Bloodhound
BloodHound maps Active Directory relationships and visualizes attack paths from any starting position to high-value targets. It transforms raw AD data, users, groups, sessions, ACLs, trusts, into a graph database that reveals non-obvious connections between objects.
Strategic context
Active Directory environments are complex. A domain with thousands of users, hundreds of groups, and layered delegation creates relationships that are impossible to map manually. BloodHound automates this mapping and presents it as a navigable graph.
BloodHound excels at revealing indirect paths. A standard user may not have a direct relationship to the Domain Admin group, but maybe a member of a group that has local admin access on a workstation where a Domain Admin has an active session. BloodHound makes these chains visible.
For security leaders, BloodHound reveals the actual attack surface of an Active Directory environment. Running BloodHound defensively (as BloodHound Community Edition or similar) provides the same visibility that attackers gain.
Execution examples
Data collection
BloodHound requires collected data about the domain. Collection is performed by SharpHound (Windows) or BloodHound-Python (Linux).
# SharpHound (on a domain-joined Windows host)
.\SharpHound.exe -c All
# BloodHound-Python (from Linux with domain credentials)
bloodhound-python -d domain.local -u user -p password -c All -ns DC_IPThe -c All flag collects all data types: users, groups, sessions, local admins, ACLs, trusts, and object properties. The collection generates a ZIP file that is imported into the BloodHound application.
Collection generates significant LDAP and SMB traffic. SharpHound with all collection methods touches every domain-joined computer to enumerate sessions and local groups. Consider the OPSEC implications and whether selective collection (-c DCOnly for example) is more appropriate for the engagement.
Analysis
After importing data, analysis begins with pre-built queries and extends to custom investigation.
Useful starting queries:
Shortest paths to Domain Admins: reveals the most direct escalation routes
Kerberoastable users: identifies service accounts whose tickets can be requested and cracked
AS-REP roastable users: identifies accounts vulnerable to offline hash cracking
Find computers where Domain Users are local admin: reveals overly permissive local admin configurations
Shortest paths from owned principals: after marking compromised accounts as "owned," shows the most efficient paths forward
Where BloodHound fits in the lifecycle
Reconnaissance: AD enumeration and attack path identification
Privilege escalation: identifying and validating escalation paths through AD relationships
Lateral movement: identifying which systems to target based on session and admin data
Last updated