BloodHound: attack paths in the domain

April 20, 2025 · 1 min read · #active-directory #bloodhound #recon

Active Directory is a graph of relationships: group memberships, ACLs, sessions, delegation. BloodHound collects this data and queries it to find escalation paths invisible to the eye.

How it is used

A collector (SharpHound) enumerates the domain; BloodHound imports the data into a Neo4j graph. Prebuilt queries show, for example, "shortest path to Domain Admins" from a compromised user, abusing weak ACLs (GenericAll, WriteDacl), privileged sessions, or delegation.

SharpHound.exe -c All
# then: MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:'DOMAIN ADMINS@..'}))

Defence

It is also a defensive tool: run it yourself to find and cut the paths. Reduce privileged group memberships, fix dangerous ACLs, limit where admins log in (session hygiene), apply tiering. Make the short graphs impossible.

« back to home