P-BLO
BloodHound
Active Directory graphs for abuse paths and privilege relationships.
OVERVIEW
BloodHound turns an Active Directory's structure (users, groups, ACLs, sessions, delegations) into a graph, after ingesting data collected by something like SharpHound. Predefined or custom Cypher queries then run against that graph to surface abuse paths.
Instead of enumerating permissions one by one, it lets you ask directly 'what's the shortest path from this user to Domain Admins?' and get the answer visualized as a chain of exploitable relationships.
USE CASES
Practical use cases
- 01
Finding the shortest path from already-obtained credentials to Domain Admin.
- 02
Identifying misconfigured ACLs or abusable Kerberos delegations.
- 03
Prioritizing which hosts and accounts to attack next based on impact, not alphabetical order.
- 04
Justifying in the report why a service account with excessive permissions is a critical finding.
QUICK START
With in-scope domain credentials already obtained, to see what is reachable and prioritize lateral movement over noise.
- Collect domain data with an authorized collector (e.g. SharpHound) from an in-scope account.
- Import the collected data into the BloodHound instance.
- Mark already-compromised accounts as "owned" to scope the analysis.
- Run the built-in shortest-path-to-Domain-Admins queries and prioritize from there.
BEFORE YOU RUN IT
What to check before running it
SharpHound collection generates a high volume of LDAP/SMB queries, detectable by AD-aware EDR rules.
Collected data represents the entire directory structure: treat it as sensitive and dispose of it per the engagement's rules.
The graph reflects a single point in time; on active domains, re-validate before acting on a path found days earlier.