1. Mental Model & Architectural Core
BloodHound CE (Community Edition) uses graph theory to reveal attack paths in Active Directory that would take humans weeks to manually discover. SharpHound (the collector) gathers AD data, and BloodHound visualizes it as a directed graph where edges represent exploitable relationships GenericAll, WriteDACL, DCSync, GPO links and automatically finds shortest paths to Domain Admin.
Active Directory is a city with thousands of streets and buildings (users, groups, computers, GPOs). BloodHound is Google Maps for attackers you tell it "I am here (low-priv user) and I want to reach here (Domain Admin)" and it finds you the 3-hop path you could never discover by reading LDAP dumps.
- After initial foothold in AD: map attack paths to Domain Admin from your current user
- Purple team: identify high-risk ACL relationships before an attacker does
- ADCS enumeration: identify ESC1-ESC14 vulnerable certificate templates
- Find Kerberoastable accounts with paths to privileged groups
- Run "Shortest Paths to Domain Admins" discovers GenericAll → GPO → DC chains in seconds
- Find users with DCSync rights (DS-Replication-Get-Changes) via custom Cypher queries
- Map ADCS ESC1 vulnerable templates to users who can enroll for instant privilege escalation
SharpHound (C#) or bloodhound-python queries LDAP and SAMR to collect AD objects: users, groups, computers, GPOs, OUs, trusts, ACLs, and session data. This JSON data is ingested into a Neo4j graph database. BloodHound's query engine uses Cypher (graph query language) to find paths via relationship edges. Pre-built queries surface the most dangerous misconfigurations automatically.
2. Syntax, Flags & Live Telemetry
| Flag / Option | Description |
|---|---|
| bloodhound-python -u "user" -p "pass" -d corp.local -ns 10.10.10.1 --zip | Collect all AD data from Linux using Python collector |
| SharpHound.exe -c All --zipfilename output.zip | Collect all data from Windows with SharpHound (C#) |
| SharpHound.exe -c ACL,ObjectProps,Trusts | Collect only ACLs, object properties, and trust data |
| Cypher: MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"})) RETURN p | Find shortest path from any user to Domain Admins group |
| Cypher: MATCH (u:User {owned: true}) RETURN u | List all nodes you have marked as owned |
bloodhound-python -u "svc_backup" -p "Password123!" -d corp.local -ns 10.10.10.1 -c All --zip
After ingestion, immediately run the pre-built query "Find Shortest Paths to Domain Admins" and "Find Principals with DCSync Rights". Mark every compromised account as owned (right-click → Mark as Owned) and re-run paths to see new routes opening from your compromised nodes.
3. Hands-On Practice Labs & Cyber Ranges
4. Detection & Prevention Playbook
- Enable Advanced Audit Policies: DS Access, Account Logon, Object Access
- Monitor for LDAP queries fetching all user/group/computer objects simultaneously
- Implement Tier 0/1/2 Admin model to reduce lateral movement paths
- Use Microsoft Defender for Identity (MDI) which detects BloodHound collection patterns