Mapping RBAC in BloodHound | SO-CON 26

Hope Walker presents a solution for improving how BloodHound maps Role-Based Access Control (RBAC) in Entra ID, addressing critical gaps in shortest path calculations, scoped assignments, and custom roles 0:00.

Key Takeaways:
• Current BloodHound RBAC mapping has five key issues: inaccurate shortest path calculations, limited scoped assignment support, no custom role visibility, static role representations, and resulting inaccurate findings 3:30.
• The proposed solution abstracts role assignments into separate nodes and uses composition edges that collapse multiple permissions into single edges, preserving shortest path accuracy 6:30.
• By mapping individual permissions rather than predefined roles, custom roles automatically gain coverage since they reuse permissions from built-in roles 8:30.
• Scoped role assignments, such as administrative units, are handled by connecting principals only to resources within that specific scope 12:00.
• This approach is designed to be repeatable across multiple RBAC systems including Azure RM and Intune, though implementation is still in progress 14:00.

This research provides a foundational framework for more accurate attack path analysis in environments using Microsoft's RBAC systems.

Sources:

• 0:00 Introduction and speaker background
• 3:30 Problems with current BloodHound RBAC mapping
• 6:30 Solution: role assignment nodes and composition edges
• 8:30 Custom role coverage through permission map