Active Directory is one of the most important components of a Windows enterprise environment. It manages identities, computers, groups, permissions, authentication, and access to business resources. For security professionals, understanding how these objects are connected is just as important as identifying individual vulnerabilities.
BloodHound for Active Directory Enumeration helps security teams visualize these relationships and uncover attack paths that may otherwise be difficult to spot. Instead of presenting Active Directory as a collection of isolated users and computers, BloodHound represents the environment as a graph of relationships and permissions.
This approach is particularly useful during penetration tests, red-team engagements, and defensive Active Directory reviews. Microsoft itself recommends reducing excessive privileges, protecting privileged accounts, securing administrative hosts, and monitoring sensitive Active Directory objects because identity relationships can become an important attack surface.
This guide explains how BloodHound works, what information it collects, how SharpHound fits into the process, how to interpret attack paths, and how defenders can use the same information to reduce Active Directory risk.
What Is BloodHound?
BloodHound is a security analysis tool designed to expose hidden relationships within Active Directory and help identify potential attack paths.
MITRE ATT&CK describes BloodHound as an Active Directory reconnaissance tool capable of revealing hidden relationships and identifying attack paths.
Traditional enumeration might produce lists such as:
- Users
- Groups
- Computers
- Domain controllers
- Sessions
- Permissions
The problem is that a list does not always explain how those objects interact.
BloodHound takes a different approach.
It represents objects as nodes and relationships as edges.
For example:
User
↓
MemberOf
↓
Security Group
↓
AdminTo
↓
Computer
↓
HasSession
↓
Privileged UserA security professional can then investigate whether these relationships create a realistic path toward a highly privileged account.
Why BloodHound Is Important for Active Directory Enumeration
Active Directory environments can become complicated very quickly.
A medium-sized company may have thousands of users, hundreds of groups, and hundreds or thousands of computers. Over time, permissions accumulate.
Employees change roles.
Groups are created for temporary projects.
Service accounts remain active after applications are retired.
Old administrative permissions are sometimes forgotten.
These changes can create relationships that administrators do not immediately recognize as security risks.
BloodHound helps turn this complexity into a visual model.
Instead of asking:
“Who is a Domain Admin?”
a tester can ask:
“Which low-privileged users have a path to a Domain Admin?”
That is a much more useful security question.
How BloodHound Works
BloodHound has two major components in a typical Active Directory assessment:
- Data collection
- Graph analysis
The collector gathers information from the environment and produces data that BloodHound can ingest.
For Active Directory, SharpHound Community Edition is the official data collector for BloodHound CE. SpecterOps documents that SharpHound uses native Windows APIs and LDAP functionality to collect information from domain controllers and domain-joined Windows systems.
The collected information is then imported into BloodHound, where relationships can be analyzed.
Data Collection
SharpHound can collect information such as:
- Security group memberships
- Domain trusts
- Active Directory object permissions
- Organizational Unit structure
- Group Policy links
- User properties
- Computer properties
- Local group membership
- Active sessions
- SQL administration relationships
SpecterOps documents these as part of the default SharpHound collection behavior.
Graph Analysis
After collection, BloodHound converts the information into relationships.
Common relationship types include:
- MemberOf
- AdminTo
- HasSession
- CanRDP
- CanPSRemote
- ExecuteDCOM
- GenericAll
- GenericWrite
- WriteDacl
- WriteOwner
- ForceChangePassword
- AddMember
The exact relationships available depend on the data collected and the BloodHound version.
The important point is that the graph shows relationships that may create privilege or access paths.
Understanding Active Directory Nodes
Before using BloodHound effectively, it helps to understand the main object types.
Users
User objects represent identities in the domain.
Security professionals may review:
- Privileged users
- Disabled accounts
- Service accounts
- Administrative accounts
- Users with unusual permissions
- Users with access to sensitive systems
A normal user is not necessarily low risk.
A normal account may have indirect privileges through group membership or delegated permissions.
Groups
Groups are especially important because permissions are frequently assigned through them.
For example:
User → Helpdesk → Server Administrators → Local AdministratorThe user does not directly belong to the server administrators group, but nested membership can still create effective privilege.
Computers
Computer objects represent domain-joined systems.
BloodHound can help identify relationships between computers and users, including administrative access and sessions.
A compromised workstation can become important if a privileged user has an active session on it.
Domains
Domains provide the broader identity boundary.
In multi-domain environments, testers should pay attention to relationships crossing domain boundaries.
Domain Controllers
Domain controllers are among the highest-value assets in an Active Directory environment.
Microsoft warns that privileged access to a domain controller can potentially allow an attacker to modify or destroy the Active Directory database and threaten domain-managed systems.
What Is SharpHound?
SharpHound is the data collector used with BloodHound for Active Directory environments.
The official SpecterOps documentation identifies SharpHound Community Edition as the official BloodHound CE collector.
It is designed to collect information required to build the Active Directory relationship graph.
The official project is maintained by SpecterOps and its source code is publicly available.
The appropriate SharpHound version should match the deployed BloodHound environment. SpecterOps recommends obtaining the compatible collector through the BloodHound interface or the corresponding official release.
Security teams should always obtain security tooling from trusted sources and use it only against environments where they have authorization.
Basic BloodHound Enumeration Workflow
A typical authorized assessment can follow this process.
Step 1: Define the Scope
Before collecting data, identify:
- Authorized domains
- Testing accounts
- Approved systems
- Collection windows
- Production restrictions
- Data handling requirements
This is particularly important because Active Directory enumeration can generate security alerts and endpoint telemetry.
Step 2: Identify the Collection Host
The collection host should be appropriate for the engagement.
For a controlled internal assessment, the tester may use an authorized domain-joined Windows system.
SharpHound is designed to run in the context of a domain user.
Step 3: Perform Collection
For a basic assessment, SharpHound can perform its default collection:
SharpHound.exeThe official documentation states that the default collection gathers several important categories, including group memberships, trusts, object permissions, GPO links, OU structure, computer and user properties, local groups, and sessions.
For a narrowly scoped assessment, collection methods can be selected instead of collecting everything.
For example:
SharpHound.exe --CollectionMethods SessionThe exact options should always be checked against the version deployed in the assessment environment.
SpecterOps maintains current documentation for SharpHound collection flags and methods.
Step 4: Import the Data
SharpHound generates JSON data and packages the collected information into an archive.
The archive can then be uploaded into BloodHound for analysis. SpecterOps documents both UI and API-based ingestion methods for BloodHound CE.
Step 5: Analyze the Graph
Once the data is available, begin with high-value objects.
Look for:
- Domain Admins
- Enterprise Admins
- Domain controllers
- Administrators
- Privileged service accounts
- Sensitive servers
- Administrative workstations
Then investigate which users or computers can reach those objects.
BloodHound Attack Path Analysis
Attack-path analysis is one of BloodHound’s biggest advantages.
Suppose an organization has the following relationship:
Standard User
↓
MemberOf
↓
Helpdesk Group
↓
Admin Access
↓
Management Server
↓
Privileged Session
↓
Domain AdministratorThe standard user may appear harmless during a basic account review.
BloodHound reveals the relationship chain.
This allows a penetration tester to explain the security issue in business terms:
A compromised standard account can potentially reach a privileged identity through a series of existing permissions.
That is much more actionable than simply reporting that “nested group membership exists.”
Important BloodHound Relationships
Several relationships deserve special attention during an assessment.
GenericAll
GenericAll represents broad control over an object.
Its security impact depends on the object involved and the effective permissions associated with the relationship.
GenericWrite
GenericWrite can provide significant modification rights over an object.
Review the affected object and determine whether the permission can contribute to privilege escalation.
WriteDacl
WriteDacl can allow modification of an object’s access control list.
This can become dangerous when applied to sensitive objects.
WriteOwner
Ownership changes can have significant security implications because object ownership affects control over permissions.
ForceChangePassword
This relationship indicates that a principal may have the ability to reset another user’s password without knowing the current password, depending on the effective permissions and environment.
AdminTo
AdminTo helps identify administrative control over computers.
This becomes particularly important when an administrative relationship connects a low-privileged identity to a sensitive machine.
Session Analysis
User sessions can be extremely valuable during a penetration test.
Consider a workstation where a standard employee normally logs in.
If a privileged administrator also has an active session on that workstation, the workstation becomes more important from an attack-path perspective.
This is why session data can change over time.
SpecterOps specifically notes that group memberships and many AD permissions may change relatively infrequently, while user sessions can change daily. SharpHound therefore provides a session-loop collection method for repeatedly collecting session information.
For defenders, this leads to an important lesson:
Where administrators log in matters almost as much as what permissions they have.
Microsoft recommends secure administrative hosts and warns against using privileged accounts on less-trusted systems.
BloodHound and Kerberos
BloodHound can also help identify relationships relevant to Kerberos security.
Examples include:
- Service accounts
- SPNs
- Delegation relationships
- Privileged accounts
- Computer relationships
This does not mean BloodHound automatically exploits Kerberos weaknesses.
Instead, it helps establish the relationships that a tester may need to investigate further.
For example, if a privileged account is associated with a particular service or delegation configuration, the relationship becomes a candidate for deeper security validation.
BloodHound and Group Policy
Group Policy is another important area of Active Directory analysis.
Misconfigured GPO permissions can create unexpected privilege paths.
During an assessment, review:
- Who can modify GPOs
- Which computers receive a GPO
- Security filtering
- GPO inheritance
- Administrative permissions
- Scripts
- Scheduled tasks
- Configuration changes
SharpHound’s default collection includes Group Policy links and relevant AD relationships, helping testers understand how GPOs connect to computers and organizational units.
BloodHound for Defensive Security
BloodHound is not only a penetration-testing tool.
Defenders can use the same graph-based approach to identify excessive privileges before an attacker discovers them.
A defensive review might ask:
- Which users can reach Domain Admins?
- Which systems are administered by too many users?
- Where are privileged accounts logging in?
- Which groups contain excessive membership?
- Which permissions create unexpected paths?
- Which accounts have access to critical servers?
- Which trusts expand the attack surface?
Microsoft recommends least-privilege administration, reducing permanent privileged membership, securing administrative hosts, and monitoring sensitive Active Directory objects.
Common Active Directory Problems BloodHound Can Expose
BloodHound can help identify relationships associated with:
Excessive Privilege
Users may have more permissions than their role requires.
Nested Group Problems
A user can receive unexpected privileges through multiple layers of group membership.
Administrative Session Exposure
Privileged users may log into systems that should not be trusted with privileged credentials.
Excessive Local Administrator Access
Large numbers of users may have administrative control over workstations or servers.
Dangerous Object Permissions
Users or groups may have modification rights over sensitive AD objects.
Trust Relationships
Cross-domain relationships can create additional paths that security teams need to understand.
Forgotten Accounts
Old accounts and service identities may still have meaningful access.
Real-World Example
Consider a company with 3,000 employees.
A helpdesk employee has a normal domain account and does not belong directly to Domain Admins.
A traditional permissions review shows nothing alarming.
A BloodHound analysis reveals:
Helpdesk User
↓
Helpdesk Group
↓
Local Admin on Server A
↓
Server A Admin Group
↓
Access to Server B
↓
Privileged User Session
↓
Domain AdminThe problem is not necessarily one catastrophic configuration.
It is the combination of several legitimate permissions.
This is exactly where graph-based analysis becomes useful.
The security team can break the chain by removing unnecessary local administrator rights, restricting administrative sessions, reducing group membership, and protecting privileged accounts.
Best Practices When Using BloodHound
Use an Authorized Environment
BloodHound can expose sensitive identity information. Never collect Active Directory data from an environment without explicit authorization.
Protect Collected Data
BloodHound datasets can contain usernames, computer names, group relationships, permissions, and other sensitive information.
Store them securely and limit access.
Minimize Collection
Do not collect information that the assessment does not require.
Targeted collection can reduce unnecessary activity and make analysis easier.
Match the Collector Version
Use a SharpHound release compatible with the BloodHound environment. SpecterOps provides current compatibility and collector guidance through its documentation and releases.
Validate Findings Manually
A graph relationship is a lead, not automatically proof of exploitability.
Verify the underlying permissions and configuration before reporting a critical finding.
Focus on Business Impact
Do not report hundreds of relationships without context.
Prioritize paths that could realistically affect:
- Domain controllers
- Critical servers
- Sensitive applications
- Privileged identities
- Business-critical data
How Defenders Can Reduce BloodHound-Identified Attack Paths
Finding an attack path is only the beginning.
Organizations should remediate the underlying relationship.
Common actions include:
- Remove unnecessary group membership
- Apply least privilege
- Restrict local administrator access
- Protect privileged accounts
- Use dedicated administrative hosts
- Reduce permanent privileged access
- Review GPO permissions
- Remove unnecessary trusts
- Disable unused accounts
- Protect service accounts
- Monitor sensitive AD changes
- Restrict privileged sessions
- Segment critical systems
Microsoft’s Active Directory guidance specifically recommends eliminating permanent membership in highly privileged groups where practical and using temporary privilege controls.
BloodHound in a Penetration Testing Methodology
BloodHound fits naturally into the reconnaissance and privilege-analysis phases of an internal penetration test.
A typical workflow looks like:
Scope
↓
Initial Access
↓
Domain Enumeration
↓
BloodHound Collection
↓
Relationship Analysis
↓
Attack Path Identification
↓
Controlled Validation
↓
Risk Assessment
↓
Remediation
↓
RetestingThe tool should support the methodology rather than replace it.
A skilled penetration tester combines BloodHound results with Windows security knowledge, network enumeration, credential security analysis, manual permission review, and business context.
For those developing practical skills, “https://academy.pentesthint.com/” practical cyber security learning combined with “https://vuln.pentesthint.com/” hands-on labs can help build the Windows and Active Directory fundamentals required for effective assessment work.
BloodHound and the Future of Identity Security
Enterprise identity environments are becoming increasingly hybrid.
Many organizations operate traditional Active Directory alongside Microsoft Entra ID and other cloud services.
This creates additional relationships between on-premises identities and cloud resources.
Microsoft warns that synchronizing on-premises Active Directory groups into cloud environments can introduce lateral-movement risk if a compromised on-premises identity or group can influence cloud-connected resources.
For security professionals, this means identity enumeration will increasingly need to consider both traditional AD and cloud identity relationships.
The core principle remains the same:
Understand who can access what, how they can access it, and what happens if that identity is compromised.
BloodHound for Active Directory Enumeration Checklist
Use this checklist during an authorized assessment:
- Define the assessment scope
- Identify domains and forests
- Identify domain controllers
- Enumerate users
- Enumerate security groups
- Review nested groups
- Identify privileged accounts
- Review computer objects
- Collect domain trusts
- Review AD object permissions
- Review GPO relationships
- Identify local administrator relationships
- Review user sessions
- Identify privileged sessions
- Review service accounts
- Review delegation relationships
- Investigate attack paths
- Validate high-risk relationships
- Prioritize business-critical paths
- Recommend remediation
- Retest after remediation
Career Opportunities
Knowledge of BloodHound and Active Directory is highly useful for several cybersecurity roles.
Penetration Tester
Internal penetration testers frequently need to understand Windows domains, identity relationships, privilege escalation, and lateral movement.
Red Team Operator
Red teams use identity and attack-path analysis to understand how an adversary might move through an enterprise environment.
Security Engineer
Security engineers can use relationship analysis to reduce excessive privileges and strengthen identity architecture.
SOC Analyst
SOC professionals benefit from understanding why certain authentication and administrative events are significant.
Identity Security Specialist
Identity-focused roles increasingly require knowledge of both on-premises Active Directory and cloud identity platforms.
For professionals building these skills, a combination of “https://academy.pentesthint.com/” cyber security training and controlled “https://vuln.pentesthint.com/” cyber security labs provides a practical foundation.
External Resources
The best way to keep BloodHound knowledge current is to follow the project’s official documentation.
- BloodHound Community Edition Documentation
- SharpHound Documentation
- SharpHound Official GitHub Repository
- MITRE ATT&CK: BloodHound
- Microsoft: Active Directory Security Best Practices
- Microsoft: Reducing the Active Directory Attack Surface
FAQs
What is BloodHound for Active Directory Enumeration?
BloodHound is a graph-based security analysis tool that helps security professionals visualize Active Directory relationships and identify potential attack paths involving users, groups, computers, permissions, sessions, and other objects.
Is BloodHound a vulnerability scanner?
No. BloodHound is primarily a relationship and attack-path analysis tool. It does not replace vulnerability scanners or traditional network enumeration tools.
What is SharpHound?
SharpHound is the official data collector for BloodHound Community Edition. It collects Active Directory and domain-joined computer information and prepares it for ingestion into BloodHound.
Can defenders use BloodHound?
Yes. Defenders can use BloodHound to identify excessive privileges, dangerous relationships, privileged sessions, and potential paths to sensitive accounts or systems.
What information does SharpHound collect?
Depending on the selected collection methods, SharpHound can collect security group memberships, trusts, AD object permissions, GPO relationships, OU structure, user and computer properties, local groups, and sessions.
Does BloodHound automatically exploit attack paths?
No. BloodHound identifies relationships and potential paths. Security professionals must analyze and validate those relationships within the authorized scope of an assessment.
Why are attack paths important in Active Directory?
An individual permission may appear harmless, but several permissions can combine into a path toward a highly privileged account. Attack-path analysis helps organizations understand the combined risk.
Is BloodHound useful for beginners?
Yes, but beginners should first understand Windows networking, Active Directory, LDAP, Kerberos, groups, permissions, and basic privilege concepts. Once those fundamentals are understood, BloodHound becomes much easier to interpret.
Conclusion
BloodHound has changed the way security professionals approach Active Directory enumeration.
Instead of looking at users, groups, computers, and permissions as isolated pieces of information, it allows testers and defenders to understand the relationships connecting them.
That distinction matters.
A normal user may have an unexpected path to a sensitive server. A helpdesk group may indirectly provide administrative access. A privileged administrator may have an active session on an insecure workstation. A forgotten permission may connect several otherwise unrelated systems.
These relationships can remain hidden during a basic Active Directory review.
BloodHound helps bring them into view.
However, effective Active Directory security is not about finding the largest number of graph relationships. It is about identifying the relationships that create meaningful security risk and then removing or controlling them.
Organizations should combine BloodHound analysis with least privilege, secure administrative hosts, strong privileged-account controls, monitoring, segmentation, and regular security assessments. Microsoft continues to emphasize these controls as important parts of reducing the Active Directory attack surface.
For penetration testers and security teams looking to strengthen their practical skills, PentestHint provides security resources, “https://vuln.pentesthint.com/” real-world vulnerable machines, and “https://pentesthint.com/” security consulting resources.
The goal is simple: understand the identity relationships before an attacker does, reduce unnecessary privilege, and make the shortest path to critical systems as difficult as possible.
