AdvancedActive Directory

BloodHound Guide: Mapping Active Directory Relationships

Learn how to use BloodHound and SharpHound for Active Directory reconnaissance, attack path analysis, privilege escalation detection, and security assessment.

#BloodHound#Active Directory#Reconnaissance#Attack Paths#Privilege Escalation

Introduction to BloodHound

BloodHound is an open-source tool that uses graph theory to reveal hidden relationships within Active Directory environments. Developed by SpecterOps, BloodHound maps AD objects as nodes in a graph database and identifies attack paths by analyzing edges between them. It visualizes AD relationships in ways impossible with traditional enumeration tools.

Prerequisites

**Active Directory Fundamentals** — Understanding of AD components

**Domain Enumeration** — Familiarity with AD reconnaissance

How BloodHound Works

BloodHound (UI + Analysis): The graphical interface running on Kali Linux, connected to a Neo4j graph database.

SharpHound (Data Collector): Runs on a domain-joined system, gathering data via LDAP queries, local admin checks, session enumeration, and ACL analysis.

Setting Up BloodHound

# Install Neo4j and BloodHound on Kali
sudo apt install neo4j bloodhound -y
sudo systemctl start neo4j

# Navigate to http://localhost:7474 and set neo4j:neo4j password

Running SharpHound

# PowerShell collection
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain corp.local

# Compiled executable
.\SharpHound.exe --CollectionMethods All --Domain corp.local

Key BloodHound Queries

Find Shortest Paths to Domain Admins: Maps the most efficient route from current compromise to Domain Admin.

Find Kerberoastable Accounts: Lists accounts with SPNs vulnerable to Kerberoasting.

Find Computers where Domain Users have Local Admin: Identifies shadow admin misconfigurations.

Find AS-REP Roastable Users: Users without Kerberos pre-authentication.

Advanced Analysis

BloodHound edges represent privilege escalation opportunities:

**MemberOf** — Group membership

**AdminTo** — Local admin on a computer

**HasSession** — Active session on a computer

**CanRDP** — RDP access to a computer

**AllowedToDelegate** — Delegation privileges

**AddMember** — Can add members to a group

ACL edges reveal subtle privilege escalations like GenericAll and WriteDacl that allow adding users to privileged groups.

Common Mistakes

Running SharpHound without domain context

Using **Session Collection** without permission (noisy)

Forgetting to validate with post-remediation collection

Best Practices

Run **multiple collection methods** for complete coverage

Use **encrypted LDAP** in production

Schedule **regular collections** to track AD changes

Combine with **manual review** — not every path is exploitable

Related Tools

**SharpHound** — BloodHound data collector

**AzureHound** — BloodHound for Azure AD

**PlumHound** — Task engine for BloodHound

**PowerView** — AD enumeration used by SharpHound

Domain Enumeration: Active Directory Reconnaissance Techniques

Active Directory Fundamentals: Windows Network Domains

Lateral Movement: Moving Through Network Environments

Kerberos Explained: Authentication Protocol Deep Dive

Summary

BloodHound reveals AD attack paths by mapping relationships as graph data. Used offensively, it identifies the most efficient route to privilege escalation. Used defensively, it helps organizations find and fix security gaps before attackers exploit them.

Related SMB Tool Recommendations

[SMBClient](/tools/smbclient) - Verify share access and browse discovered SMB shares

[Enum4Linux](/tools/enum4linux) - Enumerate SMB users, groups, shares, and policies

[Enum4Linux-NG](/tools/enum4linux-ng) - Run modern SMB enumeration with structured output

[NBTScan](/tools/nbtscan) - Resolve NetBIOS names before deeper SMB testing

[CrackMapExec](/tools/crackmapexec) - Scale SMB enumeration across larger networks

[NetExec](/tools/netexec) - Use modern SMB and Active Directory automation

Knowledge Check

What graph database does BloodHound use?

What does SharpHound collect?

What does the "Shortest Paths to Domain Admins" query reveal?

What type of accounts are vulnerable to Kerberoasting?

Frequently Asked Questions

What is BloodHound?

BloodHound is an open-source tool that uses graph theory to map Active Directory relationships and identify attack paths. Developed by SpecterOps, it visualizes AD objects as nodes and edges in a Neo4j graph database, revealing privilege escalation routes invisible to traditional enumeration.

What is SharpHound?

SharpHound is BloodHound's data collector that runs on domain-joined Windows systems. It gathers data via LDAP queries, local admin checks, session enumeration, and ACL analysis, then exports JSON files that BloodHound imports into its graph database for analysis.

How do I set up BloodHound on Kali Linux?

Install with `sudo apt install neo4j bloodhound -y`, start Neo4j with `sudo systemctl start neo4j`, then navigate to `http://localhost:7474` to set the database password. Launch BloodHound from the application menu or command line and connect to the Neo4j instance.

What does the 'Shortest Paths to Domain Admins' query do?

This built-in query maps the most efficient route from your current compromise position to Domain Admin privileges. It identifies every hop needed — compromised accounts, group memberships, ACL misconfigurations, and delegation rights — showing the fastest path to full domain control.

What is a Kerberoastable account in BloodHound?

BloodHound identifies accounts with Service Principal Names (SPNs) as Kerberoastable. Any domain user can request a service ticket for these accounts, which can be cracked offline with [Hashcat](/articles/hashcat-guide). See our [Kerberos guide](/articles/kerberos-explained) for attack details.

What do BloodHound edges represent?

Edges represent privilege escalation relationships between AD objects. Key edges include MemberOf (group membership), AdminTo (local admin access), HasSession (active session), CanRDP (remote desktop access), and GenericAll (full control). ACL edges reveal subtle escalation paths.

How does BloodHound help defenders?

Defensively, BloodHound identifies the same attack paths attackers would use, allowing organizations to fix misconfigurations before exploitation. It reveals excessive group memberships, unnecessary local admin rights, weak ACLs, and trust relationship abuse opportunities.

What is the difference between BloodHound and PowerView?

PowerView performs real-time AD enumeration via LDAP queries on live systems. BloodHound ingests collected data into a graph database for offline analysis and visualization. BloodHound excels at path analysis and relationship mapping, while PowerView provides raw enumeration data.

What collection methods does SharpHound support?

SharpHound offers Group, LocalAdmin, Session, Trusts, ACL, Container, and RDP collection methods. Use `--CollectionMethods All` for comprehensive coverage. Session and RDP collection are noisier and should only be used with authorization during penetration tests.

What is AzureHound?

AzureHound extends BloodHound to Azure AD (Entra ID) environments, mapping cloud identities, role assignments, and relationships alongside on-premises AD. It identifies cloud-to-on-premises attack paths that traditional BloodHound misses in hybrid environments.

What are common BloodHound mistakes?

Running SharpHound without proper domain context, using Session Collection without permission (very noisy), forgetting to run post-remediation collections to verify fixes, and trusting every graph path without manual validation — not every identified path is practically exploitable.