HorusEye is an AI-assisted analysis platform that ingests BloodHound, Certipy, and NetExec output and produces ranked, scored attack paths for authorized penetration testers.
| Tool | Omar-tamerr/HorusEye — AI-assisted Active Directory attack-path analysis platform that ranks paths to Domain Admin from recon tool output |
| Category | Active Directory attack-path analysis and engagement reporting (Python, MIT) |
| Primary Use | Correlating SharpHound JSON, Certipy ESC findings, and ldapdomaindump output into a scored, ordered list of attack paths during authorized assessments |
| Safe Use | Intended for authorized penetration tests, lab environments such as HackTheBox Pro Labs, and internal red-vs-blue exercises against environments you are contracted to test |
| Telemetry Note | The tool itself is largely offline — the offline explorer makes no external requests — but the offense modules shell out to NetExec, impacket, and certipy, all of which generate standard Windows event-log and network telemetry defenders can monitor |
HorusEye, currently at v2.3 and written in Python 3.8+, positions itself as the connective tissue between the fragmented Active Directory toolchain. The author, Omar Tamer, frames the problem precisely: BloodHound shows you the graph but gives generic commands, Impacket gives execution without analysis, and Certipy reports ADCS findings without ranking which template is worth pursuing first. HorusEye ingests output from BloodHound, Certipy, ldapdomaindump, CrackMapExec, and NetExec, then scores every detected attack path by exploitability against the specific environment it just parsed. The output is a ranked, ordered walk from your current foothold toward Domain Admin, with the exact command appropriate to the accounts and configurations actually observed.
The detection engine covers 13 classes of attack path, which the README enumerates: Kerberoasting, AS-REP roasting, DCSync, ACL abuse, GPO abuse, unconstrained and constrained delegation, ADCS ESC1 through ESC8, domain trusts, privileged sessions, weak password policy, and stale admin accounts. What distinguishes the scoring from a flat severity label is a Tier-0 privilege model: any path that leads directly to Domain Admin is promoted to CRITICAL, so the ranking reflects genuine impact rather than a generic label. This is the kind of prioritization logic that matters on a real engagement where a SharpHound export covering 400 users and nested group memberships would otherwise produce thousands of unreadable rows.
Version 2.3 adds several features that push the tool toward professional and CI-grade use. The offline explorer, invoked with --explorer, emits a single self-contained HTML file containing a dashboard, a clickable attack-path graph with choke points highlighted in red, and a filterable findings explorer — with no server and no external requests, making it safe to hand directly to a client. Every finding now carries a rule_id, a confidence level with a stated reason, and structured evidence in the form of the actual ACEs and objects behind it, so each result is reproducible from source data. Provenance is explicit: findings trace to their exact source file, and a parse report with compatibility warnings distinguishes a genuinely clean domain from a thin import.
The graph engine, introduced in v2.2 with --graph, builds a directed control graph from group membership, abusable ACLs, local-admin rights, sessions, DCSync, and delegation relationships, then computes the shortest path from a foothold to Domain Admin. The foothold is set with --owned USER@DOMAIN, defaulting to any domain user. The README's own framing is apt: BloodHound shows you the graph, HorusEye tells you the order to walk it. Edges are labelled as observed versus inferred, paths rank with a stated rationale, and a remediation-impact view names the choke points — the single fixes that would break the path entirely, which is the detail that makes the same report useful to defenders.
That dual-audience design is explicit throughout. Every finding carries MITRE ATT&CK technique mappings, remediation steps, and detection guidance including relevant event IDs and telemetry sources. Noise reduction drops expected rights — Domain Admins holding GenericAll, domain controllers replicating directory data — collapses duplicate ACEs, and aggregates mass grants so that a real-world export yields a readable finding list. For pipeline integration, reports are byte-deterministic when SOURCE_DATE_EPOCH is set, a documented exit-code taxonomy of 0/1/2/3 lets CI distinguish clean from findings from incomplete runs, and --diff OLD.json plus --fail-on LEVEL support regression gating between assessment iterations.
The optional AI layer is where the project shows unusual discipline for this category. It uses the official Anthropic SDK with a current Claude model to add plain-English narratives per finding, but critically, AI output is validated and can never overwrite a verified field. The --ai-redact flag masks emails, IPs, domain names, and account names before any request leaves the machine, which is the correct posture for a tool handling client data under engagement NDAs. A SECURITY.md documents intended use, data egress, and reporting, and the credential-configured key is stored under ~/.horuseye/config.json set via --config.
Architecturally, the project is honest about its dependency surface. The only Python library dependency is rich; everything else — hashcat, john, nxc, evil-winrm, the impacket suite, certipy, bloodhound-python, pypykatz — is an external CLI tool that HorusEye orchestrates rather than imports. A --check-deps preflight groups installed tools by the feature that needs them, and detection plus scoring work with zero external tools at all. The parsers live in their own parsers/ package with orchestration in cli.py, and the README claims a pytest suite with CI, which the test badge corroborates.
Some offensive features in the README are explicitly marked as incomplete, and the transparency is worth crediting rather than penalizing: Auto-Chain and Auto-Exploit are labeled as stubs not yet wired, and the LSASS dump module prints commands only, with AV-aware selection noted as unwired. The features that are implemented — a three-round hashcat engine with AD-specific patterns, an 18-variant username wordlist generator, lockout-aware password spraying, lateral movement mapping, and persistence checklists including golden ticket and skeleton key scenarios — are framed around the standard external toolchain rather than custom weaponized code. From a documentary standpoint, this is orchestration and analysis, not novel exploit development.
For an authorized workflow, the strongest use case is the reconnaissance-to-report pipeline: collect with SharpHound or bloodhound-python, analyze and rank with HorusEye, then deliver a client-ready HTML or --markdown report with Mermaid diagrams, ATT&CK tables, and per-finding remediation and detection guidance. The --target flag generalizes pathfinding beyond Tier-0 to any critical asset, which fits assessments where the crown jewels are a SQL cluster or a build server rather than the domain itself. CTF players on HackTheBox Pro Labs, OSCP, and CPENT tracks get the compressed recon-to-privesc loop the README promises.
Where does it fit against the ecosystem? It is not competing with BloodHound — it consumes it. It competes with the manual triage operators do after collection, and with commercial attack-path products that do the same ranking behind a paywall. At roughly 30 stars it is an early-stage project, and anyone adopting it for client work should review the parsers and scoring rules themselves, verify the --ai-redact masking behavior against their own data-handling obligations, and treat the offense modules as conveniences around well-known tooling rather than audited capability. Installation is straightforward — git clone followed by pip install -e . gives you the horuseye command — and the MIT license permits full internal review, which for a tool making claims about your domain is not optional diligence.
Defensively, the tool deserves blue-team attention for two reasons. First, its detection guidance is genuinely useful: the same findings that tell an operator what to run next tell a defender which event IDs and telemetry sources to prioritize. Second, understanding which 13 path classes it ranks — and that it promotes Tier-0-reaching paths to CRITICAL — gives defenders a practical prioritization model for their own attack-path review programs, no engagement required.
Omar-tamerr/HorusEye.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.