Crate adhammer_graph 

Control-path graph (the BloodHound-style layer, in-process on petgraph).

Nodes are security principals; a directed edge A -> B means “A holds a primitive that lets it control B”. We seed Tier-0 (Domain/Enterprise Admins, DC computers, the domain head) and do a reverse traversal to find every principal that can reach it. Each edge carries a weight; the cheapest path is the attacker’s likely route.

Structs

AttackPath

ControlGraph

Node

SchemaMap

lDAPDisplayName ⇄ schemaIDGUID, case-insensitive by name.

Step

One hop of an attack path, with everything a report needs about it: what it is, what it buys the attacker, the command that walks it, and how a defender removes it.

Enums

ControlPrimitive

A concrete thing a trustee can do to an object, derived from one ACE.

EdgeKind

Edge label. ACL-derived edges are ad_acl::ControlPrimitives; the rest come from object attributes rather than from a security descriptor.