BloodHound can map ANYTHING

SpectreOps releases BloodHound version 8 with major features including a table view for large datasets, a community query repository, open graph capabilities for modeling custom attack paths across any platform, and privilege zones for enterprise defenders 0:00.

Key Takeaways:
• Table View allows users to view query results as a sortable, filterable table, ideal for analyzing large datasets without relationships 6:30.
• Query Repository at queries.specops.io offers community-submitted Cypher queries that are automatically validated and can run directly against a user's BloodHound instance 8:05.
• Open Graph provides a generic ingest API allowing researchers to model attack paths for non-Microsoft platforms (e.g., 1Password, GitHub) using JSON payloads 11:01.
• Hybrid Pathfinding supports complex attack chains across platforms, such as moving from on-premise Active Directory to Azure Entra ID and then to GitHub write access 18:56.
• Privilege Zones in BloodHound Enterprise enable creating arbitrary groups of assets like PCI data or VIPs, allowing defenders to map attack paths to sensitive resources 31:24.

These updates transform BloodHound from a Microsoft-centric tool into a versatile platform for analyzing identity and attack paths across the entire enterprise ecosystem.

Sources:

• 0:00 Introduction to BloodHound version 8
• 6:30 Table View feature demonstration