How to Enumerate Active Directory with BloodHound-Python

Summary

A practical walkthrough of using BloodHound-Python to collect Active Directory data with different methods and password, hash, and Kerberos authentication, then package results for BloodHound analysis.

Key points

• BloodHound-Python collects Active Directory relationships and writes JSON data for graph analysis without requiring a domain-joined Windows host.
• Default gathers broad domain and host data; LoggedOn focuses on active sessions; DCOnly queries the domain controller over LDAP; All provides the broadest collection.
• The tutorial demonstrates authentication with a password, an NT hash, a Kerberos AES key, and a cached Kerberos ticket.
• Collected data can reveal users, groups, policies, computer relationships, and sessions that may expose paths toward privileged accounts.
• The --zip option bundles collection output into a single archive for import into BloodHound.
• The article advises using these techniques only in authorized assessments and notes that defenders can use the resulting graphs to identify paths that need hardening.

Products

Tools

Related Articles

• Correlating Windows Events 5156 and 1644 to Attribute ADWS QueriesBloodHound · Microsoft Active Directory
• Detecting Active Directory Attack-Path Enumeration with SDFlagsBloodHound · Microsoft Active Directory
• Attackers Exploit Ivanti Connect Secure Zero-Day Before Fix Reached All Supported VersionsMicrosoft Active Directory
• Akira Intrusion Used ClickFix to Gain Domain Admin and Encrypt 485,224 FilesMicrosoft Active Directory
• Ivanti Connect Secure Zero-Days Chained for Unauthenticated Root AccessMicrosoft Active Directory