Identity
BloodHound
Graph analysis of Active Directory and hybrid identity attack paths from authorized collection.
What it is
BloodHound CE maps who can take over what in AD: ACLs, sessions, group nesting, and AD CS. Collect with SharpHound or the official collectors using a read-only bind the client approved. Graph analysis is not exploitation — keep path proofs non-persistent.
Reach for it when
Internal AD or hybrid identity assessments where the question is 'how far does this foothold go' without dumping NTDS.
Watch-outs
Collection can be noisy (session enum, DCOM). Use the stealth/approved collector flags from the RoE. Do not ingest production graphs into a personal SaaS tenant. Cleanup: delete cache and collector artifacts; no new principals.
Typical invocation
Run the approved SharpHound collector with LDAP signing, then review shortest paths to DA in BloodHound CE.
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- Impacket
Python collection of Windows/AD protocol tools for authorized authentication and post-ex proof.
- Certipy
Active Directory Certificate Services enumeration and abuse-path analysis for authorized AD CS reviews.
- NetExec
Network execution and enumeration suite for SMB, LDAP, WinRM, and related Windows services.
- Sliver
C2 framework for authorized post-exploitation on in-scope hosts when an implant is in the RoE.