Incident Response Consultant · Sophos

Active Directory &
Identity Security

I work identity-based incidents — both proactive hardening and reactive response. AD tiering, Entra ID security, attack path management, and post-compromise recovery. Writing about what I see in real environments.

bloodhound · corp.local assessment
# Identity security assessment
 
$ SharpHound.exe -c All --domain corp.local
[*] Collecting AD objects...
[✓] Users: 2,847 · Groups: 312 · GPOs: 48
 
$ bloodhound --query shortest-paths-to-DA
[!] Tier 0 reachable from Tier 1: YES
[!] Kerberoastable SPNs with DA path: 6
[!] Unconstrained delegation (non-DC): 4
[!] Stale AdminCount=1 accounts: 23
[!] Entra Connect sync over-privileged
 
[*] Building remediation backlog...
[✓] 14 high-priority findings documented
 
$
What I Write About
🏰 AD Tiering & Microsoft EAM 🔍 Attack Path Management ☁️ Entra ID & Hybrid Identity 🚨 Incident Response & Recovery 🔐 AD Hardening 📡 Identity Threat Detection
Recent Posts
All posts →
🩸

BloodHound for Defenders: Using Attack Path Analysis to Find Your AD Gaps

How to run BloodHound proactively, write Cypher queries that surface real risk, and turn graph data into a remediation backlog your team can actually work through.

🔥

Post-Compromise AD Recovery: The Eviction Playbook Nobody Gives You

Threat actor eviction from Active Directory is one of the hardest IR problems. The decisions made in the first 48 hours determine whether you succeed — or give the attacker a way back.

🔗

Hybrid Identity Attack Surface: Where On-Prem AD and Entra ID Create Unexpected Risk

AD Connect sync, Pass-Through Authentication, seamless SSO — each one is a bridge that can be crossed the wrong way. Most defenders don't know they exist until an incident reveals them.

ET

Ed Truderung

Incident Response Consultant & Identity Specialist

I'm an Incident Response Consultant with over 15 years in IT and a focus on identity security. My background includes ransomware response, intrusion investigations, and recovering compromised Active Directory environments. I hold CompTIA Security+, ISC² SSCP, and ISC² CC certifications.

This blog covers Active Directory security, identity attack paths, and hardening strategies based on my professional experience in the field. The topics I write about reflect patterns and misconfigurations that are well documented in the industry but still show up far too often in production environments. My goal is to break them down in a practical way that defenders and administrators can actually act on.

ISC² SSCP ISC² CC CompTIA Security+ Sophos · Incident Response
LinkedIn