BloodHound shows you the path who can reach Domain Admin. It’s the right question, and the tools that answer it are excellent. But a reachability graph is blind to an entire class of problem, because the worst things in an Active Directory often aren’t a path at all.
They’re a backdoor welded into an attribute. A certificate that keeps working long after the password is reset. A permission stamped into the schema, so every object created from now on inherits it silently. A deleted account someone quietly kept the right to bring back. None of that is an edge in a graph, and all of it may be sitting in a directory right now.
Kestrel reads it. It’s a single native Windows executable - no server, no Python, no agent, zero dependencies, that runs with ordinary domain-user rights and audits the persistence a graph can’t express. Twenty-plus checks, from DCSync and AD CS to Golden SAML preconditions and MachineAccountQuota abuse, run from one command and end in a single severity-ranked findings list, each row shipping the exact fix.
One binary for every team. Red enumerates the persistence the graph misses and exports straight to BloodHound CE. Blue gets a prioritized, remediated report and a tool whose exact detection footprint is published, because Kestrel is read-only and detectable by design: no replication, no privilege escalation, no cloud.
It’s not that Kestrel is faster than a graph. It answers questions the graph can’t ask.
v1.0 is out now for free, open source, Apache 2.0.
→ github.com/ssteelfactor-oss/Kestrel
Top comments (0)