Good Fences Make Good Neighbors: New AD Trusts Attack Paths in BloodHound

This post introduces BloodHound v7.4–v7.5 enhancements for mapping Active Directory trust attack paths: replacing the TrustedBy edge with SameForestTrust (traversable) and CrossForestTrust (non-traversable), adding traversable edges for abusable cross-forest configurations (AbuseTGTDelegation and SpoofSIDHistory), capturing trustAttributes from both sides to correctly model SID filtering and TGT delegation, expanding special identity modeling (Authenticated Users/Everyone propagation and a new ClaimSpecialIdentity edge), and adding HasTrustKeys to represent the trust account attack. It clarifies when and how SID history spoofing and TGT delegation can be abused across trusts, highlights limitations like selective authentication and transitivity, and provides guidance to audit trusts and understand forest-wide security boundaries.