What it does. Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-internal-reconnaissance-with-bloodhound-ce, or copy the skill folder into ~/.claude/skills/conducting-internal-reconnaissance-with-bloodhound-ce/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md

SKILL.md (verbatim)

name: conducting-internal-reconnaissance-with-bloodhound-ce
description: Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths.
domain: cybersecurity
subdomain: red-teaming
tags:
- red-team
- reconnaissance
- bloodhound
- active-directory
- attack-paths
- privilege-escalation
- graph-analysis
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Restore Access
- Password Authentication
- Biometric Authentication
- Strong Password Policy
- Restore User Account Access
nist_csf:
- ID.RA-01
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1087.002
- T1069.002
- T1482
- T1018

Conducting Internal Reconnaissance with BloodHound CE

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

BloodHound Community Edition (CE) is a modern, web-based Active Directory reconnaissance platform developed by SpecterOps that uses graph theory to reveal hidden relationships and attack paths within AD environments. Unlike the legacy BloodHound application, BloodHound CE uses a PostgreSQL backend with a dedicated graph database, providing improved performance, a modern web UI, and enhanced API capabilities. Red teams use BloodHound CE to collect AD objects, ACLs, sessions, group memberships, and trust relationships, then visualize attack paths from compromised low-privileged accounts to high-value targets like Domain Admins. The SharpHound collector (v2 for CE) gathers data from Active Directory, while AzureHound collects from Azure AD / Entra ID environments.

When to Use

• When conducting security assessments that involve conducting internal reconnaissance with bloodhound ce
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Familiarity with red teaming concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Deploy BloodHound CE server using Docker Compose
• Collect AD data using SharpHound v2 or BloodHound.py
• Import collected data into BloodHound CE for graph analysis
• Identify shortest attack paths from owned principals to Domain Admins
• Discover ACL-based attack paths, Kerberoastable accounts, and delegation abuse
• Execute custom Cypher queries for advanced attack path analysis
• Generate attack path reports for engagement documentation

MITRE ATT&CK Mapping

• T1087.002 - Account Discovery: Domain Account
• T1069.002 - Permission Groups Discovery: Domain Groups
• T1482 - Domain Trust Discovery
• T1615 - Group Policy Discovery
• T1018 - Remote System Discovery
• T1033 - System Owner/User Discovery
• T1016 - System Network Configuration Discovery

Workflow

Phase 1: BloodHound CE Deployment

1. Deploy BloodHound CE using Docker Compose:

   curl -L https://ghst.ly/getbhce -o docker-compose.yml
   docker compose pull
   docker compose up -d
   

2. Access the web interface at https://localhost:8080
3. Log in with the default admin credentials (displayed in Docker logs):

   docker compose logs | grep "Initial Password"
   

4. Change the default admin password immediately

Phase 2: Data Collection with SharpHound v2

1. Transfer SharpHound v2 to the compromised Windows host:

   # Execute full collection
   .\SharpHound.exe -c All --outputdirectory C:\Temp
   
   # DCOnly collection (LDAP only, stealthier)
   .\SharpHound.exe -c DCOnly
   
   # Session collection for logged-on user mapping
   .\SharpHound.exe -c Session --loop --loopduration 02:00:00
   
   # Collect from specific domain
   .\SharpHound.exe -c All -d child.domain.local
   

2. Alternative: Use BloodHound.py from Linux:

   bloodhound-python -u user -p 'Password123' -d domain.local -ns 10.10.10.1 -c All
   

3. Exfiltrate the generated ZIP file to the analysis workstation

Phase 3: Data Import and Initial Analysis

1. Upload collected data via the BloodHound CE web interface (File Ingest)
2. Mark compromised accounts as "Owned" in the interface
3. Run built-in analysis queries:
   • Shortest Path to Domain Admin
   • Kerberoastable Users with Path to DA
   • AS-REP Roastable Users
   • Users with DCSync Rights
   • Computers with Unconstrained Delegation

Phase 4: Custom Cypher Queries

1. Execute custom Cypher queries in the BloodHound CE search bar:

   // Find shortest path from owned principals to Domain Admins
   MATCH p=shortestPath((n {owned:true})-[*1..]->(m:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
   RETURN p
   
   // Find Kerberoastable users with path to DA
   MATCH (u:User {hasspn:true})
   MATCH p=shortestPath((u)-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
   RETURN p
   
   // Find computers with sessions of DA members
   MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
   RETURN c.name, u.name
   
   // Find ACL-based attack paths (GenericAll, WriteDACL, GenericWrite)
   MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(t)
   WHERE u.owned = true
   RETURN p
   
   // Find users who can DCSync
   MATCH (u)-[:MemberOf*0..]->()-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)
   RETURN u.name, d.name
   
   // Find computers with LAPS but readable by non-admins
   MATCH (c:Computer {haslaps:true})
   MATCH p=(u:User)-[:ReadLAPSPassword]->(c)
   RETURN p
   

Phase 5: Attack Path Prioritization

1. Score identified attack paths by:
   • Number of hops (shorter = higher priority)
   • Stealth requirements (avoid noisy techniques)
   • Tool availability for each hop
   • Likelihood of detection at each step
2. Create an execution plan for the highest-priority paths
3. Identify required tools for each step in the chain
4. Plan OPSEC considerations for each technique

Tools and Resources

Key Attack Path Types

Validation Criteria

• BloodHound CE deployed and accessible
• SharpHound v2 data collected from all domains in scope
• Data successfully imported into BloodHound CE
• Owned principals marked in the interface
• Shortest paths to Domain Admin identified
• ACL-based attack paths documented
• Kerberoastable and AS-REP roastable accounts listed
• Custom Cypher queries executed for advanced analysis
• Attack paths prioritized by feasibility and stealth
• Report generated with all identified paths and evidence

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

BloodHound CE Reconnaissance Report Template

Engagement Details

Collection Summary

Attack Paths Identified

High-Value Findings

Remediation Priority

references/api-reference.md (verbatim)

BloodHound CE Reconnaissance — API Reference

Libraries

Key neo4j Driver Methods

Critical Cypher Queries

BloodHound Python Ingestor

bloodhound-python -d domain.local -u user -p pass -ns DC_IP -c all --zip

Collection methods: all, group, localadmin, session, trusts, objectprops, acl

MITRE ATT&CK Mapping

External References

• BloodHound CE Documentation
• neo4j Python Driver
• BloodHound Cypher Cheatsheet

references/standards.md (verbatim)

Standards and References - BloodHound CE Reconnaissance

MITRE ATT&CK References

Official Resources

• BloodHound CE: https://github.com/SpecterOps/BloodHound
• SharpHound: https://github.com/BloodHoundAD/SharpHound
• BloodHound.py: https://github.com/dirkjanm/BloodHound.py
• BloodHound Query Library: https://queries.specterops.io/
• AzureHound: https://github.com/BloodHoundAD/AzureHound

Key Research

• SpecterOps: An Ace in the Hole - Stealthy Data Collection with BloodHound
• Compass Security: BloodHound Community Edition Custom Queries (2025)
• SpecterOps: Introducing the BloodHound Query Library (2025)

references/workflows.md (verbatim)

Workflows - BloodHound CE Reconnaissance

Complete Reconnaissance Workflow

1. Deployment
   ├── Pull BloodHound CE Docker images
   ├── Start services with docker compose up -d
   ├── Access web UI and set admin password
   └── Verify API connectivity

2. Data Collection
   ├── Choose collector: SharpHound v2 (Windows) or BloodHound.py (Linux)
   ├── Run All collection method for comprehensive data
   ├── Run Session collection in loop for user mapping
   ├── Collect from all reachable domains
   └── Exfiltrate ZIP data to analysis workstation

3. Import and Setup
   ├── Upload ZIP files via BloodHound CE web interface
   ├── Wait for data processing to complete
   ├── Mark owned/compromised principals
   └── Set high-value targets

4. Analysis
   ├── Run built-in attack path queries
   ├── Execute custom Cypher queries
   ├── Identify ACL abuse opportunities
   ├── Map delegation configurations
   ├── Find Kerberoastable / AS-REP roastable accounts
   └── Discover GPO modification paths

5. Attack Planning
   ├── Prioritize paths by hop count and stealth
   ├── Identify tools needed per hop
   ├── Plan OPSEC for each technique
   └── Document execution plan

6. Reporting
   ├── Export graph visualizations
   ├── Generate path summaries
   ├── Document all findings with evidence
   └── Provide remediation recommendations

Stealthy Collection Workflow

Low-Noise Collection:
  1. DCOnly mode: Only queries domain controllers via LDAP
     SharpHound.exe -c DCOnly

  2. Targeted collection: Specific container/OU
     SharpHound.exe -c All --searchbase "OU=Servers,DC=domain,DC=local"

  3. Session loop: Passive session enumeration over time
     SharpHound.exe -c Session --loop --loopduration 04:00:00 --loopinterval 00:05:00

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.