🔐 IdentityGuard - AD + Entra ID Attack-Path Analyzer

IdentityGuard is a Python-based Purple Teaming tool designed to analyze Active Directory and Entra ID environments for misconfigurations and lateral movement paths. It demonstrates a deep understanding of Identity Security, similar to enterprise tools like BloodHound.

This project proves an ability to move beyond simply executing attacks, focusing instead on identifying, visualizing, and mitigating the underlying identity architecture flaws that make attacks possible.

🏗️ Architecture

IdentityGuard works by ingesting JSON data (simulating output from enumeration tools like SharpHound) and building a directed graph of relationships.

AD Data (JSON)
      ↓
Graph Engine (core/graph_engine.py)
      ↓
Analyzers (analyzers/)
   ├─ Lateral Movement BFS (Finds paths to Domain Admins)
   └─ Identity Misconfigs (Stale accounts, Kerberos risks)
      ↓
CLI Reporter (main.py)

✨ Key Features

• Graph-Based Attack Path Finding: Uses Breadth-First Search (BFS) algorithms to trace how a low-privileged user (e.g., jsmith) can pivot through groups and sessions to compromise a Tier 0 asset (e.g., a Domain Controller).
• Kerberos Risk Analysis: Automatically flags accounts vulnerable to AS-REP Roasting (where DoNotRequirePreAuth is true).
• Stale Account Detection: Identifies dormant accounts (inactive > 90 days) that increase the attack surface.
• Local Lab Ready: Comes with a built-in ad_mock.json dataset, allowing you to run and test the analyzer immediately without needing to deploy a heavy Windows Server Domain Controller locally.

🚀 Quick Start

Ensure you have Python 3 installed. No external dependencies are required.

python main.py

Expected Output Example:

==================================================
IDENTITY GUARD - ATTACK PATH REPORT
==================================================

[ATTACK PATH DETECTED]
Risk: CRITICAL
Reason: Excessive privilege path leading to Tier 0 compromise.

Path:
User: jsmith
  -> (MemberOf)
Group: HelpDesk
  -> (AdminTo)
Server: WEB-SRV-01
  -> (HasSession)
User: admin_local
  -> (MemberOf)
Group: Domain Admins
  -> (AdminTo)
Server: DC-01

[MISCONFIGURATIONS DETECTED]
Risk: HIGH | Reason: AS-REP Roasting Vulnerability (User: svc_backup lacks PreAuth)
Risk: MEDIUM | Reason: Stale Account Detected (User: old_intern last logon 120 days ago)

==================================================

---

Built to showcase Purple Teaming, Attack Path Management, and Python Graph Analysis.