adhammer-graph 1.5.0

What it is

Turns an AD snapshot into a directed control graph and finds the cheapest walkable path from any principal to a Tier-0 target (Domain Admins, Enterprise Admins, krbtgt, an EA-equivalent).

Every edge names the primitive that walks it (GenericAll, WriteDACL, AddKeyCredential, AllowedToDelegateTo, MemberOf, AddSelf, WriteSPN, AddMember, …); every path knows the CLI invocation that tries to walk it, so an operator can go from "here's the chain" to "here's the shell that fires it" without re-typing.

Consumers include the adhammer-report crate (renders the top-N paths into JSON/HTML/Markdown) and the CLI itself (surfaces the chain in scan output).

Install

[dependencies]
adhammer-graph = "1.4"

Example

use adhammer_graph::{AttackPath, ControlGraph, EdgeKind};

// ControlGraph::from(&snapshot) builds every AD-side control edge from
// object ACEs, group memberships, delegation flags, and dMSA principals.
// Then find_cheapest_paths_to_tier0() enumerates walkable chains.

Related

• adhammer — the CLI.
• adhammer-collector — produces the snapshot this crate consumes.
• adhammer-report — renders AttackPath into report body + BloodHound-style SVG.
• adhammer-bloodhound — export the graph in BloodHound CE v5 JSON.

License

MIT — see LICENSE.