BloodHound

BloodHound is an Active Directory attack-path mapping tool originally built by Andy Robbins, Will Schroeder, and Rohan Vazarkar. Its collector (SharpHound, C#; or bloodhound-python) ingests AD objects — users, groups, computers, sessions, ACLs, trusts — into a Neo4j graph database, then uses graph traversal to reveal privilege-escalation paths that are invisible in flat listings: e.g. user → group membership → GenericAll over another group → ForceChangePassword over a Domain Admin. MITRE ATT&CK tracks it as software S0521. The current community edition is maintained by SpecterOps.

Why it matters

• ACL attack paths — the 1.3 “ACL Attack Path Update” (2017) added object-control edges ([[active-directory-weak-permissions|GenericAll, ForceChangePassword, AddMember, WriteOwner, WriteDacl, AllExtendedRights]]) with paired PowerView abuse cmdlets.
• Session data — SharpHound’s session collection replicates and automates PowerView user-hunting (Invoke-UserHunter) at domain scale.
• Trust mapping — charts cross-domain edges feeding trust pivot analysis.
• Defense too — the same queries surface misconfigurations for remediation; BloodHound Enterprise is SpecterOps’ commercial product built on this.

Collection

# SharpHound (in-memory, from a domain foothold)
Invoke-BloodHound -CollectionMethod All -ZipFileName loot.zip
 
# From Linux
bloodhound-python -u $USER -p $PASS -d $DOMAIN -ns $DC_IP -c All

Collection is loud in volume (LDAP bulk queries + SMB session enumeration per host) — defenders detect it via the same telemetry as manual enumeration, just amplified.

Core edge vocabulary

MemberOf, HasSession, AdminTo, GenericAll, ForceChangePassword, AddMember, GenericWrite, WriteDacl, WriteOwner, AllExtendedRights, DCSync, AllowedToDelegate, plus AD CS edges (ESC1–ESC13) in current releases. Edges marked traversable mean the source principal can take control of the destination; BloodHound’s pathfinding chains them into attack paths.

Sources

• MITRE ATT&CK S0521 — BloodHound
• 2017 — BloodHound 1.3 — The ACL Attack Path Update
• BloodHound Documentation (SpecterOps)
• BloodHoundAD/BloodHound (Legacy — GitHub)

Related: powerview, active-directory-weak-permissions, active-directory-enumeration, active-directory-lateral-movement, active-directory-trust-pivoting, kerberoasting, active-directory-certificate-services.