Tools · Identity defense · 14 / 25
BloodHound: the object id is the directory object
A node’s name is a label from the collection. The object id is the directory identifier stored with it. Write the id. Do not merge two nodes because the names match.
The id outlives the label
A BloodHound node shows a name and an object id. For an Active Directory object the id is the identifier the collector stored, typically the object’s SID. The name is the label at collection time. A rename in the directory later does not rewrite a zip you already imported.
Two nodes can share a display name and still be two objects. The ids tell you that. A note that cites only the name can be read as either one.
An arrow connects ids
A path is a chain of object ids with an edge type between them. If you write the path as names only, a renamed account makes the note impossible to find in the next zip. Write the id beside each name you keep.
The edge type is the relationship that was stored. Do not replace it with a stronger word that was not on the arrow. The id says which object. The edge type says which relationship.
What to file
File the object id, the name, and the zip filename. If two nodes share a name, file both ids and do not add their edges together. If the id was cropped out of a screenshot, write “object id not in the screenshot” and do not reconstruct it from a name search in a different zip.
Worked case: two nodes named Riley
One loaded zip shows a user named Riley with object id ending in -1421 and another named Riley ending in -1888. A draft draws one path and says Riley has both a membership and a session. The membership is on -1421. The session is on -1888.
The note lists the two ids. The membership stays on -1421. The session stays on -1888. There is not one Riley with both. The names match. The objects do not.
zip: lab-dconly-thursday.zip name: Riley object id: ...-1421 edge: membership name: Riley object id: ...-1888 edge: session write: two objects not: one Riley with both edges
Diagram
A shared name and two object ids
The name is a label. The id is the object.
Is. The label stored at collection
Can. Match another node
Use. Beside the id, not instead of it
Is. The directory identifier on the node
Can. Be found in a later zip after a rename
Use. When you say which object an edge touches
Check yourself
1. Two nodes are both named Riley and have different object ids. What are they?
2. A membership is on id -1421 and a session is on id -1888. What may you write?
3. The screenshot shows the name and not the id. What do you write?