BloodHound Attack Path Analysis

You have collected BloodHound data from a target Active Directory environment and loaded it into the Neo4j interface.

Guide the analysis to identify the shortest and most reliable path to Domain Admin:

**Step 1 — High-Value Target Identification**
- What built-in queries should you run first to understand the environment?
- How do you identify Tier 0 assets beyond just "Domain Admins"?
- What makes a path "reliable" vs "noisy" from an attacker's perspective?

**Step 2 — Path Analysis**
- How do you interpret ACL edges: WriteDACL, GenericAll, GenericWrite, AddMember, ForceChangePassword?
- What does "transitive object control" mean and why does it matter?
- How do you identify paths through Group Policy Objects (GPOs) and Organizational Units (OUs)?

**Step 3 — Prioritizing Exploitation**
- Given three different paths to DA with different edge counts and edge types, how do you choose?
- How do session data (where admins log in) influence your approach?
- What is the risk profile of each common edge type?

**Step 4 — Custom Cypher Queries**
- Write a Cypher query to find all users with paths to DA in under 3 hops
- Write a query to find computers where Domain Admins have active sessions
- Write a query to find all objects a given user has control over

Output:
- Analysis methodology with reasoning at each step
- 3 example Cypher queries with explanation
- Prioritized attack path recommendation