Incident Response Consultant · Sophos

Active Directory &
Identity Security

Notes from the IR side of identity-based intrusions — how attackers actually move through AD and Entra ID, and what defenders can do about it before the next incident. No vendor angles, just what I see in real environments.

Read the Blog → GitHub
18articles
2projects
Oct 2026latest post
bloodhound · corp.local assessment
# Identity security assessment
 
$ SharpHound.exe -c All --domain corp.local
[*] Collecting AD objects...
[✓] Users: 2,847 · Groups: 312 · GPOs: 48
 
$ bloodhound --query shortest-paths-to-DA
[!] Tier 0 reachable from Tier 1: YES
[!] Kerberoastable SPNs with DA path: 6
[!] ADCS ESC1 from Domain Users: 1
[!] Unconstrained delegation (non-DC): 4
[!] Stale AdminCount=1 accounts: 23
 
[*] Building remediation backlog...
[✓] 14 high-priority findings documented
 
$
New on GitHub
edtrud385/BloodHound-Legacy

BloodHound Legacy, now fluent in CE data

A fork of BloodHound Legacy 4.3.1 that keeps Legacy's readable big-graph layout but understands everything BloodHound CE collects - so large environments stay legible without losing ADCS, local groups or Tier Zero context.

ADCS ESC1–ESC13 CE node icons Tier Zero markers Global edge filter PNG export
Read the write-up → View on GitHub
ADCSESC1 → Expand ADCS Composition
An ADCS ESC1 edge expanded into its underlying attack chain in BloodHound Legacy
Latest Posts
All 18 posts →
New Here? Start With These
  1. 01 Anatomy of a Domain CompromiseA real intrusion pattern, from initial access to Domain Admin. 7 min
  2. 02 BloodHound for DefendersFind your attack paths before an attacker does. 6 min
  3. 03 The Event IDs That Actually MatterThe Windows logs that reveal identity attacks in progress. 9 min
  4. 04 Post-Compromise AD RecoveryThe eviction playbook for the first 48 hours. 5 min
What I Write About
AD Tiering & Microsoft EAM Attack Path Management Entra ID & Hybrid Identity Incident Response & Recovery AD Hardening Identity Threat Detection
ET

Ed Truderung

Incident Response Consultant & Identity Specialist

I'm an Incident Response Consultant with over 15 years in IT and a focus on identity security. My background includes ransomware response, intrusion investigations, and recovering compromised Active Directory environments.

This blog breaks down the AD and Entra ID patterns and misconfigurations that are well documented in the industry but still show up far too often in production — in a practical way that defenders and administrators can actually act on.

ISC² SSCP ISC² CC CompTIA Security+ Sophos · Incident Response
LinkedIn → GitHub