Skip to content

Add "non-tier-zero shortest path to tier zero" queries - #51

Merged
1 commit merged into
SpecterOps:mainfrom
chryzsh:add-non-t0-shortest-paths
Apr 15, 2026
Merged

Add "non-tier-zero shortest path to tier zero" queries#51
1 commit merged into
SpecterOps:mainfrom
chryzsh:add-non-t0-shortest-paths

Conversation

@chryzsh

Copy link
Copy Markdown
Contributor

We found that breaking down paths to Tier Zero by source type makes sense during testing and helps vizualise specific attacks paths to Tier Zero in reporting. We found them to be a good alternative to the built-in "Shortest paths to Tier Zero / High Value targets" query, which doesn't exclude Tier Zero to Tier Zero paths. Each query filters sources that are NOT Tier Zero and targets that ARE Tier Zero using both Tag_Tier_Zero labels and system_tags.

  • Shortest paths from non-Tier Zero computers to Tier Zero
  • Shortest paths from non-Tier Zero groups to Tier Zero
  • Shortest paths from non-Tier Zero objects to Tier Zero
  • Shortest paths from non-Tier Zero user accounts to Tier Zero

@martinsohn

Copy link
Copy Markdown
Collaborator

Hi @chryzsh! I'll get those added in an upcoming change. Thank you :)

@martinsohnmartinsohn self-assigned this Apr 4, 2026
@chryzsh

Copy link
Copy Markdown
ContributorAuthor

Great! Thank you!

@martinsohnmartinsohn mentioned this pull request Apr 15, 2026
@martinsohnmartinsohn closed this pull request by merging all changes into SpecterOps:main in 93706e1Apr 15, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@chryzsh@martinsohn