Adding MSSQL to BloodHound with OpenGraph

The post introduces MSSQLHound, a PowerShell collector that leverages BloodHound 8.0’s OpenGraph to model MSSQL attack paths by adding new nodes and edges, shifting to a composition model that separates non-traversable permission edges from traversable attack-action edges for clearer pathfinding and remediation. It details collection/processing logic, resource considerations, and unit-testing insights, and demonstrates practical research and operations with Cypher queries—including a default SCCM scenario where TRUSTWORTHY databases and EXECUTE AS OWNER can enable host-level code execution—enabling both offensive discovery and defensive analysis of MSSQL permissions and attack paths.