Building on our research from SO-CON 2025, this talk extends our Active Directory graph analysis framework. For OAIC, we pivot from defender-oriented use cases to an attacker's perspective. Still, our goal remains to think like both the attacker and the defender, to provide functionality to make everyone’s lives easier.

Our framework operationalizes the attacker's OODA loop within AD. The crucial Orient and Decide phases are automated by our enhanced algorithm, which uses linear programming to analyze the graph and select optimal attack paths based on a set of user-defined criteria, including attack difficulty and OPSEC.

This decision is then passed to the Model Context Protocol (MCP), which drives the Act phase. The MCP enables our agent, "Off-Leash Sniffer Dog," to execute a suite of offensive capabilities, including:
- Initial Access: Discovering plaintext passwords, Kerberoastable/AS-REP Roastable accounts, legacy machine account with fix password, and attacker self-defined compromised account
- Attack Execution: Automating attacks such as DACL abuse, RBCD, DCSync, AD CS escalation, and NTLM relays.

The MCP also supports flexible command generation using user-supplied tool lists or auto-detected binaries available on the host machine. Whether you’re an operator reducing analysis time, a defender exploring "what-if" scenarios, or an attacker seeking to automate attacks, this talk will show how to turn identity graphs into a fully functional OODA loop that covers the entire process from analysis to action.