Taming the Attack Graph: A Many Subgraphs Approach to Attack Path Analysis

This blog proposes a framework using technology subgraphs, decomposition, and graph abstraction to model hybrid attack paths across enterprise platforms, highlighting “credential watering holes” like GitHub Secret Scanning that can fan out access to many systems. It illustrates the approach with a red team scenario that leveraged GitHub org-admin access to enumerate secret-scanning alerts and harvest credentials (e.g., GCP service accounts), and introduces SecretHound for modeling secrets within BloodHound OpenGraph. The article emphasizes identifying subgraph-local tier-zero nodes and applying OpenGraph collectors to manage and visualize cross-platform attack paths.