About
About Pathwarden and this site
Why Pathwarden exists, how to use it responsibly, and what this website does (and doesn't do) with your visit.
On this page
Why Pathwarden exists
Attack path management is a way to defend Active Directory. Instead of working through lists of misconfigurations, a team measures how many accounts can reach Tier Zero and cuts those paths off. Doing that on every collection has needed a commercial platform.
Pathwarden does it for free. It is one program that reads BloodHound collector data, finds the attack paths to Tier Zero, works out the fewest changes that close them, and tracks each fix until a retest shows it fixed. The knowledge base on this site explains the attacks and their fixes for everyone responsible for Active Directory, not only specialists.
License
Pathwarden is open source under the Apache License 2.0. The site's own text is part of the same project. The remediation guides and documentation shown here are generated from the Pathwarden repository at version 1.0.0-rc.1.
Responsible use
Only collect and analyze environments you are authorized to assess. Collector output is a map of your domain for an attacker: store it like credentials, and delete it after analysis.
The knowledge base explains how attacks work at the level of the public research and vendor documentation it cites, so that defenders can recognize and fix them. It deliberately doesn't give step-by-step exploitation instructions.
Privacy note for this website
This is a static website. It is built to collect nothing about you:
- No cookies and no analytics or tracking scripts.
- No third-party requests. The headline font is served from this site, and so is every script, stylesheet and image. A Content Security Policy on every page blocks anything else from loading.
- No referrer is sent when you follow a link to another site.
- Your theme choice (dark or light) is saved in your browser's local storage, on your device only, and never sent anywhere.
- Search runs in your browser. The site downloads a small index and searches it locally; what you type never leaves your device.
The site is hosted on Neocities. Like any web host, Neocities processes the technical data needed to deliver pages (such as your IP address) under its own privacy policy. This site adds nothing on top.
We think a security tool's website should be held to the standard it recommends, so it uses no frameworks or content delivery networks, and every byte it serves can be audited.
Privacy in the product
Pathwarden itself runs on your own computer, with no account and no cloud service. The app listens on 127.0.0.1 only, or, in the Windows desktop window*, on no network port at all. Run history goes to a folder or a git repository you choose. It keeps finding titles, which name the accounts they are about, and, if you choose, full runs. A passphrase can encrypt it. See where your data goes for the details.
Credits
Pathwarden stands on the work of others. Attack path analysis was pioneered by BloodHound, created by Andy Robbins, Rohan Vazarkar and Will Schroeder and now maintained by SpecterOps; Pathwarden reads the data format of its collectors, SharpHound and RustHound-CE, and its built-in collector is based on RustHound-CE. The AD CS checks follow SpecterOps' Certified Pre-Owned research and its successors. MITRE ATT&CK technique IDs are used throughout the knowledge base.
Headlines are set in Barlow by Jeremy Tribby, under the SIL Open Font License 1.1.
BloodHound, SharpHound and SpecterOps are trademarks of their owners. Pathwarden is an independent project, not affiliated with or endorsed by SpecterOps or Microsoft.
Very new and undergoing testing. These features haven't received a lot of testing yet. Try them out and let us know what's working.