BloodHound AD Attack Path Analysis: A Defender's Guide to Finding and Fixing Privilege Escalation Routes Before Attackers Do

SharpHound is the ingestor that collects AD relationship data. Running it without coordination will generate LDAP query noise and may trigger anomaly-based alerts. Coordinate with the SOC before collection, or use a service account in an exclusion list. Run collection from a domain-joined machine with a read-only standard user account. SharpHound does not require elevated privileges for most collection methods.

Command for a standard collection:

SharpHound.exe -c All --zipfilename bloodhound_$(hostname)_$(date +%Y%m%d).zip

This collects groups, local admins, sessions, ACLs, trusts, and object properties. The All method runs each collector in sequence. For large environments (100k+ objects), add --SkipPasswordCheck and collect in batches using --SearchBase to scope to a specific OU.

For stealth-conscious environments, use --CollectionMethods DCOnly first. This hits only the Domain Controller via LDAP, skips session enumeration (which touches every workstation), and is far less noisy. You lose session data but retain the full ACL and group membership graph, which is where most high-value paths live.

BloodHound CE expresses relationships as edges. After ingestion, the graph contains hundreds of edge types, but six account for the overwhelming majority of exploitable paths to Domain Admin in real environments:

GenericAll / GenericWrite / WriteProperty: These ACEs allow an attacker controlling account A to modify account B's attributes. GenericAll is equivalent to full control. GenericWrite allows writing specific properties. In practice, GenericWrite on a user allows shadow credential attacks (writing msDS-KeyCredentialLink), setting a target SPN for targeted Kerberoasting, or forcing a password reset if WritePasword is also set.

AddMember / WriteSelf on groups: If account A can add members to a privileged group, account A effectively has that group's rights. This is often misconfigured on distribution groups that were promoted to security groups over time.

AllowedToDelegate / AllowedToAct (constrained/resource-based delegation): Delegation allows a service to impersonate any user against a target service. Unconstrained delegation exposes TGTs. Constrained delegation with protocol transition allows S4U2Self abuse. Resource-based constrained delegation (RBCD) is the most dangerous because it is writable by anyone with WriteProperty on msDS-AllowedToActOnBehalfOfOtherIdentity.

CanPSRemote / AdminTo: Direct administrative access to a machine. If that machine hosts a privileged process, or if a Tier 0 admin has an active session, local admin is a stepping stone.

HasSIDHistory: Objects migrated from a legacy domain may retain SID history pointing to Tier 0 groups in the old domain. If trusts are still in place, this is a direct privilege escalation.

ADCS edges (Enroll, GenericWrite on certificate templates): With ADCS deployed, ESC1 through ESC8 attack paths appear as edges. Any user who can enroll in a misconfigured template that allows SAN override can issue themselves a certificate for any identity, including Domain Admin.

BloodHound CE exposes a Cypher query console. These queries surface the highest-priority exposures:

Find all shortest paths from Domain Users to Tier 0:

MATCH p=shortestPath((g:Group {name:"DOMAIN USERS@YOURDOMAIN.LOCAL"})-[*1..]->(t:Group {name:"DOMAIN ADMINS@YOURDOMAIN.LOCAL"}))
RETURN p

Find all principals with GenericAll on Tier 0 objects:

MATCH (n)-[:GenericAll]->(m:Group)
WHERE m.name STARTS WITH "DOMAIN ADMINS"
RETURN n.name, m.name
ORDER BY n.name

Find computers with unconstrained delegation (non-DCs):

MATCH (c:Computer {unconstraineddelegation:true})
WHERE NOT c.name STARTS WITH "DC"
RETURN c.name, c.operatingsystem

Find RBCD write paths (WriteProperty on msDS-AllowedToActOnBehalfOfOtherIdentity):

MATCH p=(a)-[:WriteDacl|WriteOwner|GenericAll|GenericWrite|Owns]->(b:Computer)
RETURN a.name, b.name, type(relationships(p)[0])
LIMIT 50

Find users with a path to Domain Admin in fewer than 4 hops:

MATCH p=shortestPath((u:User)-[*1..4]->(g:Group {name:"DOMAIN ADMINS@YOURDOMAIN.LOCAL"}))
RETURN u.name, length(p) AS hops
ORDER BY hops ASC
LIMIT 25

Run each query and export the results to a CSV. Group by edge type to identify which remediation action breaks the most paths.

Not every attack path requires the same urgency. Prioritize remediation using two criteria: how close the starting node is to the edge of the organization (internet-facing, phishable users, compromised vendor accounts) and how many paths pass through a given intermediate node.

Use the BloodHound node degree query to find chokepoint nodes:

MATCH (n)-[r]->(m)
WHERE NOT n:Base AND NOT m:Base
RETURN n.name, labels(n), count(r) AS outbound_edges
ORDER BY outbound_edges DESC
LIMIT 20

Nodes with high outbound edge counts are chokepoints. Removing or tightening a single ACE on a chokepoint node can sever dozens of attack paths simultaneously.

For ACE-based paths (GenericWrite, AddMember), the fix is to remove the ACE. Open ADSI Edit, navigate to the object, open Properties, go to Security, and remove the specific ACE. Document the change in your change management system with the ticket that authorized the original grant.

For delegation-based paths, disable delegation on accounts that do not need it. In AD PowerShell:

Set-ADUser -Identity svc_webservice -TrustedForDelegation $false
Set-ADAccountControl -Identity svc_webservice -AccountNotDelegated $true

For service accounts with SPNs that have RBCD misconfiguration, verify the msDS-AllowedToActOnBehalfOfOtherIdentity attribute is null if not intentionally configured:

Get-ADComputer -Identity WEBSERVER01 -Properties msDS-AllowedToActOnBehalfOfOtherIdentity |
Select-Object Name, msDS-AllowedToActOnBehalfOfOtherIdentity

After making changes, re-run SharpHound and re-ingest the data. BloodHound CE keeps ingestion sessions separate, so you can compare old and new graphs. Run the same Cypher queries from before remediation and confirm the paths are gone.

For ACE changes, allow up to 15 minutes for AD replication before re-running SharpHound. If you made changes to multiple domain controllers directly, replication latency can cause inconsistent results. Force replication if needed:

repadmin /syncall /AdeP

Document each remediation in a structured format:

• Date of finding
• Edge type and source/target nodes
• ACE or delegation attribute changed
• Account that held the permission and how it was granted (delegation, inherited, explicit)
• Ticket number for the change
• Date of verification re-run
• Result: path present or path absent

Schedule quarterly BloodHound runs as a recurring control. Attack paths re-emerge from provisioning mistakes, group policy changes, and shadow IT. Treat BloodHound output like a vulnerability scan: the finding is not closed until re-verification shows the path is gone.