BloodHound: AD attack path mapping

BloodHound is an open-source tool that maps Active Directory attack paths using graph theory. It collects relationship data between users, computers, groups, GPOs, and OUs, then visualizes privilege escalation routes inside a Neo4j graph database. The core mechanism relies on SharpHound, a C# ingestor that queries LDAP and SMB to enumerate object permissions, session data, and group memberships. BloodHound exposes dangerous misconfigurations that are invisible to traditional audits, such as GenericAll rights, unconstrained delegation, or transitive group memberships. A low-privileged domain user can often reach Domain Admin through a chain of seemingly harmless ACL entries. This makes BloodHound critical for both Red Teams planning lateral movement and Blue Teams auditing AD hygiene. The tool introduced the concept of 'shortest attack paths', allowing attackers to identify the minimal privilege chain from any owned node to a high-value target. BloodHound CE (Community Edition) extends this with a REST API and multi-user collaboration features. Understanding BloodHound's collection methods and graph queries is now a baseline skill for any AD security practitioner.

Detecting BloodHound collection activity requires monitoring several distinct data sources. SharpHound generates high-volume LDAP queries in a short time window. Event ID 1644 on domain controllers logs expensive or frequent LDAP queries and can surface abnormal enumeration bursts. Event ID 4662 tracks accesses to sensitive AD object attributes such as ms-Mcs-AdmPwd or servicePrincipalName. SMB-based session enumeration triggers Event ID 4624 (logon type 3) and Event ID 4648 across many hosts in rapid succession. NetCease and SAMRi10 hardening measures reduce the effectiveness of session enumeration and generate errors that BloodHound-based collectors cannot silently ignore. SIEM rules should baseline LDAP query volumes per source host and alert on deviations. EDR telemetry can flag SharpHound binary execution by hash or by its characteristic process behaviors, including memory injection variants. Network detection via Zeek or Suricata can identify LDAP traffic anomalies, particularly when a non-DC host issues hundreds of LDAP searches within minutes. BloodHound's DCOnly collection mode reduces network noise but is still detectable through LDAP log volume on the domain controller itself.

Red Teams use BloodHound to plan precise attack paths rather than noisy broad enumeration. After running SharpHound with flags such as '--CollectionMethods All' or '--CollectionMethods DCOnly', analysts load the resulting JSON files into BloodHound and run pre-built queries like 'Shortest Paths to Domain Admins' or 'Find Principals with DCSync Rights'. Custom Cypher queries against the Neo4j backend allow fine-grained path analysis beyond built-in queries. Common exploitable paths include WriteDacl or GenericWrite permissions on user objects, enabling targeted ACL abuse without touching privileged groups directly. Kerberoastable accounts reachable through short attack chains are high-priority targets. BloodHound data also reveals AS-REP roastable accounts and computers with unconstrained delegation. On the defensive side, the BloodHound data itself drives remediation: Tier Model enforcement, AdminSDHolder cleanup, and removal of excessive ACL entries all reduce the number of viable paths. Tools like PlumHound and Pwned Passwords integration with BloodHound help prioritize remediation by criticality. Purple Team exercises should regularly re-ingest fresh SharpHound data and measure path reduction over time to validate that hardening efforts are effective and sustainable.