TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Black Hills InfoSec

PlumHound Reporting Engine for BloodHoundAD

Kassie Kimball · 2022-12-06 · Read original ↗

ATT&CK techniques detected

3 predictions
T1087.002Domain Account
93%
“use a single quote instead of double. ) [ " report title ", " [ output - format ] ", " [ output - file ] ", " [ cypherquery ] " ] what reports are packaged in the default list? the “ default. tasks ” instructs plumhound to also generate an index of all the produced reports, index…”
T1098Account Manipulation
53%
“group has been delegated to reset passwords and will count how many users are delegated to the group. next up, reports regarding the domain ’ s gpos and analysis of the gpo owners. then rdp groups that tell us if rdp access is provisioned via groups and which groups provide acces…”
T1654Log Enumeration
45%
“verbosity argument for plumhound is - v ( number ). the verbose number can be 0 - 1000, where “ 0 ” is quiet and 1000 produces a message on every crucial step of the plumhound process, somewhere in between is just that. too verbose? reduce your - v setting. not enough? increase i…”

Summary

Kent Ickler // It’s been over two years since Jordan and I talked about a Blue Team’s perspective on Red Team tools.   A Blue Team’s Perspective on Red Team Hack […]

The post PlumHound Reporting Engine for BloodHoundAD appeared first on Black Hills Information Security, Inc..