What it does. BloodHound is a graph-based Active Directory reconnaissance tool that Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/exploiting-active-directory-with-bloodhound/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-active-directory-with-bloodhound, or copy the skill folder into ~/.claude/skills/exploiting-active-directory-with-bloodhound/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-active-directory-with-bloodhound/SKILL.md

SKILL.md (verbatim)

name: exploiting-active-directory-with-bloodhound
description: BloodHound is a graph-based Active Directory reconnaissance tool that
  uses graph theory to reveal hidden and unintended relationships within AD environments.
  Red teams use BloodHound to identify attac
domain: cybersecurity
subdomain: red-teaming
tags:
- red-team
- adversary-simulation
- mitre-attack
- exploitation
- post-exploitation
- active-directory
- bloodhound
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Restore Access
- Password Authentication
- Biometric Authentication
- Strong Password Policy
- Restore User Account Access
nist_csf:
- ID.RA-01
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1595
- T1190
- T1059
- T1078
- T1592

Exploiting Active Directory with BloodHound

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments. Red teams use BloodHound to identify attack paths from compromised accounts to high-value targets such as Domain Admins, identifying privilege escalation chains that would be nearly impossible to find manually. SharpHound is the official data collector that gathers AD objects, relationships, ACLs, sessions, and group memberships.

When to Use

• When performing authorized security testing that involves exploiting active directory with bloodhound
• When analyzing malware samples or attack artifacts in a controlled environment
• When conducting red team exercises or penetration testing engagements
• When building detection capabilities based on offensive technique understanding

Prerequisites

• Familiarity with red teaming concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Collect Active Directory relationship data using SharpHound or BloodHound.py
• Visualize attack paths from compromised accounts to Domain Admin
• Identify misconfigured ACLs, group memberships, and delegation settings
• Discover shortest attack paths to high-value targets
• Map Kerberos delegation configurations for abuse
• Document all identified privilege escalation chains

MITRE ATT&CK Mapping

• T1087.002 - Account Discovery: Domain Account
• T1069.002 - Permission Groups Discovery: Domain Groups
• T1482 - Domain Trust Discovery
• T1615 - Group Policy Discovery
• T1018 - Remote System Discovery
• T1033 - System Owner/User Discovery
• T1016 - System Network Configuration Discovery

Workflow

Phase 1: Data Collection with SharpHound

1. Transfer SharpHound collector to compromised host
2. Execute collection with appropriate method (All, DCOnly, Session, LoggedOn)
3. Collect from all reachable domains if multi-domain environment
4. Exfiltrate ZIP data files to analysis workstation
5. Import data into BloodHound CE or Legacy

Phase 2: Attack Path Analysis

1. Mark owned principals (compromised accounts)
2. Query shortest path to Domain Admins
3. Identify Kerberoastable accounts with admin privileges
4. Find AS-REP Roastable accounts
5. Analyze ACL-based attack paths (GenericAll, GenericWrite, WriteDACL, ForceChangePassword)
6. Review GPO abuse opportunities

Phase 3: Exploitation Planning

1. Prioritize attack paths by complexity and stealth
2. Identify required tools for each step in the chain
3. Plan OPSEC considerations for each technique
4. Execute identified attack chain
5. Document evidence at each step

Tools and Resources

Tool	Purpose	Platform
BloodHound CE	Graph visualization and analysis	Web-based
SharpHound	AD data collection (.NET)	Windows
BloodHound.py	AD data collection (Python)	Linux/Windows
Cypher queries	Custom graph queries	Neo4j/BloodHound
PlumHound	Automated BloodHound reporting	Python
Max (BloodHound)	BloodHound automation	Python

Key BloodHound Queries

Query	Purpose
Shortest Path to Domain Admins	Find fastest route to DA
Find Kerberoastable Users with Path to DA	SPN accounts leading to DA
Find AS-REP Roastable Users	Accounts without pre-auth
Shortest Path from Owned Principals	Paths from compromised accounts
Find Computers with Unsupported OS	Legacy systems for exploitation
Find Users with DCSync Rights	Accounts that can replicate AD
Find GPOs that Modify Local Group Membership	GPO-based privilege escalation

Validation Criteria

• SharpHound data collected from all domains
• Attack paths identified from owned accounts to DA
• ACL-based attack paths documented
• Kerberoastable and AS-REP roastable accounts identified
• Exploitation plan created with prioritized paths
• Evidence screenshots captured for report

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

BloodHound AD Assessment Report Template

Document Control

Field	Value
Domain	[DOMAIN.LOCAL]
Engagement ID	[ID]
Assessor	[NAME]
Date	[DATE]
Classification	CONFIDENTIAL

---

1. Executive Summary

[Overview of AD security posture based on BloodHound analysis]

Critical Findings:

• attack paths to Domain Admin identified
• [Y] Kerberoastable accounts with privileged access
• [Z] systems with unconstrained delegation

---

2. Attack Path Summary

2.1 Shortest Path to Domain Admin

#	Step	From	To	Edge/Method	Tool Required
1
2

2.2 ACL-Based Paths

Source	Target	Right	Abuse Method
		GenericAll/WriteDACL/etc.

2.3 Session-Based Paths

Computer	Privileged Session	Path to Computer

---

3. Kerberoasting Targets

Account	SPN	Admin Count	Cracked	Password
		Yes/No	Yes/No	[REDACTED]

4. AS-REP Roasting Targets

Account	Hash Type	Cracked	Notes
		Yes/No

5. Delegation Issues

Unconstrained Delegation

Computer	OS	DC	Notes
		No

Constrained Delegation

Object	Allowed To Delegate To	Abuse Potential

---

6. Recommendations

Critical (Immediate)

1. [Recommendation]

High (30 days)

1. [Recommendation]

Medium (90 days)

1. [Recommendation]

---

Appendix: Cypher Queries Used

[Query 1]

[Query 2]

references/api-reference.md (verbatim)

API Reference: Active Directory Analysis with BloodHound

SharpHound — Data Collection

Syntax

SharpHound.exe -c All -d domain.local
SharpHound.exe -c DCOnly --ldapusername user --ldappassword pass

Collection Methods

Flag	Data Collected
All	Everything below
Default	Group, Session, Trusts, ACL, ObjectProps
DCOnly	LDAP-only (no sessions)
Session	Active sessions
ACL	Access control lists
ObjectProps	User/computer properties

bloodhound-python — Cross-Platform

Syntax

bloodhound-python -d domain.local -u user -p pass -c all --zip -ns 10.10.10.1

Options

Flag	Description
-d	Domain name
-u	Username
-p	Password
-c	Collection method
-ns	Nameserver (DC IP)
--zip	Output as ZIP

Neo4j Cypher Queries

Shortest Path to Domain Admins

MATCH p=shortestPath(
    (u:User {owned:true})-[*1..]->(g:Group {name:'DOMAIN ADMINS@DOMAIN.LOCAL'})
) RETURN p

Kerberoastable Users

MATCH (u:User) WHERE u.hasspn=true AND u.enabled=true
RETURN u.name, u.serviceprincipalnames

Unconstrained Delegation

MATCH (c:Computer {unconstraineddelegation:true})
RETURN c.name, c.operatingsystem

DCSync Rights

MATCH p=(u)-[:GetChanges|GetChangesAll]->(d:Domain)
RETURN u.name, d.name

AS-REP Roastable

MATCH (u:User {dontreqpreauth:true})
RETURN u.name, u.enabled

BloodHound JSON Format

Users JSON

{
  "data": [{
    "Properties": {
      "name": "USER@DOMAIN.LOCAL",
      "enabled": true,
      "admincount": true,
      "hasspn": false
    },
    "Aces": [],
    "MemberOf": []
  }]
}

Neo4j Python Driver

Connection

from neo4j import GraphDatabase
driver = GraphDatabase.driver("bolt://localhost:7687", auth=("neo4j", "bloodhound"))
with driver.session() as session:
    result = session.run("MATCH (n:User) RETURN count(n)")

BloodHound CE API

Authentication

POST https://bloodhound:8080/api/v2/login
Content-Type: application/json

{"login_method": "secret", "secret": "api-key-here"}

Search

GET https://bloodhound:8080/api/v2/search?q=admin
Authorization: Bearer {token}

references/standards.md (verbatim)

Standards and Framework References

MITRE ATT&CK - Discovery (TA0007)

Technique ID	Name	BloodHound Relevance
T1087.002	Account Discovery: Domain Account	Enumerates all domain users
T1069.001	Permission Groups Discovery: Local Groups	Local admin group membership
T1069.002	Permission Groups Discovery: Domain Groups	Domain group membership
T1482	Domain Trust Discovery	Trust relationships between domains
T1615	Group Policy Discovery	GPO enumeration and analysis
T1018	Remote System Discovery	Computer object enumeration
T1033	System Owner/User Discovery	Session data collection
T1016	System Network Configuration Discovery	Network topology mapping

MITRE ATT&CK - Privilege Escalation Paths

Technique ID	Name	BloodHound Attack Path
T1134.001	Access Token Manipulation	Token impersonation via session data
T1078.002	Valid Accounts: Domain Accounts	Credential reuse paths
T1484.001	Domain Policy Modification: Group Policy	GPO abuse for code execution
T1558.003	Kerberoasting	SPN accounts to crack
T1558.004	AS-REP Roasting	No pre-auth accounts

Active Directory ACL Abuse Paths

ACL Right	Abuse Method	Impact
GenericAll	Full control over object - reset password, modify group membership	High
GenericWrite	Modify object attributes - set SPN for Kerberoasting	High
WriteOwner	Take ownership of object, then modify DACL	High
WriteDACL	Modify permissions on object	High
ForceChangePassword	Reset user password without knowing current	High
AddMember	Add users to groups	Medium-High
ReadLAPSPassword	Read local admin passwords	High
ReadGMSAPassword	Read managed service account passwords	High
AllExtendedRights	DCSync rights, LAPS read	Critical

BloodHound Edge Types

Edge	Description	Attack Potential
MemberOf	Group membership	Inherited permissions
HasSession	Active user session on computer	Credential theft
AdminTo	Local admin rights	Lateral movement
CanRDP	RDP access rights	Remote access
CanPSRemote	PowerShell remoting rights	Remote code execution
ExecuteDCOM	DCOM execution rights	Remote execution
Contains	OU/GPO container relationship	GPO targeting
GPLink	GPO linked to OU	Policy enforcement path
Owns	Object ownership	Full control potential
AZMemberOf	Azure AD group membership	Cloud attack path
AZGlobalAdmin	Azure AD Global Admin	Cloud full control

NIST SP 800-171 - Active Directory Security

3.1 Access Control

• Limit information system access to authorized users
• Employ the principle of least privilege
• Control the flow of CUI per approved authorizations

3.5 Identification and Authentication

• Authenticate organizational users and devices
• Use multi-factor authentication
• Employ replay-resistant authentication mechanisms

CIS Benchmark for Active Directory

Account Configuration

• Ensure 'Account lockout threshold' is set to 5 or fewer attempts
• Ensure 'Minimum password length' is set to 14 or more characters
• Ensure Kerberos service accounts use AES encryption

Group Policy Configuration

• Restrict access to Group Policy modification
• Audit Group Policy changes
• Limit GPO link permissions

references/workflows.md (verbatim)

BloodHound Active Directory Exploitation Workflows

Workflow 1: Data Collection

SharpHound Collection (Windows)

# Basic collection - all methods
.\SharpHound.exe -c All

# DCOnly collection (less noise, requires domain user)
.\SharpHound.exe -c DCOnly

# Session collection with loop (continuous session data gathering)
.\SharpHound.exe -c Session --Loop --LoopDuration 02:00:00 --LoopInterval 00:05:00

# Collection from specific domain
.\SharpHound.exe -c All -d targetdomain.local

# Stealth collection (avoid noisy queries)
.\SharpHound.exe -c DCOnly,Session --Stealth

# Collection via LDAP with specific credentials
.\SharpHound.exe -c All -d targetdomain.local --LdapUsername user --LdapPassword pass

# Output to specific directory
.\SharpHound.exe -c All --OutputDirectory C:\Users\Public\

# Exclude domain controllers from session collection
.\SharpHound.exe -c All --ExcludeDomainControllers

BloodHound.py Collection (Linux/Kali)

# Basic collection with username/password
bloodhound-python -d targetdomain.local -u user -p 'Password123' -c All -ns 10.0.0.1

# Collection with NTLM hash
bloodhound-python -d targetdomain.local -u user --hashes aad3b435b51404eeaad3b435b51404ee:hash -c All -ns 10.0.0.1

# DNS resolution via domain controller
bloodhound-python -d targetdomain.local -u user -p 'Password123' -c All -dc dc01.targetdomain.local -ns 10.0.0.1

# Collection with specific methods
bloodhound-python -d targetdomain.local -u user -p 'Password123' -c Group,LocalAdmin,Session -ns 10.0.0.1

Workflow 2: BloodHound CE Setup and Data Import

Setup BloodHound Community Edition

# Docker Compose setup
curl -L https://ghst.ly/getbhce -o docker-compose.yml
docker compose pull
docker compose up -d

# Access at https://localhost:8080
# Default credentials in docker compose output
# Upload SharpHound ZIP files via UI

Legacy BloodHound Setup

# Install Neo4j
sudo apt install neo4j
sudo neo4j console

# Download and run BloodHound
wget https://github.com/BloodHoundAD/BloodHound/releases/latest
chmod +x BloodHound
./BloodHound --no-sandbox

# Import data via drag-and-drop of ZIP files

Workflow 3: Attack Path Discovery

Pre-Built Queries

-- Shortest Path to Domain Admins from Owned
MATCH p=shortestPath((n {owned:true})-[*1..]->(m:Group {name:"DOMAIN ADMINS@TARGETDOMAIN.LOCAL"}))
RETURN p

-- Find All Kerberoastable Users
MATCH (u:User {hasspn:true}) RETURN u.name, u.serviceprincipalnames

-- Kerberoastable Users with Path to DA
MATCH (u:User {hasspn:true})
MATCH p=shortestPath((u)-[*1..]->(g:Group {name:"DOMAIN ADMINS@TARGETDOMAIN.LOCAL"}))
RETURN u.name, LENGTH(p)
ORDER BY LENGTH(p) ASC

-- AS-REP Roastable Users
MATCH (u:User {dontreqpreauth:true}) RETURN u.name, u.displayname

-- Users with DCSync Rights
MATCH p=(n)-[:MemberOf|GetChanges|GetChangesAll*1..]->(d:Domain)
WHERE n.name IS NOT NULL
RETURN p

-- Computers with Unconstrained Delegation
MATCH (c:Computer {unconstraineddelegation:true})
WHERE NOT c.name CONTAINS "DC"
RETURN c.name

-- Find Users with Local Admin on Multiple Computers
MATCH (u:User)-[:AdminTo]->(c:Computer)
WITH u, COUNT(c) as adminCount
WHERE adminCount > 1
RETURN u.name, adminCount
ORDER BY adminCount DESC

-- GPOs Modifying Local Group Memberships
MATCH (g:GPO)-[:GpLink]->(ou:OU)-[:Contains*1..]->(c:Computer)
RETURN g.name, ou.name, COLLECT(c.name)

-- Find Shortest Path from Domain Users to DA
MATCH p=shortestPath((g:Group {name:"DOMAIN USERS@TARGETDOMAIN.LOCAL"})-[*1..]->(h:Group {name:"DOMAIN ADMINS@TARGETDOMAIN.LOCAL"}))
RETURN p

-- Accounts with Constrained Delegation
MATCH (c) WHERE c.allowedtodelegate IS NOT NULL
RETURN c.name, c.allowedtodelegate

ACL-Based Attack Path Queries

-- Find GenericAll Rights
MATCH p=(n)-[:GenericAll]->(m)
WHERE n <> m AND NOT n.name STARTS WITH "DVTA"
RETURN p

-- Find WriteDACL Rights to Domain Object
MATCH p=(n)-[:WriteDacl]->(d:Domain)
RETURN p

-- Find ForceChangePassword Paths
MATCH p=(n)-[:ForceChangePassword]->(m:User)
RETURN p

-- Find AddMember Rights to Admin Groups
MATCH p=(n)-[:AddMember]->(g:Group)
WHERE g.name CONTAINS "ADMIN"
RETURN p

-- Find WriteOwner Abuse Paths
MATCH p=(n)-[:WriteOwner]->(m)
WHERE m:Group OR m:User
RETURN p

-- Find LAPS Password Readers
MATCH p=(n)-[:ReadLAPSPassword]->(c:Computer)
RETURN p

Workflow 4: Exploitation Chain Examples

Chain 1: ACL Abuse to Domain Admin

Step 1: Owned user has GenericWrite on Service Account
  -> Set SPN on service account (Targeted Kerberoasting)

Step 2: Crack service account Kerberos ticket
  -> Obtain service account password

Step 3: Service account has GenericAll on admin group
  -> Add ourselves to admin group

Step 4: Admin group is member of Domain Admins
  -> Domain Admin achieved

Chain 2: Session-Based Lateral Movement

Step 1: BloodHound shows Domain Admin session on WORKSTATION01
Step 2: Owned user has local admin on WORKSTATION01
Step 3: Lateral move to WORKSTATION01 via PsExec/WMI
Step 4: Dump credentials from LSASS
Step 5: Obtain Domain Admin NTLM hash or Kerberos ticket

Chain 3: GPO Abuse Path

Step 1: Owned user has WriteDACL on GPO
Step 2: Modify GPO to add immediate scheduled task
Step 3: GPO is linked to OU containing Domain Controller
Step 4: Scheduled task executes payload on DC
Step 5: Domain compromise achieved

Chain 4: Constrained Delegation Abuse

Step 1: Compromised service account with constrained delegation to DC
Step 2: Request TGT for compromised service account
Step 3: Use S4U2Self to get ticket for high-priv user
Step 4: Use S4U2Proxy to forward ticket to target service on DC
Step 5: Access DC as Domain Admin

Workflow 5: Reporting with PlumHound

Automated Report Generation

# Install PlumHound
git clone https://github.com/PlumHound/PlumHound.git
pip install -r requirements.txt

# Generate default reports
python PlumHound.py -x tasks/default.tasks -s "bolt://localhost:7687" -u neo4j -p password

# Generate specific report
python PlumHound.py --easy -s "bolt://localhost:7687" -u neo4j -p password

# Custom task file for red team reporting
python PlumHound.py -x tasks/redteam.tasks -s "bolt://localhost:7687" -u neo4j -p password

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.