Attack-Path Analysis — What Can a Compromised Host Reach?

Objective

When a host is compromised, the first question is blast radius: what can it reach? In a graph that is one traversal; in a SIEM query language it is a painful recursion. This recipe models the network as a reachability graph and finds every crown-jewel asset an attacker can pivot to.

Step 1: Model reachability

Nodes are hosts and assets; a REACHES edge means "can connect / authenticate to." A crown property marks the assets that matter.

MERGE (h:Node  {id: "WKS-42",  crown: false})
MERGE (s:Node  {id: "SRV-07",  crown: false})
MERGE (db:Node {id: "DB-PROD", crown: true})

MERGE (h)-[:REACHES]->(s)
MERGE (s)-[:REACHES]->(db);

Step 2: From a compromised host, find reachable crown jewels

The variable-length pattern -[:REACHES*1..4]-> follows every pivot up to four hops; the WHERE keeps only the assets you care about.

MATCH (h:Node {id: "WKS-42"})-[:REACHES*1..4]->(a:Node)
WHERE a.crown = true
RETURN a.id AS reachable_crown_jewel;

Result — the compromised workstation can pivot, two hops out, to the production database:

Why it matters

One pattern replaces a recursive multi-join and gives the SOC an immediate answer to "how bad is this?" Feed the entry host from a triage alert, and record the finding on a write-once action ledger. Correlate the technique against prior incidents with IOC semantic correlation.