on open source endpoint security solutions like Wazuh make sure they integrate nicely with SIEM, SOAR, and remote management. Wherever possible, use DevOps-friendly solutions for configuration management (think Ansible and Terraform vice Github Actions :) ) and remember that, if you're responding to an incident, you're going to want to suspend all of your jump boxes, retain any storage and their full memory state, and spin up verifiably clean jump boxes so you have confidence in your connections into the environment. This is the most commonly overlooked need (most orgs seem to be aware of their privilege sprawl issue) and it has a MASSIVE impact on your ability to quickly begin effective investigation and response efforts in the event of an incident (most orgs do NOT seem to be aware of this and it costs them time and meaningful information during incidents).

Agree. Harden your endpoints (if unsure where to start consider hardening kitty, https://github.com/scipag/HardeningKitty) and harden Defender (https://0ut3r.space/2022/03/06/windows-defender/). Add Sysmon with a good config (https://github.com/olafhartong/sysmon-modular) and you've reached a good starting point.

I use a tool called Hardening-Kitty https://github.com/scipag/HardeningKitty , which has recommended policy lists from a variety of organizations. I check my computer with all of them. They don't all agree, of course, so I kind of pick and choose a little. But the lists have helped me find things I had no idea where they were.

A related tool that I found somewhere on reddit recently: HardeningKitty

Tool Language Url Notes SharpHound .NET 4 executable https://github.com/BloodHoundAD/SharpHound/ Also possible to be executed in-memory using Cobalt Strike, check @william_knows’ blog post AzureHound PowerShell https://github.com/BloodHoundAD/AzureHound/ Specifically for Azure environments, outside of the scope of this article SharpHound.ps1 PowerShell https://github.com/BloodHoundAD/BloodHound/ Available from the Collectors folder. Using PowerShell reflectively loads the embedded SharpHound.exe .NET executable. It exposes the Invoke-BloodHound function which calls the main function of the SharpHound binary. SharpHound.py Python https://github.com/fox-it/BloodHound.py/ Python version of SharpHound ADExplorerSnapshot.py Python https://github.com/c3c/ADExplorerSnapshot.py/ Convert Sysinternals ADExplorer snapshots to BloodHound-compatible JSON files. BOFHound Python https://github.com/fortalice/bofhound/ Generate BloodHound compatible JSON from logs written by ldapsearch BOF and pyldapsearch.

Run Sharphound and bloodhound Bloodhound. It is excellent in determining relationships and privilege escalation paths that would allow the access.

BloodHound is a web application that identifies and visualizes attack paths in Active Directory environments. It identifies the fastest series of steps from any AD account or machine to a desired target, such as membership in the Domain Admins group. Regularly checking your AD using BloodHound can be an effective defense mechanism that helps you ensure that compromising an account or machine doesn’t enable an attacker to compromise your domain.

Bloodhound - AD attack path management/enumeration

I solved it by grabbing a new version of Sharphound.ps1 on the attack box, you can find it here: https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors.

No live event would be complete without sessions. There were over 30 speakers who covered topics from starting a career in InfoSec, to in-depth sessions about using specific tools like BloodHound. Here are just a few high-level themes and highlights. All of these sessions, including mine, will be made available on the BSidesSLC YouTube channel soon.

If you're planning to use Active Directory and/or Azure AD, run ADRecon/AzureADRecon and Bloodhound frequently and review in depth. Run ScoutSuite frequently and review as part of a normal operational cycle (e.g., at weekly team meetings make the results available and set aside 15 minutes to discuss and make assignments). Look critically at where these three tools overlap within two or three degrees of separation from your jump hosts (e.g., hosts/nodes that are one or two devices away and users/security groups that are one or two devices away) for help prioritizing when you have too many high-risk/high-impact items to look through.