Active Directory Attack Path Analysis: BloodHound, ACL Abuse, and Privilege Escalation Remediation

BloodHound Community Edition (CE, formerly BloodHound CE after SpecterOps open-sourced it) uses SharpHound as its data collection agent. SharpHound enumerates AD objects, group memberships, ACLs, GPO links, trust relationships, session data, and local admin rights, then outputs JSON files for import into BloodHound's Neo4j graph database.

Running SharpHound:

# Standard collection (recommended for most environments)
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Temp\

# Stealth collection (avoids session enumeration, which generates Event ID 4624)
Invoke-BloodHound -CollectionMethod DCOnly -OutputDirectory C:\Temp\

# Loop collection (captures session data over time for better coverage)
Invoke-BloodHound -CollectionMethod Session -Loop -LoopDuration 02:00:00

OPSEC considerations for defenders running internal assessments: SharpHound generates LDAP queries to domain controllers that are visible in DC LDAP query logs. In environments with advanced detection, run collection from a dedicated assessment machine with a service account that has minimal permissions. Use -CollectionMethod DCOnly first to collect structural data (GPOs, ACLs, groups) without triggering session enumeration alerts.

AzureHound for hybrid environments: If your AD syncs to Azure AD / Entra ID, run AzureHound alongside SharpHound. AzureHound collects Azure RBAC assignments, Entra ID group memberships, app role assignments, and conditional access policies. Import both datasets into BloodHound CE to see hybrid attack paths that span on-premises AD and Azure.

BloodHound represents relationships between AD objects as edges. Not all edges are equally dangerous. Prioritize hunting for these edge types in order of exploitation difficulty (easiest first).

GenericAll / GenericWrite — Full control edges: GenericAll on a user object means any principal with that edge can reset the target's password, add them to groups, modify their attributes, and write their msDS-KeyCredentialLink attribute (enabling Shadow Credentials attack). Find all paths where non-privileged groups (Domain Users, Authenticated Users) have GenericAll on privileged accounts.

BloodHound query:

MATCH (n:Group {name: "DOMAIN USERS@DOMAIN.LOCAL"})
MATCH (m:User)
WHERE NOT m.name ENDS WITH '$'
MATCH p=shortestPath((n)-[r:GenericAll|GenericWrite|WriteDACL|WriteOwner*1..]->(m))
RETURN p

Kerberoastable accounts with high privilege: Service accounts with SPNs registered are Kerberoastable — any domain user can request their TGS ticket and attempt offline password cracking. The vulnerability is the combination of SPN + weak password. BloodHound marks Kerberoastable accounts; filter for those with paths to privileged groups.

Unconstrained delegation: Computer objects with unconstrained delegation enabled cache TGTs for every user who authenticates to them. If an attacker compromises such a machine and a Domain Admin authenticates to it (via a printer spooler coercion or RPC call), the attacker captures the DA TGT and can impersonate that user. In BloodHound: MATCH (c:Computer {unconstraineddelegation: true}) RETURN c

DCSync rights: Accounts with Replicating Directory Changes and Replicating Directory Changes All permissions on the domain object can perform DCSync — requesting all password hashes from a DC without being on the DC itself. Find accounts with this right outside of Domain Admins and SYSTEM:

MATCH (n)-[:DCSync]->(d:Domain)
WHERE NOT (n)-[:MemberOf*1..]->(:Group {name: "DOMAIN ADMINS@DOMAIN.LOCAL"})
RETURN n.name, d.name

LAPS misconfigurations: In environments using Local Administrator Password Solution, the LAPS password attribute (ms-Mcs-AdmPwd) should only be readable by designated admin groups. BloodHound's ReadLAPSPassword edge shows which principals can read LAPS passwords for which computers.

Not all attack paths are equally urgent. Prioritize remediation using a tiering model that reflects the blast radius of compromise.

Tier 0 — Crown jewels (remediate immediately): Objects whose compromise gives attacker control over all of AD: Domain Controllers, the domain object itself, Domain Admin group members, Enterprise Admins, Schema Admins, KRBTGT account, AdminSDHolder, AD replication paths. Any path from a non-Tier 0 principal to a Tier 0 asset is critical.

Tier 1 — High-value servers (remediate within 30 days): Objects that control large numbers of endpoints or sensitive data: PKI servers, ADFS infrastructure, privileged access workstations, backup servers, privileged identity management systems. Compromise of these allows lateral movement to Tier 0.

Tier 2 — Standard workstations and users (remediate within 90 days): Standard endpoints and user accounts. Attack paths that start at Tier 2 and reach Tier 0 in fewer than 3 hops should be treated as Tier 1 priority.

BloodHound shortest path queries by tier:

-- Shortest path from any Domain User to Domain Admins
MATCH (n:Group {name: "DOMAIN USERS@DOMAIN.LOCAL"})
MATCH (m:Group {name: "DOMAIN ADMINS@DOMAIN.LOCAL"})
MATCH p=shortestPath((n)-[*1..]->(m))
RETURN p ORDER BY length(p) LIMIT 10

-- Count of unique attack paths to Domain Admin
MATCH (n:Group {name: "DOMAIN USERS@DOMAIN.LOCAL"})
MATCH (m:Group {name: "DOMAIN ADMINS@DOMAIN.LOCAL"})
MATCH p=(n)-[*1..]->(m)
RETURN count(p) as PathCount

Attack path remediation prioritizes breaking the highest-severity paths with the lowest operational impact. Use this sequenced approach.

BloodHound CE provides point-in-time analysis. Production environments change daily — new group memberships, new service accounts, new ACLs added by application deployments. Implement continuous monitoring to catch new attack paths as they emerge.

Scheduled SharpHound collection: Run SharpHound on a weekly schedule from a dedicated service account. Import fresh data into BloodHound CE and compare path counts between runs. A spike in paths to Tier 0 objects should trigger immediate investigation.

BloodHound Enterprise: SpecterOps offers BloodHound Enterprise as a commercial platform that runs continuous collection, tracks attack path count trends over time, assigns risk scores to individual paths, integrates with ticketing systems, and provides remediation workflow management. For organizations where AD security is a compliance requirement (FedRAMP, CMMC, PCI-DSS Requirement 8), the audit trail and continuous monitoring justify the commercial cost.

Alert on high-value ACE additions: Configure alerting on Windows Security Event ID 5136 (directory service object modification) for ACE additions on the following objects: the domain root object (DCSync rights), AdminSDHolder, all Tier 0 group objects, and all Domain Controller computer objects. ACE additions to these objects outside of change control windows should be treated as a security incident.