Building an AD attack path into a report finding, with no external graph server

Mapping an attack path in Active Directory typically takes two tools that don't talk to each other. One to explore the graph and another to write the report. In Neuron, it's one. Let me show you the whole trip from collection to a finished finding without leaving Neuron.

In this engagement, we'll import a sample Active Directory dataset. This dataset immediately becomes available to all of the other teammates working on this engagement with me. As I click in here, you can now see a full list of nodes, and we can start executing all of the queries that we have in our query library.

Once that's complete, I can filter for queries that just have results. And let's take a look at a roastable user. Let's assume that we've been able to crack the password for this user. From here, we want to get to domain admin.

And we can immediately see that we have a couple of different options. I'll enable the select tool, and I'll highlight the path that I took during the engagement. Let's turn on the focus view so that I can more easily see the path I took through the network.

Now let's create a finding. Give it a little bit more context about what happened. Now that our finding's been generated, let's accept and create. We'll quickly review the content for accuracy, and the graph is embedded into our finding. Submit it for QA and we're done.

In this quick demo, you've seen how Neuron can give you and your team back hours of your valuable time during every engagement. When your graphing platform is integrated with your reporting platform, that's Neuron. Stop by today at neuron.ws.