v1.2.0

First release since the public launch. Mostly ADCS and SCCM coverage, plus a fix for a performance regression that was on main for a couple of weeks.

New checks

• ESC6a — pre-patch CA EDITF_ATTRIBUTESUBJECTALTNAME2 abuse. The existing ESC6 check is now ESC6b for symmetry.
• ESC3 victim template — matches Certipy's criteria, gated on a paired enrollment-agent template and on the agent and victim ACLs actually overlapping, so it no longer fires on templates you can't chain.

SCCM

• SCCM_Site targets now surface in builtin and common group analysis, as do the SCCM collector's Coerce edges.
• SCCMTakeover6 requires a distinct site server before firing.
• Relay findings use the raw edge type names rather than renamed ones.
• Path chains render scope separately instead of folding it into the path. Previously scope nodes were appended with > and no edge label, which read as hops that don't exist; SCCM_AssignAllPermissions is now visible in the chain.

MSSQL

• ExecuteAs chains enumerate all branches instead of stopping at the first.
• Dropped the no-target fallback in the NTLM relay check.

Fixes

• Escalation path performance. A disabled-victim guard added on 9 July made the escalation batch query roughly 3.5x slower with no change to the findings it produced. It was reverted — if you cloned main between 9 and 22 July you were getting correct results, just slowly. Pull to get the speed back; there is nothing to re-run.
• NTDS lookups for single-domain runs route through the audit context partition; the legacy NTDS parser is gone.
• Stale RID for LAB-SQL01$ in the sample NTDS.

Housekeeping

• requirements.txt for anyone who prefers pip install -r over an editable install. pyproject.toml remains the source of truth.
• Interesting/abuse relationship lists consolidated into modules/relationships.py. CoerceAndRelayToADCS added; CoerceAndRelayNTLMToLDAP and LDAPS dropped from the abuse-edge allowlist.
• Fixture-test docs pinned to neo4j:4.4, matching CI and the Neo4j version BloodHound CE ships.
• Refreshed sample data and regenerated sample reports.

v1.1.0

Initial public release.

ADPathfinder maps Active Directory attack paths for pentesters and red teamers. It ingests BloodHound CE data plus OpenGraph plugins, including native support for MSSQLHound and ConfigManBearPig, and surfaces paths from low-privileged users and computers to high-value targets.

Includes coverage across AD, ADCS, SCCM, MSSQL, cross-domain paths, and password-audit correlation against NTDS hashes and hashcat potfiles. HTML reports are generated for AD findings and password audits, with text, JSON, and diagnostics outputs available.

See the wiki for setup, configuration, and contributor docs.