BloodHound

BloodHound is the go-to tool for analysing attack paths in Active Directory. It turns domain enumeration into a graph and answers the key question: from where I am, what is the shortest path to Domain Admin? Its value is not spotting a single permission but chaining dozens of relationships that would be invisible by hand.

Collection. A collector queries the domain and stores the result as several JSON files (later imported). The usual ones:

# from Linux, with only domain credentials
bloodhound-python -u <user> -p <pass> -d <domain> -ns <dc-ip> -c All

# from Windows, with the binary
SharpHound.exe -c All

# netexec can collect too
netexec ldap <dc-ip> -u <user> -p <pass> --bloodhound --collection All

-c All gathers users, groups, ACLs, active sessions, delegations, GPOs and memberships. The sessions part (which user is logged on to which host) is the noisiest and needs SMB/admin access; the rest comes from LDAP with a plain account.

The model. BloodHound draws each principal as a node and each permission or relationship as a directed edge. And here is the central idea: each edge is an abuse with a name. A ForceChangePassword arrow from A to B means A can become B; a GenericAll over a computer opens RBCD; a MemberOf into Domain Admins closes the chain. Reading the graph is reading the list of available ACL abuses: GenericAll, GenericWrite, ForceChangePassword, WriteDACL, WriteOwner, DCSync.

How it is used. Mark the starting point (right-click the controlled node, Mark as Owned) and run Shortest Path from Owned Principals, or custom Cypher queries:

MATCH p=shortestPath((n {owned:true})-[*1..]->(m:Group {name:"DOMAIN ADMINS@DOMAIN"})) RETURN p

Each node ships, under Help > Abuse Info, the exact command to abuse that edge, linking analysis to exploitation without leaving the tool.

Nuance. The graph reflects the state at collection time and shows what is theoretically possible per the ACEs; it does not confirm each edge works right now (a session may have expired, an account may be disabled). It is a map of candidate routes, not a guarantee: every step is verified as it is run. Version note: BloodHound Community Edition (BHCE) replaces the legacy build with the same graph model but a different interface and engine.

How to detect it. Collection is a bulk enumeration that leaves a signature. The LDAP part shows up best with LDAP query logging (the Directory Service channel or event 1644 with the Expensive/ Inefficient LDAP diagnostic enabled): a single client firing hundreds of LDAP queries in seconds, walking the whole tree, is not normal workstation activity. The sessions part touches SMB against many hosts (5145 on IPC$/srvsvc on each) in a short window. Honey accounts or canary objects (decoy objects with no legitimate use) turn any query that touches them into a high-fidelity alert, catching the collector even if it throttles its rate. On the network, SharpHound produces a very characteristic burst of LDAP/SAMR/SMB traffic.

Defence. The underlying mitigation is the same as for ACL abuse: run BloodHound defensively to find and cut the paths to Tier-0 before an attacker finds them.