BloodHound

What BloodHound Is and Why Both Sides Use It

BloodHound is an open-source AD attack path mapping tool developed by SpecterOps. It uses graph theory to visualize relationships between AD objects — users, groups, computers, sessions, ACLs, and GPOs — and identifies attack paths to high-value targets like Domain Admins.

• BloodHound answers the question: “What can this user do, directly or indirectly, to get to Domain Admin?” The answer is rarely direct — it chains together group memberships, computer access, session control, ACL abuse, and privilege escalation.
• The tool consists of three components: a collector (runs on a domain-joined system and gathers data), a graph database (Neo4j backend storing the relationships), and a user interface (Electron-based GUI for visualizing and querying attack paths).
• For blue teams, BloodHound is a continuous security assessment tool. Run it monthly, compare outputs, and track the reduction in attack paths over time.

MITRE ATT&CK maps AD enumeration to T1087 (Account Discovery) and T1069 (Permission Groups Discovery). BloodHound automates both.

Collection Methods

SharpHound (Windows Collector)

SharpHound is the primary BloodHound collector. It runs on any domain-joined Windows system and gathers AD data using LDAP queries, WinRM, and RPC.

Collection methods:

Running SharpHound

# Basic collection (most common — users, groups, computers, sessions, ACLs)
SharpHound.exe --CollectionMethod Default

# Full collection (all methods — takes longer but gives complete picture)
SharpHound.exe --CollectionMethod All

# Specific collection — just ACLs and sessions
SharpHound.exe --CollectionMethod ACL,Sessions

# Encrypted collection (zip file with password)
SharpHound.exe --CollectionMethod Default --ZipPassword

# Collect from a specific domain (multidomain environments)
SharpHound.exe --Domain target.corp.local

AzureHound (Azure AD Collector)

AzureHound collects Azure AD and Azure RBAC data, mapping attack paths in cloud environments.

# Authenticate to Azure
Connect-AzureAD

# Run AzureHound collection
Import-Module AzureHound.psd1
Invoke-AzureHound -OutputDirectory C:\BloodHound\

What Data to Collect (Blue Team Focus)

For blue team assessments, start with:

Key BloodHound Graph Edges

BloodHound models relationships as edges between AD objects. Each edge represents an attack path.

Primary Attack Path Edges

Blue Team Priority Edge Check

For blue teams, these edges should be flagged as findings:

Blue Team Workflow — Finding and Fixing Attack Paths

Step 1: Collect and Import

# Run SharpHound on a domain-joined system
SharpHound.exe --CollectionMethod Default --OutputPrefix "corp-monthly"

# Import the resulting zip file into BloodHound UI or API
# File → Upload → Select corp-monthly_*.zip

Step 2: Run Built-In Queries (Analyst Focus)

BloodHound has pre-built queries. For blue team analysis:

Step 3: Analyze the Attack Graph

Cypher query — find all users who can reach Domain Admin in 3 hops or fewer:

MATCH (u:User)-[r1*1..3]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"})
RETURN u.name, count(r1) as pathCount
ORDER BY pathCount DESC

Cypher query — find all kerberoastable accounts that are Domain Admins:

MATCH (u:User {hasspn:true})-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"})
RETURN u.name, u.displayname, u.samaccountname

Step 4: Remediate Priority Findings

BloodHound CE (Community Edition)

BloodHound CE is the current version (replacing the legacy BloodHound 4.x). Key differences:

Quick Start with BloodHound CE

# Clone and start BloodHound CE
git clone https://github.com/SpecterOps/BloodHound.git
cd BloodHound/examples/docker-compose
docker compose up -d

# Access the UI at http://localhost:8080
# Upload SharpHound zip files via the Web UI

Blue Team Automation — Continuous BloodHound Assessment

For production blue team use, BloodHound should run on a schedule:

# Example automation using task scheduler (weekly)
Schedule: Every Monday at 2:00 AM
Action: 
  1. PowerShell: Download latest SharpHound
  2. PowerShell: Run SharpHound --CollectionMethod Default --OutputPrefix "corp-weekly"
  3. PowerShell: Upload zip to BloodHound CE API
  4. Automated analysis: Compare with previous week's data
  5. Report: Generate finding diff report (new edges discovered, old edges remediated)

SPL query — track BloodHound findings over time (if findings logged to SIEM, or via Metasploit automation):

index=splunk sourcetype="bloodhound_findings"
| stats count by finding_type, severity, host
| eval remediation_status = if(count > 0 AND count = latest_count, "UNCHANGED", if(count < latest_count, "IMPROVED", "WORSENED"))
| table finding_type, host, severity, count, remediation_status

Related

• Azure Sentinel — detection and response for T1654 techniques
• Burp Suite — detection and response for T1592 techniques
• Cobalt Strike — Detection and Beacon Analysis — detection and response for T1055, T1572, T1071 techniques

Sources

• BloodHound — SpecterOps
• BloodHound CE Documentation
• SpecterOps — BloodHound Cypher Cheat Sheet
• MITRE ATT&CK T1087 — Account Discovery
• BloodHound on GitHub