BloodHound

Official SpectreOps documentation.

Ingestors

Sharphound

SharpHound is a data collection tool that maps Active Directory environments by gathering information on users, groups, sessions, and permissions, typically used as part of the BloodHound toolset. It does that via Windows API calls and LDAP queries.

OPSEC: The --excludedcs option avoids querying Domain Controllers.

# Collect all available domain information
.\SharpHound.exe -c all

Its PowerShell version import Sharphound.ps1 directly into memory.

# Execution policy bypass
powershell -ep bypass

# Import module
Import-Module .\Sharphound.ps1

# Collect all available domain information
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\stephanie\Desktop\ -OutputPrefix "corp audit"

It collects and compresses domain data (in JSON format) into a .zip file. SharpHound may also generate a .bin cache file to speed up future runs—this file isn't required for analysis and can be ignored or deleted.

SharpHound also supports looping for continuous data collection if needed.

SOAPHound

RustHound

bloodhound-python (nxc)

BloodHound

BloodHound is a graphical tool that visualizes Active Directory relationships and permissions to identify attack paths and privilege escalation opportunities in enterprise environments. Once the data is collected via SharpHound, we can upload the .zip file to BloodHound.

BloodHound used neo4j, a graph database that stores data as nodes and relationships—perfect for mapping complex AD environments. The default Neo4j credentials are neo4j:neo4j.

Custom cypher queries: BloodHound Queries For All.

bloodhound-automation

Bloodhound automation automatically runs and populates a new instance of BH CE:

# Create & start a project
./bloodhound-automation.py start -bp 10001 -np 10501 -wp 8001 my_project

# Import data
./bloodhound-automation.py data -z test.zip my_project

# Delete & clear data
./bloodhound-automation.py delete my_project
./bloodhound-automation.py clear my_project

Manual

Docker

AD-miner

AD Miner is an Active Directory auditing tool (supporting both on-prem and Entra ID) that analyzes BloodHound data in a Neo4j database using Cypher queries. It generates a static, web-based report highlighting AD weaknesses with dynamic graphs, risk ratings, historical indicators, and detailed mitigation paths. It requires a Neo4j database populated with AD data from tools like SharpHound, RustHound-CE, BloodHound.py, or AzureHound.

For optimal performance, BloodHound Automation is recommended, as it installs the Graph Data Science plugin—enabling faster analysis and smarter pathfinding compared to default BloodHound setups.

Basic

Basic usage:

AD-miner -cf My_Report -u neo4j -p mypassword

Cache

Resources

• A nice demo of how to use Bloodhound (video)