Notes from the IR side of identity-based intrusions — how attackers actually move through AD and Entra ID, and what defenders can do about it before the next incident. No vendor angles, just what I see in real environments.
A fork of BloodHound Legacy 4.3.1 that keeps Legacy's readable big-graph layout but understands everything BloodHound CE collects - so large environments stay legible without losing ADCS, local groups or Tier Zero context.
A stolen vendor credential reached hundreds of Microsoft 365 tenants. Why MFA and Conditional Access didn't help, and the app permissions that did the damage.
New edges and Edge Filtering sections, pathfinding that follows every edge in the database, and Tier Zero icon fixes.
Restricting the Entra admin center doesn't stop standard users enumerating your directory. What actually closes the gap.
I'm an Incident Response Consultant with over 15 years in IT and a focus on identity security. My background includes ransomware response, intrusion investigations, and recovering compromised Active Directory environments.
This blog breaks down the AD and Entra ID patterns and misconfigurations that are well documented in the industry but still show up far too often in production — in a practical way that defenders and administrators can actually act on.