HorusEye

See the path. Know the fix.

An AI-assisted Active Directory attack-path platform. It ingests BloodHound, Certipy, ldapdomaindump and NetExec output, then ranks every path by exploitability, proves it with evidence, and hands red teams the command and blue teams the remediation — in one portable, offline report.

▶ Try the live demo Get started View on GitHub
latest release CI status python 3.8+ license MIT platform Linux and Windows
horuseye — shortest path to Domain Admin
$ horuseye --bloodhound ./bh/ --domain corp.local \
      --graph --owned 'jdoe@corp.local' --explorer report.html

  » 8 findings — 2 CRITICAL, 5 HIGH

  Path 1  (3 hops: JDOE → CORP.LOCAL)
    JDOE@CORP.LOCAL
      │ MemberOf            ▸ HELPDESK@CORP.LOCAL
      │ ForceChangePassword ▸ HELPDESK-SVC@CORP.LOCAL
      │ DCSync              ▸ CORP.LOCAL

  » Remediation impact (break the path):
    ✂ remove MemberOf JDOE ▸ HELPDESK  (no alternative remains)

  🧭 Explorer → report.html
attack path
✂ Member of Admin to Has session FOOTHOLD JDOE HELPDESK WEB01 TARGET ADMINISTRATOR
Where it fits

BloodHound maps the graph.
HorusEye tells you what to do about it.

HorusEye doesn't replace your collectors — it consumes their output and turns a graph of relationships into a ranked, defensible plan of action for both sides of the engagement.

SharpHound / BloodHound Certipy NetExec → HorusEye → Ranked paths + evidence + fixes
What it does

One analysis, two audiences

Thirteen attack-path detections, scored by real exploitability — each with the evidence behind it, the command to validate it, and the fix and detection to close it.

🗺️

Shortest path to DA

A deterministic graph from any foothold to Domain Admin across membership, ACLs, local-admin, sessions, DCSync and delegation — with the command for each step.

✂️

Remediation options

Names the choke point, then compares ways to break every route — fewest changes, keep group memberships, or fix nearest the targets — and shows who loses what access with each. Mark access people need with --keep and it is never proposed.

🔎

Evidence & confidence

Every finding carries the exact ACEs/objects behind it, a confidence level, and the source file — so it's reproducible, not a black box.

🛡️

Built for defenders too

MITRE ATT&CK mapping, concrete remediation steps, and detection guidance (event IDs) on every finding. One report, red and blue.

🧭

Offline explorer

A single self-contained HTML file — dashboard, interactive attack graph, step-by-step walkthrough and filterable findings. No server; nothing leaves the file.

⚙️

CI-ready & private

--diff retests, --fail-on exit codes, byte-deterministic output, and --ai-redact to keep client names off any API. A stable Python API, too.

How it compares

Complementary, not a clone

BloodHound is the standard for collecting and exploring Active Directory attack graphs. HorusEye works on the same data and focuses on what comes next: triage, evidence and remediation in a portable report.

 BloodHound Community EditionHorusEye
Primary jobCollect and explore the AD / Entra ID relationship graphTriage, score and explain attack paths from collected data
InterfaceWeb app with a REST API (API-first)CLI, a portable offline HTML report, and a Python API
DeploymentDocker Compose: application, PostgreSQL and Neo4jOne pip install, one runtime dependency (rich), no server
GuidanceEdge documentation with abuse info, OPSEC notes and referencesPer finding: evidence, confidence, command, fix, detection, ATT&CK
RemediationAttack path management and remediation guidance in BloodHound Enterprise (commercial)Built-in choke-point analysis plus fix options that each break every route, showing who loses what access; required access can be kept
Retest & CIScriptable through the REST API--diff retests and --fail-on exit codes, built in
LicenseApache-2.0MIT

HorusEye is an independent open-source project, not affiliated with SpecterOps. BloodHound details are from SpecterOps' public documentation (October 2026). HorusEye ingests BloodHound/SharpHound data — use both.

See it live

The explorer, running in your browser

A real HorusEye report on a synthetic domain: two attack routes to domain control, the single fix that breaks both, and every finding with its evidence. No install required.

Open the demo full-screen ↗

Get started

Install in one line

Python 3.8+ on Linux or Windows. The only runtime dependency is rich.

$pip install git+https://github.com/Omar-tamerr/HorusEye
$horuseye --bloodhound ./bh/ --domain corp.local --graph --explorer report.html
1 · Collect

Run SharpHound (-c All), Certipy or NetExec as you already do.

2 · Analyse

Point HorusEye at the output. Get ranked paths, evidence and fixes in seconds.

3 · Report

Ship the offline explorer, Markdown or JSON — or gate CI with --fail-on.

For authorized security assessments, CTF practice and defensive analysis only. Use only against systems you own or have explicit written permission to test.