BloodHound is an open-source security tool that applies graph theory to discover, visualize, and analyze hidden attack paths and privilege escalation relationships within Active Directory and Azure Active Directory environments.
Graph Theory and Active Directory Attack Path Management
Active Directory (AD) and Microsoft Entra ID (formerly Azure AD) manage identities, access permissions, and trust boundaries across modern enterprise networks. Over years of organizational growth, access control lists (ACLs), nested security groups, administrative delegations, and service permissions accumulate into complex relationship webs. While administrators view these permissions in discrete dialogue boxes, attackers analyze the entire structure as a connected mathematical graph.
BloodHound bridges this visibility gap by transforming complex permissions into directed graph structures. Nodes represent discrete directory entities such as Users, Groups, Computers, Domains, and Organizational Units (OUs), while edges represent specific security permissions, group memberships, local administrative rights, or delegation privileges. By calculating the shortest path between an initial compromised identity and high-value targets like Domain Admins or Global Administrators, BloodHound reveals attack paths that traditional security scanners overlook.
Core Architecture: Ingestion, Database, and Visualization
The BloodHound ecosystem consists of three interconnected architectural components:
- Data Ingestors (SharpHound and AzureHound): SharpHound is a high-performance C# collector that gathers Active Directory data using LDAP queries, SAMR calls, and network session enumeration. AzureHound collects cloud identity relationships, role assignments, and service principal permissions via the Microsoft Graph API.
- Graph Database (Neo4j): The collected data is parsed and loaded into Neo4j, a dedicated graph database optimized for traversing highly interconnected datasets using the Cypher query language.
- User Interface: A dynamic desktop interface allows operators to run pre-built analytical queries, visualize complex permission chains, and filter specific attack paths.
SharpHound Data Collection Methods and Execution Flags
SharpHound provides multiple collection modes tailored to network size and operational requirements:
- DCOnly Mode: Queries only Domain Controllers via LDAP without generating endpoint network traffic, collecting domain trusts, group memberships, and object ACLs.
- Session and LoggedOn Collection: Connects to domain member workstations using NetSessionEnum and privileged registry inspection to map active administrative sessions and logged-on accounts.
- ComputerOnly Collection: Scans domain-joined machines for local administrator memberships, remote desktop users, and distributed COM permissions.
- ObjectProps Collection: Extracts detailed Active Directory properties such as pwdLastSet, servicePrincipalNames (SPNs), and unconstrained delegation flags.
Common Active Directory Attack Paths Identified by BloodHound
BloodHound maps diverse permission misconfigurations and privilege relationships, including:
- Direct and Transitive Group Memberships: Uncovering deeply nested group structures where a regular user account belongs to an intermediary group that inherits Domain Admin or Enterprise Admin privileges.
- Dangerous Active Directory Object ACLs: Identifying write permissions such as GenericAll, GenericWrite, WriteDacl, and WriteOwner over privileged groups or user accounts, enabling attackers to grant themselves administrative rights or reset target passwords.
- Kerberos Delegation and Abuse: Mapping accounts configured for Unconstrained Delegation or Resource-Based Constrained Delegation (RBCD), which can be exploited to impersonate privileged domain accounts.
- User Session and Local Admin Rights: Tracking where domain administrators have active sessions on workstations, exposing their credentials to memory scraping when lower-tier machines are compromised.
- Cross-Domain Trust Exploitation: Analyzing bi-directional and one-way trust relationships between internal domains and forest boundaries to determine cross-forest lateral movement routes.
Cloud Identity Paths in Microsoft Entra ID
In modern hybrid environments, on-premises Active Directory connects with Microsoft Entra ID, introducing new cloud-based attack paths that BloodHound maps with precision:
- Service Principal Permissions: Service principals assigned powerful Microsoft Graph application permissions (such as RoleManagement.ReadWrite.Directory or AppRoleAssignment.ReadWrite.All) can be abused to assign Global Administrator privileges.
- App Ownership and Secret Injection: Attackers with AddOwner or WriteOwner permissions over an application can generate new client secrets or certificates, assuming the identity of the service principal.
- Hybrid Identity Synchronization: Compromising on-premises synchronization servers or Azure AD Connect service accounts can allow adversaries to modify cloud attributes or forge cloud credentials.
Understanding these identity vectors is vital for safeguarding corporate infrastructure, directly connecting to the core security principles in Study Notes on Introduction to Information Security and Cyber Forensics. Furthermore, unauthorized exploitation of these attack paths violates statutory cybersecurity frameworks, as reflected in identity theft and digital access offenses under Cyber Laws Sec 66D.
Defensive Applications for Enterprise Security Teams
Although initially developed for penetration testers and red teams, BloodHound has become a vital defensive utility for security engineers and system administrators. Defensive applications include:
- Attack Path Remediation: Identifying and eliminating single control relationships that grant extensive administrative access across the domain.
- Implementing Tiered Administration: Enforcing the Microsoft Active Directory Administrative Tiering Model to prevent Tier 0 credentials from being exposed on Tier 1 servers or Tier 2 endpoints.
- Privileged Access Workstations (PAWs): Isolating administrative workflows to dedicated secure hardware with restricted network access.
- Continuous Posture Auditing: Regularly collecting directory data to detect newly introduced permission misconfigurations before adversaries exploit them.
Incident Response and Post-Compromise Graph Forensics
In digital forensics and incident response (DFIR) investigations, BloodHound provides critical triage capability when assessing network intrusions. When responders identify a compromised host or credential, mapping its outbound permissions through the graph reveals the attacker's potential blast radius. By tracing the shortest path between the breached account and tier-zero assets, incident response teams can immediately isolate critical lateral movement choke points, enforce credential resets for exposed service accounts, and prioritize memory acquisition on systems where privileged tokens were actively cached.
Access and Documentation
BloodHound is distributed as a free and open-source project under the GNU General Public License. Security professionals and administrators can access technical documentation and repository resources through the official documentation portal at https://github.com/BloodHoundAD/BloodHound/blob/master/docs/index.rst.