HackBlue

Tools · Active Directory defense · 18 / 23

BloodHound for defenders: finding and removing attack paths in Active Directory

Think of Active Directory as a graph of who can control what, collect data in an authorized way, read the shortest paths to Tier 0, and cut the edges that matter.

12 min read · practice only with authorization

Graph thinking

Attackers rarely go straight to Domain Admins. They chain small permissions: a user is a local admin on a workstation, a domain admin logged on to that workstation, so the domain admin’s session is reachable. Or a group has GenericWrite on another group that is nested into a privileged one. BloodHound models users, groups, computers, sessions, ACLs, and GPOs as nodes and edges, then finds shortest paths between them.

Defenders use the same graph to answer one question: how many accounts have any path to Tier 0, and which few edges remove most of those paths.

Collecting data responsibly

BloodHound Community Edition uses collectors such as SharpHound to gather data through ordinary LDAP and Windows API queries. Run collection only in your lab or with explicit written approval from the directory owner and the security team, because its activity resembles an attacker’s reconnaissance and may trigger alerts.

Session and local admin collection touches many computers. In production, an approved, scheduled collection from a designated host keeps it auditable.

Lab: read the paths

In the lab, after planting a few mistakes from earlier tutorials, run an approved collection and load it into BloodHound. Use the built-in queries for shortest paths to Domain Admins and for Kerberoastable users with paths to high-value targets. Pick one path and list every edge type in it.

For each edge, decide the fix: remove a delegation, remove a local admin grant, stop admins logging on to workstations, or tighten an ACL. Re-collect after the fix and confirm the path is gone.

Snippet
# Example Cypher in BloodHound: users with any path to Domain Admins
MATCH p=shortestPath((u:User)-[*1..]->(g:Group))
WHERE g.name STARTS WITH 'DOMAIN ADMINS@'
RETURN p LIMIT 25

Measure progress

Track the number of principals with a path to Tier 0 over time. A falling number is a meaningful security metric that leadership can understand. Prioritize edges that appear in many paths, often a single overly broad group or a common workstation where admins log on.

Commercial attack path management tools and open-source alternatives like PingCastle’s control paths offer similar views. The thinking matters more than the tool.

Diagram

One attack path, cut at the cheapest edge

  1. User

    Helpdesk user is a member of Workstation Admins.

  2. AdminTo

    Workstation Admins are local admins on WS17.

  3. HasSession

    A domain admin logged on to WS17 last week.

  4. Fix

    Stop domain admins logging on to workstations; the path disappears.

Check yourself

1. What does BloodHound model?

2. Why get approval before running SharpHound in production?

3. Which metric best shows AD attack path progress?