Active Directory Enumeration: Practical Attack Path Mapping with BloodHound

The Hidden Web of Active Directory

Active Directory (AD) powers identity and access management for over ninety percent of enterprise networks. When an attacker gains an initial foothold inside a corporate domain, their goal is rarely to stay on that initial host. Instead, they seek a path to high-value targets like Domain Controllers, sensitive databases, or cloud identity synchronization servers.

Traditionally, discovering these paths required manual command-line queries using tools like net.exe, PowerShell AD modules, or PowerView. Modern security practitioners and red teams use graph-based analysis to visualize complex trust relationships immediately. BloodHound automates this process, exposing hidden attack paths that system administrators often do not realize exist.

In this guide, we will walk through the fundamentals of Active Directory graph theory, how to collect environment telemetry using SharpHound, how to analyze attack paths, and how defenders can disrupt these routes.

Understanding Graph Theory in AD

BloodHound maps Active Directory using graph theory principles. Instead of viewing AD as a hierarchical structure of Organizational Units (OUs), BloodHound treats the environment as a network of nodes connected by edges.

Nodes represent entities within the domain:

• Users: Accounts that authenticate against the domain.
• Computers: Workstations, servers, and Domain Controllers.
• Groups: Security and distribution groups.
• Domains: The top-level administrative boundary.
• GPOs: Group Policy Objects governing security configurations.

Edges represent permissions, relationships, or session activity:

• MemberOf: Indicates that a user or computer belongs to a group.
• AdminTo: Indicates explicit local administrator rights on a host.
• HasSession: Shows an active or cached user session on a host.
• GenericAll: Full control over a target object.
• WriteDACL: Ability to modify permissions on a target object.

When multiple relationships link together, they form a chain. For example, User A is a MemberOf Group B, which has AdminTo rights on Computer C, where Domain Admin D HasSession. By gaining control of User A, an attacker can compromise Computer C, dump credentials from memory, and compromise Domain Admin D.

Step 1: Collecting Telemetry with SharpHound

SharpHound is the primary data collector for BloodHound. It queries Domain Controllers via Lightweight Directory Access Protocol (LDAP) and contacts individual network hosts using Server Message Block (SMB) and Remote Procedure Call (RPC) to identify logged-in users and local group memberships.

You do not need administrative rights to run SharpHound. Any standard domain user account can execute queries against LDAP and SMB endpoints across the domain.

To collect domain data using the C# executable, open a standard PowerShell prompt on a domain-joined machine and run:

.\SharpHound.exe --CollectionMethods Default --OutputDirectory C:\Windows\Tasks\Output --ZipFileName audit_data.zip

The default collection method performs several essential tasks:

• Group: Enumerates domain group memberships.
• LocalGroup: Enumerates members of local groups (like Administrators and Remote Desktop Users) on accessible network hosts.
• Session: Enumerates active user sessions by inspecting network registry and SMB connections.
• Trust: Maps incoming and outgoing domain trust relationships.

For stealthier operations, red teams often restrict collection flags to avoid triggering high volumes of network traffic:

.\SharpHound.exe --CollectionMethods Dsnonly --Stealth --Throttle 1000

This limits enumeration to LDAP queries and throttles requests to minimize detection by Network Detection and Response (NDR) sensors.

Step 2: Deploying BloodHound Community Edition

Once collection completes, you need a BloodHound instance to ingest and visualize the generated zip file. BloodHound Community Edition (CE) runs efficiently via Docker containers.

Create a project folder on your analysis machine and download the official docker-compose configuration:

mkdir bloodhound-ce && cd bloodhound-ce
curl -L https://ghstack.neotechnology.com/bloodhound-ce -o docker-compose.yml
docker compose up -d

This command starts three containers: the Neo4j graph database, the BloodHound API server, and the web interface accessible on port 8080.

Navigate to http://localhost:8080 in your web browser, log in with the default administrator credentials, and upload your zip file using the Data Ingestion panel.

Step 3: Analyzing Attack Paths with Cypher

Once the data ingests, BloodHound presents a built-in library of pre-built queries. Some of the most actionable default queries include:

• Find all Domain Admins
• Shortest Paths to Unconstrained Delegation Systems
• Shortest Paths to Domain Admins
• Users with Foreign Domain Group Membership

While pre-built queries cover many scenarios, custom Cypher queries allow you to ask precise questions. Cypher is the query language used by the underlying graph engine.

To find all users who possess explicit write control over sensitive groups, run:

MATCH (u:User)-[r:GenericAll|WriteDACL|GenericWrite]->(g:Group) WHERE g.name ENDS WITH 'DOMAIN ADMINS@DOMAIN.LOCAL' RETURN u, r, g

To find every host where a standard user account can escalate to local administrator through permission delegation:

MATCH p=shortestPath((u:User {name: 'JSMITH@DOMAIN.LOCAL'})-[*1..10]->(c:Computer)) RETURN p

By evaluating these graph outputs, security teams can pinpoint single point of failure hosts. These critical hosts, if compromised, grant attackers lateral movement paths across entire business units.

Remediation Strategies for Defenders

Mapping attack paths is only half the battle. Defenders must actively break these graph links to reduce exposure.

1. Enforce Tiered Administration Separate domain administration into distinct security tiers. Domain Admins must never log into Tier 1 (member servers) or Tier 2 (workstations). If an admin logs into a compromised workstation, their credentials remain in LSA memory, enabling credential dumping.

2. Limit Local Administrative Rights Remove standard users from local Administrator groups on endpoints. Implement Local Administrator Password Solution (LAPS) to randomize unique local passwords across all hosts, preventing single-credential lateral movement.

3. Restrict RPC and SAM Requests By default, standard domain users can query remote SAM databases to identify local group members. Configure Group Policy to restrict remote RPC calls to SAM via the following setting: Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Network access: Restrict clients allowed to make remote calls to SAM.

4. Audit ACL Delegations Regularly audit Active Directory permissions for anomalous WriteDACL or GenericAll rights granted to non-admin accounts. Use BloodHound periodically as a defensive auditing tool to identify new path creation over time.

Conclusion

Active Directory complexity naturally creates unexpected pathways for lateral movement. By integrating BloodHound into your regular security assessment routine, you gain clear visibility into your domain posture from an attacker perspective. Focus on severing critical relationships, enforcing tiered administration, and hardening remote access controls to keep your enterprise secure.

Photo by Mika Baumeister on Unsplash.