How to Use BloodHound for Defensive Active Directory Path Analysis

BloodHound Community Edition (self-hosted):

# Install via Docker Compose (simplest setup)
git clone https://github.com/SpecterOps/BloodHound.git
cd BloodHound/examples/docker-compose
docker compose up -d

# Access the web UI
open http://localhost:8080
# Default credentials are set during first login

Collect AD data with SharpHound:

SharpHound is the data collector: it enumerates AD objects, sessions, ACLs, and trust relationships using standard LDAP and SMB queries that generate Windows Event IDs 4624 (network logons) on every machine it queries. Defenders should document that SharpHound collection runs are authorized to avoid SIEM alerts during the scan.

# Download SharpHound from BloodHound GitHub releases
# Run as a domain user (does not require Domain Admin)
.\SharpHound.exe --CollectionMethods All --ZipFilename bloodhound-$(Get-Date -Format yyyyMMdd).zip

# Collection methods:
# All = Default + ACL + Container + GPOLocalGroup + LoggedOn
# Default = Sessions, LocalGroups, ObjectProps, Trusts
# LoggedOn = Find current user sessions on machines (more aggressive, requires local admin on targets)
# ACL = Collect full ACL data (slower, but reveals control paths)

# For stealth (minimal network noise, shorter collection window):
.\SharpHound.exe --CollectionMethods ObjectProps,Default --Stealth

Import the collected zip into BloodHound:

• In the BloodHound UI: Administration > File Ingest > Upload file
• Select the SharpHound zip file
• Wait for processing (~5-20 minutes depending on AD size)

Run SharpHound regularly: AD relationships change as groups are modified, systems are added, and users authenticate to different hosts. Run monthly to track whether remediated paths have re-appeared.

BloodHound's power is in its pre-built and custom Cypher queries. These are the highest-value queries for defenders:

1. Shortest path from any owned principal to Domain Admin:

-- In BloodHound GUI: Pathfinding > From: any user > To: Domain Admins
-- Or via Cypher:
MATCH p=shortestPath(
  (u:User {enabled: true})-[*1..]->(g:Group {name: "DOMAIN ADMINS@CORP.LOCAL"})
)
WHERE NOT u.name STARTS WITH 'krbtgt'
RETURN p LIMIT 10

2. Find all Kerberoastable users with paths to high-value targets:

MATCH (u:User {enabled: true, hasspn: true})
MATCH p=shortestPath(
  (u)-[*1..]->(g:Group {name: "DOMAIN ADMINS@CORP.LOCAL"})
)
RETURN u.name, length(p) as PathLength
ORDER BY PathLength

This finds service accounts that are Kerberoastable AND have a path to Domain Admin: the highest-priority accounts to migrate to gMSAs or reset with 25+ character passwords.

3. Find accounts with AdminTo on many computers:

MATCH (u:User)-[r:AdminTo]->(c:Computer)
WHERE u.enabled = true
WITH u, count(c) as adminCount, collect(c.name)[..5] as sampleHosts
WHERE adminCount > 10
RETURN u.name, adminCount, sampleHosts
ORDER BY adminCount DESC

Service accounts or user accounts with local admin on many hosts are extremely high-value attack pivots. Any Kerberoastable account in this list should be treated as a critical finding.

4. Find computers with Domain Admin sessions (HasSession):

MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*..]->(g:Group {name: "DOMAIN ADMINS@CORP.LOCAL"})
RETURN c.name, u.name
ORDER BY c.name

HasSession means BloodHound observed a domain admin account logged into that workstation or server during collection. An attacker who compromises that machine can steal the admin session. This is how most real-world AD compromises occur: compromise a workstation, find a domain admin session, steal the credentials.

5. Find principals that can reset Domain Admin passwords (GenericAll, GenericWrite, ForceChangePassword):

MATCH (n)-[r:GenericAll|GenericWrite|ForceChangePassword]->(u:User)
WHERE u.admincount = true
RETURN n.name, type(r), u.name

6. Find ACL attack paths (WriteDacl, Owns, GenericAll on sensitive groups):

MATCH p=(n)-[r:WriteDacl|Owns|GenericAll|WriteOwner|GenericWrite]->(g:Group)
WHERE g.name IN [
  "DOMAIN ADMINS@CORP.LOCAL",
  "ENTERPRISE ADMINS@CORP.LOCAL",
  "SCHEMA ADMINS@CORP.LOCAL",
  "GROUP POLICY CREATOR OWNERS@CORP.LOCAL"
]
RETURN p LIMIT 20

BloodHound will surface many findings. Prioritization should focus on the paths with the shortest length and highest exploitability:

Priority 1: Paths length 1-2 (immediate exploit):

• User directly MemberOf Domain Admins who should not be (remove from group)
• Domain Admin HasSession on a workstation (enforce admin tiering: domain admins should only log into Tier 0 assets like DCs and PAWs, never workstations)

Priority 2: Kerberoastable accounts with short paths to Domain Admin:

# For each identified high-risk Kerberoastable account:
# Option 1: Migrate to gMSA
New-ADServiceAccount -Name "gMSA-$ServiceName" \
  -DNSHostName "$ServiceName.corp.local" \
  -PrincipalsAllowedToRetrieveManagedPassword "ServiceHosts-SG"

# Option 2: Reset to a 25+ character random password
$pw = -join ((33..126) | Get-Random -Count 30 | ForEach-Object {[char]$_})
Set-ADAccountPassword -Identity svc-webapp \
  -NewPassword (ConvertTo-SecureString $pw -AsPlainText -Force) -Reset

Priority 3: AdminTo relationships that should not exist:

# For each account with excessive AdminTo relationships:
# Audit via Group Policy which groups are in the local Administrators group
# Use Restricted Groups GPO to enforce a clean local admin list:
# Computer Configuration > Windows Settings > Security Settings >
# Restricted Groups > Administrators > Members: Only Domain\Domain Admins + Domain\Local-Server-Admins

Priority 4: ACL paths (WriteDacl, GenericAll on privileged groups):

# Review and remove excess permissions on sensitive AD objects
# Remove GenericAll from any user/service account not needing it:
$acl = Get-Acl "AD:\CN=Domain Admins,CN=Users,DC=corp,DC=local"
$acl.Access | Where-Object {
    $_.IdentityReference -notmatch "Domain Admins|Enterprise Admins|SYSTEM"
} | ForEach-Object { Write-Host $_.IdentityReference, $_.ActiveDirectoryRights }

Track remediation: Export BloodHound query results to CSV, create Jira/Linear tickets for each finding category, and re-run BloodHound monthly to verify paths are eliminated.