BD BloodHound Narrator

- **Additional lateral movement edges** — `CanRDP`, `CanPSRemote`, `ExecuteDCOM`, `SQLAdmin`, `WriteSPN`, `WriteAccountRestrictions`.

- Lateral movement rebalanced: `AdminTo` and `HasSession` now score 3 each individually, and the combination bonus dropped from 10 to 5 to avoid double counting.

$lines.Add("*This path enables significant lateral movement or privilege escalation that could compromise sensitive business systems and data.*`n")

'Deploy Credential Guard on endpoints to prevent credential harvesting.'

'GenericWrite on a user permits SPN injection (targeted Kerberoasting) and shadow-credential attacks — treat as privilege escalation, not a write permission.'

# ── v1.0.2: lateral movement ──

title   = 'Break the Lateral Movement Chain'

# ── Lateral movement ──

# ── Factor: lateral movement chain ──

$reasons.Add('Lateral movement chain: local admin + session hijack enables credential theft')

description: Turn BloodHound attack path exports into dual-layer security reports — CISO executive prose on top, technical remediation playbook below. Automates Active Directory audit reporting for pe

**Detected attack patterns:** DCSync and directory replication rights, Kerberoasting, unconstrained delegation, resource-based constrained delegation (RBCD), shadow credentials (AddKeyCredentialLink),

| Lateral movement chain (AdminTo + HasSession) | +5 |

- Post-pentest AD audit reporting