Weekly puzzle
Find the path to Domain Admins.
A new identity graph every week, the same one for everyone. One account is compromised. Domain Admins is the prize. Find the cheapest way in, then close every route by removing the fewest steps. It is scored in your browser against the real optimum.
Fidelity scoring: a step's Tiered Fidelity™ level (Theoretical, Constrained, Validated) never changes its cost. When two cuts tie, the one that removes a Validated step, which telemetry has seen in use, wins the shield.
Last week ·
The cheapest path
The minimum cut
How it works
Two moves, the same rules as the product.
1 · Find the path
Walk from the compromised foothold to Domain Admins, one identity at a time. Every step is a real relationship, in the direction an attacker would use it: Member of, Local administrator, a Session on a host you control, or an ACL permission such as ForceChangePassword, GenericAll or WriteDacl. Fewer hops, or lower cost, scores higher.
2 · Close it
Remove the fewest steps so no route to Domain Admins is left. This is a minimum cut. Most single fixes just reroute the attacker, so the puzzle is finding the handful of steps that actually cut everyone off. The board recomputes as you go.
Fidelity, not cost
Each step carries a Tiered Fidelity™ level: Theoretical, Constrained or Validated. The level never changes what a step costs. It tells you how far to trust it. A Validated step is one telemetry has seen in use, so when two cuts tie, cutting the Validated one wins.
Explore a full sample companySee how fidelity works in the product
Map the real paths in your own directories.
The Public Preview is free for 30 days from your first sync, on your own server.