{ "Name": "BloodHound Enterprise", "Author": "SpecterOps - support@specterops.io", "Logo": "", "Description": "The BloodHound Enterprise Microsoft Sentinel solution ingests your BloodHound Enterprise posture and attack paths into Microsoft Sentinel. Use the dashboards to track the Active Directory and Azure attack paths of your environment. Create alerts to detect when new attack paths emerge or new the exposure increases.", "WorkbookBladeDescription": "This Microsoft Sentinel Solution installs workbooks. Workbooks provide a flexible canvas for data monitoring, analysis, and the creation of rich visual reports within the Azure portal. They allow you to tap into one or many data sources from Microsoft Sentinel and combine them into unified interactive experiences.", "AnalyticalRuleBladeDescription": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view. ", "Workbooks": [ "Workbooks/BloodHoundEnterpriseAttackPathDetails.json", "Workbooks/BloodHoundEnterpriseAttackPathOverview.json", "Workbooks/BloodHoundEnterpriseAuditLogs.json", "Workbooks/BloodHoundEnterpriseTierZeroSearch.json", "Workbooks/BloodHoundFindingTrends.json", "Workbooks/BloodHoundPostureHistory.json" ], "Analytic Rules": [ "Analytic Rules/AddKeyCredentialLinkPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/LargeDefaultGroupsWithWritegplinkPrivilege.yaml", "Analytic Rules/AddMemberPrivilegesOnTierZeroSecurityGroups.yaml", "Analytic Rules/LargeDefaultGroupsWithWriteownerlimitedrightsPrivileges.yaml", "Analytic Rules/AddMembersToTierZeroGroup.yaml", "Analytic Rules/LargeDefaultGroupsWithWriteownerPrivileges.yaml", "Analytic Rules/AddownerRoleOnTierZeroResource.yaml", "Analytic Rules/LargeDefaultGroupsWithWriteserviceprincipalnamePrivileges.yaml", "Analytic Rules/AddOwnerToTierZeroObjectViaMsGraphAppRole.yaml", "Analytic Rules/LargeDefaultGroupWithSynclapspasswordPrivileges.yaml", "Analytic Rules/AddSecretToTierZeroPrincipal.yaml", "Analytic Rules/LegacySidHistoryOnTierZeroObjects.yaml", "Analytic Rules/AddselfPrivilegeOnTierZeroSecurityGroups.yaml", "Analytic Rules/LimitedOwnershipPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/AdminsOnTierZeroComputers.yaml", "Analytic Rules/LogicAppContributorRoleOnTierZeroLogicApp.yaml", "Analytic Rules/AksContributorRoleOnTierZeroManagedCluster.yaml", "Analytic Rules/LogonsFromTierZeroUsers.yaml", "Analytic Rules/AllextendedPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/NonTierZeroPrincipalsWithAdcsEsc10ScenarioAPrivileges.yaml", "Analytic Rules/AppAdminControlOfTierZeroPrincipal.yaml", "Analytic Rules/NonTierZeroPrincipalsWithAdcsEsc13PrivilegesAgainstTierZeroGroup.yaml", "Analytic Rules/AvereContributorRoleOnTierZeroVirtualMachine.yaml", "Analytic Rules/NonTierZeroPrincipalsWithAdcsEsc1Privileges.yaml", "Analytic Rules/BasedConstrainedDelegationPrivilegesOnTierZeroComputers.yaml", "Analytic Rules/NonTierZeroResourceAssignedToTierZeroServicePrincipal.yaml", "Analytic Rules/BasedConstrainedDelegationPrivileges.yaml", "Analytic Rules/OwnerRoleOnTierZeroResource.yaml", "Analytic Rules/BasedNtlmRelayToAdcs(esc8)Attack.yaml", "Analytic Rules/OwnershipOfTierZeroPrincipal.yaml", "Analytic Rules/BasedNtlmRelayToLdapAttack.yaml", "Analytic Rules/OwnershipPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/BasedNtlmRelayToLdapsAttack.yaml", "Analytic Rules/PsRemoteUsersOnTierZeroComputers.yaml", "Analytic Rules/BasedNtlmRelayToSmbAttack.yaml", "Analytic Rules/RdpUsersOnTierZeroComputers.yaml", "Analytic Rules/CloudAppAdminOverTierZeroPrincipal.yaml", "Analytic Rules/ReadGmsaPasswordPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/CommandExecutionOnTierZeroVirtualMachine.yaml", "Analytic Rules/ReadlapspasswordPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/ConstrainedDelegationOnTierZeroComputers.yaml", "Analytic Rules/RepRoastableUserAccounts.yaml", "Analytic Rules/ContributorRoleOnTierZeroAutomationAccount.yaml", "Analytic Rules/ResetATierZeroUser_sPassword.yaml", "Analytic Rules/ContributorRoleOnTierZeroResource.yaml", "Analytic Rules/SqlAdminUsersOnTierZeroComputers.yaml", "Analytic Rules/DcomUsersOnTierZeroComputers.yaml", "Analytic Rules/SynclapspasswordPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/ForcechangepasswordPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/TierZeroAdUserSyncedToTierZeroEntraUser.yaml", "Analytic Rules/GenericallPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/TierZeroComputerHostingEnterprisecaTrustedForNtAuthentication.yaml", "Analytic Rules/GenericwritePrivilegesOnTierZeroObjects.yaml", "Analytic Rules/TierZeroComputer.yaml", "Analytic Rules/GetCertifcatesOnTierZeroKeyVault.yaml", "Analytic Rules/TierZeroEntraUserSyncedToTierZeroAdUser.yaml", "Analytic Rules/GetKeysOnTierZeroKeyVault.yaml", "Analytic Rules/TierZeroGroupControlViaMsGraphAppRole.yaml", "Analytic Rules/GetSecretsOnTierZeroKeyVault.yaml", "Analytic Rules/TierZeroPrincipalCanGrantTierZeroAppRoles.yaml", "Analytic Rules/KerberoastableUserAccounts.yaml", "Analytic Rules/TierZeroPrincipalCanGrantTierZeroEntraIdRole.yaml", "Analytic Rules/KerberosDelegationOnTierZeroObjects.yaml", "Analytic Rules/TierZeroPrincipalsWithAdcsEsc10ScenarioBPrivileges.yaml", "Analytic Rules/KeyVaultContributorRoleOnTierZeroResource.yaml", "Analytic Rules/TierZeroPrincipalsWithAdcsEsc3Privileges.yaml", "Analytic Rules/LargeDefaultGroupsInDcomUsersGroups.yaml", "Analytic Rules/TierZeroPrincipalsWithAdcsEsc4Privileges.yaml", "Analytic Rules/LargeDefaultGroupsInLocalAdministratorGroups.yaml", "Analytic Rules/TierZeroPrincipalsWithAdcsEsc6ScenarioAPrivileges.yaml", "Analytic Rules/LargeDefaultGroupsInPsRemoteUsersGroups.yaml", "Analytic Rules/TierZeroPrincipalsWithAdcsEsc6ScenarioBPrivileges.yaml", "Analytic Rules/LargeDefaultGroupsInSqlAdminsGroups.yaml", "Analytic Rules/TierZeroPrincipalsWithAdcsEsc9ScenarioAPrivileges.yaml", "Analytic Rules/LargeDefaultGroupsWithAddKeyCredentialLinkPrivileges.yaml", "Analytic Rules/TierZeroPrincipalsWithAdcsEsc9ScenarioBPrivileges.yaml", "Analytic Rules/LargeDefaultGroupsWithAddMemberPrivileges.yaml", "Analytic Rules/TierZeroPrincipalsWithDcsyncPrivileges.yaml", "Analytic Rules/LargeDefaultGroupsWithAddSelfPrivileges.yaml", "Analytic Rules/TierZeroPrincipalTrustedForUnconstrainedDelegation.yaml", "Analytic Rules/LargeDefaultGroupsWithAllExtendedPrivileges.yaml", "Analytic Rules/TierZeroServicePrincipalControlViaMsGraphAppRole.yaml", "Analytic Rules/LargeDefaultGroupsWithForcechangepasswordPrivileges.yaml", "Analytic Rules/UserAccessAdminRoleOnTierZeroResource.yaml", "Analytic Rules/LargeDefaultGroupsWithGenericallPrivileges.yaml", "Analytic Rules/VmAdminLoginRoleOnTierZeroSystem.yaml", "Analytic Rules/LargeDefaultGroupsWithGenericwritePrivileges.yaml", "Analytic Rules/VmContributorRoleOnTierZeroSystem.yaml", "Analytic Rules/LargeDefaultGroupsWithLimitedOwnershipPrivileges.yaml", "Analytic Rules/WebsiteContributorRoleOnTierZeroResource.yaml", "Analytic Rules/LargeDefaultGroupsWithOwnershipPrivileges.yaml", "Analytic Rules/WriteAccountRestrictionsPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/LargeDefaultGroupsWithRdpAccess.yaml", "Analytic Rules/WritedaclPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/LargeDefaultGroupsWithReadGmsaPasswordPrivileges.yaml", "Analytic Rules/WritegplinkPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/LargeDefaultGroupsWithReadLapsPasswordPrivileges.yaml", "Analytic Rules/WriteownerlimitedrightsPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/LargeDefaultGroupsWithWriteaccountrestrictionsPrivileges.yaml", "Analytic Rules/WriteownerPrivilegesOnTierZeroObjects.yaml", "Analytic Rules/LargeDefaultGroupsWithWritedaclPrivilege.yaml", "Analytic Rules/WriteserviceprincipalnamePrivilegesOnTierZeroObjects.yaml" ], "Parsers": [ ], "Data Connectors": [ "Data Connectors/BloodHoundFunction.json" ], "Playbooks": [], "Hunting Queries": [], "Watchlists": [], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\BloodHound Enterprise", "Version": "3.2.2", "Metadata": "SolutionMetadata.json", "TemplateSpec": true }