HackBlue

Tools · Identity defense · 10 / 25

BloodHound: a path count belongs to the zip you name

A path count is true for the collection zip that was loaded. Write the zip filename and when you ran the query. The picture does not print the zip, so a bare number cannot be compared with another day.

11 min read · practice only with authorization

The number is about one load

A path count is the result of a query against the data currently loaded. That data came from a collection zip, or from more than one if several were imported. The graph view draws nodes and arrows. It does not print the zip filename on the picture. If the note has only the number, nobody can tell which load it measured.

Two counts are comparable when each names its zip and the time the query ran. A smaller number on Thursday is not a fix unless Thursday’s zip is the one you meant, and the query text is the same.

Say which load if more than one is present

If the database holds an older zip and a newer one, a query can mix them or follow whichever ingest you last selected. Do not guess. Write the zip you believe the query used, and if you are not sure, write “zip not confirmed” instead of a comparison.

Re-running the same query after importing another zip is a new measurement. Keep the old number next to the old filename. Do not overwrite it.

What to file

File the query time in UTC, the zip filename, and the count, plus a one-line description of the query such as “enabled users with a path to the Domain Admins group.” File the query text if you have it. Do not file a screenshot that crops off the filename you were supposed to add yourself.

Worked case: 212 and then 40, unlabeled

Monday’s note says 212. Thursday’s note says 40. Neither line names a zip. The lab folder has lab-dconly-monday.zip and lab-dconly-thursday.zip, and both were imported. A draft says the exposure fell by 172 because the delegation was removed.

The corrected note refuses the comparison. It files 212 with the Monday zip and 40 with the Thursday zip only after the query is re-run against each load and the filename is written on that line. Until then the two numbers are unlabeled measurements, not a before and after.

Snippet
Monday: count 212  zip: not written
Thursday: count 40  zip: not written
files present: lab-dconly-monday.zip, lab-dconly-thursday.zip
write: comparison refused until each count names its zip
not: exposure fell by 172

Diagram

Put the zip on the same line as the count

  1. Query

    Say what was counted, in one line.

    Question
    enabled users with a path to Domain Admins
  2. Zip

    Name the collection file that was loaded.

    File
    lab-dconly-thursday.zip
  3. Time

    When the query ran, in UTC.

    Clock
    2026-11-03T11:00:00Z
  4. Compare

    Only two lines that both have a zip and the same query.

    Note
    otherwise refuse the delta

Check yourself

1. A path count is on the screen and the picture has no filename. What is missing?

2. Monday says 212 and Thursday says 40, with no zip names. What may you conclude?

3. Both zips are imported and you are not sure which one the query used. What do you write?