ADSynth: Synthesizing Realistic Active Directory Attack Graphs
Nhu Long Nguyen, Nickolas Falkner, Hung Nguyen · 2024
Active Directory (AD), a directory service for Windows domain networks, is a common target for attackers due to its widespread use and the confidential data it contains. According to Microsoft, 95 million AD accounts are attacked every day and new attacks involving AD are a common occurrence. Despite frequent attacks against Active Directory and its critical role in network security, there are no publicly available datasets and tools for generating realistic AD graphs. This absence hinders the development and testing of novel methods for protecting AD systems. Realistic AD datasets are also essential for training and up-skilling human AD defenders. In this work, we develop ADSynth, a scalable and realistic AD attack graph generator. ADSynth uses metagraphs to model design principles of realistic AD systems, relying on three novel ideas: (1) metagraph abstractions of best practices in AD organizational design, (2) metagraph abstractions of security design principles in AD systems, and (3) a random metagraph model of common security misconfigurations. Our experiments demonstrate ADSynth's scalability in creating realistic AD graphs under various security settings. We apply ADSynth to some recent research on AD security and demonstrate that data from ADSynth significantly benefit these studies. ADSynth has been released to the community11https.z/adsynthcsizcr.github.io/22https://github.com/adsynthesizer/ADSynth.git.