BloodHound is a free, open-source tool that maps Active Directory as a graph. Every user, computer, and group is a node. Every relationship and permission between them is an edge. The tool finds the shortest path from any compromised account to Domain Admin.

Attackers use BloodHound to answer: I own this low-privilege account — what is the fastest way to become Domain Admin? Defenders use the exact same tool to answer: Which attack paths exist in our environment, and which ones should we close first?

Key Relationships (Edges) to Watch For

GenericAll — Full control over the target object. Can reset their password, add them to groups, or modify their SPN for Kerberoasting. If a regular user has GenericAll over a Domain Admin, that is a direct attack path.

GenericWrite — Can modify most attributes of the target. An attacker can set an SPN on any account they have GenericWrite over, making it Kerberoastable.

WriteDACL / WriteOwner — Can modify permissions on the target. Effectively the same as GenericAll once exploited. Often overlooked because it looks like a routine admin setting.

DCSync Rights (GetChangesAll) — The right to replicate directory data from a Domain Controller. Only DCs should have this. If a non-DC account has it, an attacker can dump every password hash in the domain without touching LSASS.

AdminTo — The source account has local administrator rights on the target computer. This is your lateral movement map.

CanRDP — The source can open a Remote Desktop session. Shows up as EventCode 4624 Type 10.

The 4 BloodHound Queries to Run on Every AD Environment

1. Shortest Paths to Domain Admin — Find every permission chain that leads to full control. Prioritize the shortest ones and break at least one link in each chain.
2. Principals with DCSync Rights — Should only return your Domain Controllers. Any user or service account here is a critical finding.
3. Kerberoastable Users with High Privilege — Service accounts with SPNs that are also in privileged groups. Highest-value Kerberoasting targets.
4. High Value Target Reachability — How many hops from any compromised user to Domain Admin? Less than 3 hops for a regular user means your environment is too flat.

Learning Objective

After this lesson, you can explain what BloodHound is, describe at least 4 dangerous AD relationships it surfaces, and name the 4 key queries to run on any AD environment.

Part of the free Intro to Cyber course by Cover6 Solutions.