BloodHound Cheat Sheet AD Enumeration & Attack Paths

BloodHound has become the standard tool for mapping Active Directory attack paths during internal penetration tests and red team engagements. It converts raw AD relationships, users, groups, computers, sessions, and permissions, into a graph database that reveals privilege escalation paths a human analyst would take hours or days to spot manually.

This cheat sheet covers the full workflow: collecting data with SharpHound, loading it into BloodHound, running the most useful built-in and custom Cypher queries, and interpreting results to build a realistic attack path from a low-privilege foothold to Domain Admin.

What BloodHound Actually Does

BloodHound models Active Directory as a graph. Nodes represent users, groups, computers, GPOs, and domains. Edges represent relationships like group membership, session presence, ACL permissions, and delegation rights.

This graph model matters because privilege escalation in AD environments is rarely a single misconfiguration. It is usually a chain: a user has local admin on a machine, an admin session lands on that machine, that admin is a member of a group with GenericAll rights on another object, and so on. BloodHound automates the discovery of these chains instead of requiring manual cross-referencing of group memberships and ACLs.

Setting Up BloodHound and Its Dependencies

BloodHound Community Edition runs as a set of Docker containers, replacing the older Neo4j desktop setup used in earlier versions.

Installing via Docker Compose

bash

curl -L https://ghst.ly/getbhce -o docker-compose.yml
docker compose up -d

Once the containers are running, retrieve the initial admin password from the container logs.

bash

docker compose logs bloodhound | grep "Initial Password"

Access the web interface at http://localhost:8080 and log in with the generated credentials. From here, all data ingestion and graph querying happens through the browser interface.

Data Collection With SharpHound

SharpHound is the official collector that runs on a domain-joined or domain-reachable machine to gather AD data. It comes in a compiled executable and a PowerShell version, both interchangeable depending on your engagement's operational security requirements.

Basic Collection Commands

powershell

SharpHound.exe -c All -d target.local --zipfilename sagefox_collection

The -c All flag collects every available data type, including sessions, group memberships, ACLs, trusts, and GPOs. For engagements requiring stealth, scope the collection to only what is needed.

powershell

SharpHound.exe -c Group,LocalAdmin,Session -d target.local

Running SharpHound via PowerShell

powershell

Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain target.local -ZipFileName sagefox_output.zip

Collecting Stealthily to Avoid Detection

Session data collection generates significant network traffic since it queries every domain computer for logged-in users. Throttling requests and using the Stealth collection method reduces the chance of triggering EDR or SIEM alerts during an engagement.

powershell

SharpHound.exe -c Stealth -d target.local --throttle 5000 --jitter 20

If your organization needs this kind of AD enumeration performed safely against a production environment, SageFox Cybersecurity's internal network penetration testers run these collections with tuned throttling and jitter settings specifically to avoid disrupting business operations while still mapping the full attack surface.

Uploading Collection Data Into BloodHound

Once SharpHound generates its output zip file, drag it directly into the BloodHound web interface's upload panel, or use the API for automated workflows.

bash

curl -X POST http://localhost:8080/api/v2/file-upload \
 -H "Authorization: Bearer <token>" \
 -F "file=@sagefox_collection.zip"

After ingestion completes, the graph populates with all discovered nodes and relationships, ready for analysis through the built-in queries or custom Cypher.

Essential Built-In Queries Every Analyst Should Run First

BloodHound ships with a set of prebuilt analysis queries accessible from the search panel. These form the baseline of any assessment.

Finding Domain Admins

Use the built-in "Find all Domain Admins" query to establish your target group before searching for paths leading to it.

Shortest Paths to Domain Admins

This is typically the most valuable query in the entire tool. It calculates every possible path from any node in the graph to a member of Domain Admins, ranked by shortest hop count.

Finding Kerberoastable Users

Users with an SPN set are vulnerable to Kerberoasting, where an attacker requests a service ticket and attempts to crack it offline.

Finding Users With DCSync Rights

This identifies accounts that hold GetChangesAll and GetChanges rights on the domain object, allowing them to replicate password hashes without ever touching a domain controller directly.

Custom Cypher Queries for Deeper Analysis

The built-in queries cover common cases, but custom Cypher queries let you answer specific questions relevant to a particular engagement.

Finding All Paths From a Specific Compromised User

cypher

MATCH p=shortestPath((u:User {name:"JDOE@TARGET.LOCAL"})-[*1..]->(g:Group {name:"DOMAIN ADMINS@TARGET.LOCAL"}))
RETURN p

Finding Computers Where a Specific User Has Sessions

cypher

MATCH (u:User {name:"JDOE@TARGET.LOCAL"})-[:HasSession]->(c:Computer)
RETURN c.name

Finding Unconstrained Delegation Hosts

Unconstrained delegation is one of the most dangerous misconfigurations in AD, since compromising one of these machines can allow ticket capture from any user who authenticates to it, including Domain Admins.

cypher

MATCH (c:Computer {unconstraineddelegation:true})
RETURN c.name

Finding Owned Objects With Dangerous Outbound Permissions

After marking compromised accounts as "Owned" within the BloodHound interface, this query reveals what those accounts can reach.

cypher

MATCH (n {owned:true})-[r:GenericAll|GenericWrite|WriteOwner|WriteDacl|Owns|AllExtendedRights]->(m)
RETURN n.name, type(r), m.name

Finding AS-REP Roastable Accounts

cypher

MATCH (u:User {dontreqpreauth:true})
RETURN u.name

Marking High Value Targets and Owned Principals

Two workflow habits significantly improve analysis quality on larger engagements.

Mark any account, computer, or group you compromise as "Owned" through the node's context menu. This immediately updates every query that references owned principals and helps visualize how far a single credential compromise can reach across the domain.

Mark sensitive targets like backup service accounts, certificate authority servers, or SCCM infrastructure as "High Value" if BloodHound has not already flagged them automatically, since these often carry paths to Domain Admin that are not obvious from group membership alone.

Interpreting Common Edge Types

Understanding edge semantics is where most of BloodHound's real analytical value comes from. A few of the most commonly abused edges include:

GenericAll: Full control over the target object, including the ability to reset passwords or add the compromised principal to groups.

WriteDacl: The ability to modify the target's access control list, which can be abused to grant yourself GenericAll after the fact.

ForceChangePassword: The ability to reset a user's password without knowing the current one, useful for direct account takeover.

AddMember: The ability to add a principal to a group, often used to escalate into a privileged group directly.

CanRDP: Indicates the principal can establish a Remote Desktop session to the target computer, useful for lateral movement planning even without direct administrative rights.

Reading these edges correctly, rather than just following the shortest path visually, is what separates a surface-level BloodHound review from a thorough attack path analysis. This is a core part of what SageFox Cybersecurity's red team reports include for clients: not just the path itself, but a clear explanation of why each edge exists and how to remediate the underlying misconfiguration.

Exporting and Reporting Findings

After identifying attack paths, export the relevant graph data for inclusion in your final report.

bash

curl -X GET "http://localhost:8080/api/v2/graphs/shortest-path?start_node=1234&end_node=5678" \
 -H "Authorization: Bearer <token>" -o attack_path.json

Screenshots of the graph view combined with a written explanation of each hop in the path give clients a clear picture of both the technical risk and the business impact of the misconfiguration chain.

Common Mistakes When Using BloodHound

Running Collection Without Scoping

Collecting from every domain computer at once in a large environment can generate excessive network noise. Scope collection sessions and use throttling in sensitive environments.

Ignoring Stale Data

BloodHound reflects a snapshot in time. Sessions in particular change constantly, so a session-based attack path identified during collection may no longer be valid an hour later. Always re-verify session-based paths before attempting to act on them.

Overlooking ACL-Based Paths in Favor of Group Membership Only

Many analysts focus heavily on nested group membership and miss that a direct ACL grant like GenericWrite on a user object can be a faster, quieter path to compromise than chasing a long group nesting chain.

Best Practices for Using BloodHound on Engagements

• Always scope SharpHound collection methods to what the engagement rules of engagement allow
• Re-collect session data periodically during longer engagements rather than relying on a single snapshot
• Mark owned principals immediately after compromise to keep the graph analysis current
• Cross-reference BloodHound findings with manual net and PowerView commands before acting on a path
• Document every edge type in the final attack path, not just the starting and ending nodes, so remediation teams understand the full chain

Key Takeaways

BloodHound turns Active Directory's complex web of permissions, sessions, and group memberships into a queryable graph that reveals realistic attack paths from a single compromised credential to full domain compromise. Mastering SharpHound's collection options and a core set of Cypher queries, shortest paths to Domain Admins, Kerberoastable accounts, unconstrained delegation hosts, and ACL abuse chains, covers the majority of what a practitioner needs on a typical internal engagement.

If your organization wants a clear picture of what your Active Directory environment actually exposes to an attacker with a single foothold, SageFox Cybersecurity's internal penetration testing team runs this exact methodology on every engagement, delivering attack path documentation your team can use to prioritize fixes that matter most.