BloodHound Path Discovery
ad · easy · +30 XP
// what is BloodHound Path Discovery?
BloodHound is an Active Directory reconnaissance tool that maps attack paths by ingesting relationships between users, groups, computers, and permissions using SharpHound collectors. It identifies privilege escalation chains (e.g., GenericAll → user → AdminTo → Domain Controller) that defenders miss because AD trusts and nested group memberships create invisible paths. Finding the shortest path from a compromised low-privilege user to Domain Admin is the core offensive skill.
// how attackers detect it
- [01]Monitor for SharpHound.exe process execution and LDAP queries with filters like
(objectClass=*)hitting multiple attributes (samAccountName, objectSid, memberOf) — baseline normal LDAP traffic vs. bulk enumeration patterns using Sysmon Event ID 1 and Windows Event ID 4662 (directory service access). - [02]Detect SMB session enumeration (NetSessionEnum, NetWkstaUserEnum) via Zeek conn.log or Wireshark filters
smb2.cmd == 0x03— SharpHound queries every computer object for logged-on users, generating thousands of SMB tree connects to ADMIN$ and IPC$ shares in minutes. - [03]Alert on GPO enumeration and ACL reads by monitoring Event ID 5136 (directory object modifications) and 4662 with access mask 0x100 (ReadProperty) targeting
nTSecurityDescriptorattributes — legitimate admins rarely read ACLs on hundreds of objects simultaneously. - [04]Hunt for .zip/.json BloodHound data files in user directories or outbound network transfers using OSQuery
SELECT * FROM file WHERE path LIKE '%bloodhound%' OR path LIKE '%_users.json'— collectors output timestamped archives like20240115_BloodHound.zip.
// how defenders prevent it
- ✓Deploy Microsoft Defender for Identity or ATA to detect reconnaissance patterns and enable LDAP signing + channel binding on domain controllers via GPO
Domain Controller: LDAP server signing requirements = Require signingto prevent unsigned LDAP queries. - ✓Disable Remote SAM enumeration (CVE-2021-36934 mitigation) via registry key
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictRemoteSAM = 1and block NetSessionEnum withComputer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Network access: Restrict clients allowed to make remote calls to SAM. - ✓Reduce attack surface by removing users from local administrator groups (break GenericAll/AdminTo edges), enforcing LAPS for unique local admin passwords, and implementing tiered administration so Tier 2 accounts never log into Tier 0 assets.
- ✓Enable Protected Users security group for privileged accounts (prevents NTLM/DES/RC4, enforces Kerberos AES) and use Authentication Policy Silos to restrict where Domain Admins can authenticate, severing lateral movement paths BloodHound discovers.
// real-world incidents
CVE-2021-42287
Active Directory — sAMAccountName Spoofing
Allows unprivileged users to impersonate Domain Controllers by creating machine accounts and manipulating sAMAccountName, enabling DCSync attacks that BloodHound highlights as critical paths
CVE-2020-1472
Netlogon — Zerologon
Permits attackers to set domain controller computer account passwords to null via Netlogon, achieving instant Domain Admin escalation along BloodHound-identified AdminTo edges
CVE-2021-36934
Windows — HiveNightmare/SeriousSAM
Exposes SYSTEM/SAM/SECURITY registry hives to low-privilege users, leaking cached credentials and computer account hashes that authenticate to paths BloodHound maps
// hands-on tips for this lab
- ›Run SharpHound.exe --CollectionMethod All --OutputDirectory C:\Temp on the compromised Windows host, then exfiltrate the .zip and import into BloodHound GUI — use Pathfinding queries like 'Shortest Paths to Domain Admins from Owned Principals' after marking your compromised user as owned (right-click → Mark User as Owned).
- ›If SharpHound is blocked by AV, use Invoke-BloodHound from SharpHound.ps1 with
Invoke-BloodHound -CollectionMethod All -NoSaveCache -RandomFilenamesor azurehound for Entra ID environments, then analyze Outbound Object Control relationships (GenericAll, WriteDacl, AddMember) to find privilege escalation primitives. - ›Leverage pre-built queries in BloodHound like 'Find Principals with DCSync Rights' and 'Shortest Paths to Unconstrained Delegation Systems' — cross-reference findings with PowerView commands like
Get-DomainUser -SPNto validate Kerberoastable accounts on the discovered paths.
was this lesson helpful?
// start of ad
next
SMB Null-Session Enumeration
1 of 12 · ad