BloodHound: mapping and fixing Active Directory attack paths

I have well over eight credible sources and four verified images. Writing the post now.

The map that assumes you are already inside

Picture a penetration tester on the second morning of an engagement. She has one thing: the password of a single ordinary employee, phished in a simulated attack the day before. No admin rights, no special access, just a normal account in a company of ten thousand. She runs a small collector program, waits a few minutes while it interrogates the network, drags the resulting file into a browser window, and clicks a button labelled "shortest path to Domain Admin." A chain of glowing nodes snakes across the screen. Six hops later, her nobody account owns the entire company. This is not a rare stroke of luck. SpecterOps, the security firm that builds the tool she is using, reports that more than 70% of the Active Directory environments it assesses contain an attack path from an ordinary authenticated user to full domain control. The tool is called BloodHound, and since 2016 it has quietly rewired how both attackers and defenders think about the software that runs the login screen at most of the organisations you interact with.

What Active Directory is, and why it accumulates rot

Active Directory (AD) is Microsoft's directory service, the central database that most companies use to manage who is who on their internal networks. When you log into a work laptop, join a shared drive, or open a corporate app with a single sign-on, there is a good chance AD is deciding whether to let you in. Microsoft says it underpins identity at the overwhelming majority of large enterprises, which is exactly why it is such a prize: compromise AD and you effectively become the network's landlord. AD stores objects (users, computers, groups, and organisational containers) and, crucially, a web of permissions describing who can do what to whom. Those permissions live in structures called access control lists, or ACLs: for every object, a list of which other accounts can read it, modify it, reset its password, add members to it, or take it over entirely. A single user account might be a member of a group, which is nested inside another group, which was granted the right to reset passwords on a third group, one of whose members happens to be an administrator. Each individual permission looked reasonable when someone set it, often years ago, for a reason nobody remembers. The other load-bearing piece is Kerberos, the authentication protocol AD uses to issue the digital "tickets" that prove your identity to services without resending your password each time. Kerberos is elegant, and it is also old, and several of its design choices have become footholds, as we will see. The problem is not that any one of these settings is a bug. It is that they compound. A domain that has existed for fifteen years, through mergers, departed admins, migrated apps, and emergency "just make it work" fixes, accumulates hundreds of thousands of permission relationships. No human can hold that graph in their head. For decades, that complexity was a defence by obscurity. BloodHound's founding insight was that obscurity is not the same as safety.

From Kevin Bacon to Domain Admin

The tool got its public debut on 4 August 2016 at DEF CON 24, the long-running hacker conference in Las Vegas, in a talk titled "Six Degrees of Domain Admin" by Andy Robbins, Rohan Vazarkar, and Will Schroeder. The name is a joke with a serious point. It borrows from "Six Degrees of Kevin Bacon," the parlour game invented by three college students in 1994 in which any Hollywood actor can be linked to Kevin Bacon through a short chain of shared films. The mathematical idea underneath, that the nodes in a large social network are typically separated by only a few hops, turns out to describe corporate permission structures disturbingly well.

Robbins, Vazarkar, and Schroeder reframed Active Directory as a graph, the mathematical object made of nodes and the edges connecting them. Every user, computer, and group becomes a node. Every meaningful relationship becomes a directed edge: "is a member of," "can reset the password of," "has an active session on," "has full control over." Once you have that graph, a question that used to take a skilled auditor weeks of manual review becomes a standard computer science problem: find the shortest path from node A to node B. That is a query a graph database can answer in milliseconds, which is why the original BloodHound was built on top of Neo4j, a database designed for exactly this kind of relationship traversal. The genuinely novel contribution came the following year. In 2017 the team added edges based on ACL abuse, the permission relationships buried in those access control lists. Before that, attack paths mostly ran through group memberships and admin sessions. Adding ACLs meant BloodHound could now see that an ordinary user with the right to modify a group could grant themselves membership, or that an account with control over another user could reset its password and inherit its access. This is where the "over 70%" figure comes from: most of those universal paths to Domain Admin run through misconfigured permissions, not through unpatched software.

Reading the graph: the edges that matter

To build the graph, BloodHound needs data, and that is collected by a companion program. The main one is called SharpHound. Run under any domain user's credentials, SharpHound fires a barrage of LDAP queries at a domain controller (LDAP is the standard protocol for reading directory data) to pull the full inventory of users, groups, computers, and their permissions. It then reaches out to individual machines over SMB, the Windows file-sharing protocol, to learn who is currently logged in where. That session data is the secret sauce: it tells an attacker not just who could reach an admin, but which machine to compromise right now to steal a live administrator's credentials from memory. A handful of edge types do most of the damage, and each corresponds to a real, well-understood abuse:

• GenericAll means full control of an object. Per SpecterOps' own documentation, an attacker with GenericAll over a user can reset its password outright, or quietly add a "service principal name" to it and then perform a Kerberoasting attack: request a Kerberos ticket for that account and crack its password offline, because of a design quirk that lets any user request such tickets.
• DCSync, the cleanest route to total compromise, exploits a legitimate feature. Domain controllers replicate their password databases to each other. An account holding two specific replication rights can pretend to be a domain controller and ask for a copy of every password hash in the domain, including the administrator's, without ever touching a domain controller's disk or triggering an obvious alarm.
• WriteDACL lets you rewrite an object's permission list, which means you can grant yourself GenericAll and then do any of the above. None of these are exploits in the classic sense. They are features, working exactly as designed, chained together in a sequence nobody intended. BloodHound's power is that it finds the sequence for you.

When the defenders' tool became the attackers' map

A tool that turns a sprawling network into a to-do list of "compromise these six accounts in this order" is not going to stay confined to authorised testers. It did not.

By the end of the decade, BloodHound had become standard equipment in ransomware operations. Threat-intelligence firm Halcyon documents its use by Conti, Ryuk, LockBit, and Play affiliates to map the fastest route from an initial foothold to the domain controllers, which is where they detonate the encryption to hit every machine at once. This matters enormously for how much damage a ransomware crew can do: the difference between encrypting one department's laptops and encrypting the whole company is precisely the attack path BloodHound draws. The 2021 joint CISA, FBI, and NSA advisory on Conti offers a window into this world. It describes Conti actors using Kerberos attacks to grab admin hashes for offline cracking, and, drawing on a leaked internal Conti "playbook," escalating privileges through unpatched flaws such as Zerologon (CVE-2020-1472), which let an attacker impersonate a domain controller, and PrintNightmare (CVE-2021-34527). The advisory catalogues over 400 attacks against US and international organisations. The playbook approach, standardised tooling and repeatable steps, is what let a mid-sized criminal crew run enterprise compromise as an assembly line. The same graph logic now extends to the cloud. AzureHound, which threat actors have been observed misusing according to Palo Alto's Unit 42, collects the equivalent data from Microsoft's Entra ID (formerly Azure AD), mapping the path to Global Administrator instead of Domain Admin. When Russia's SVR foreign intelligence service breached Microsoft's own corporate cloud in January 2024, SpecterOps published a walkthrough of how the abused permissions would appear as BloodHound edges. Modern versions stitch on-premises and cloud identities into a single hybrid graph, because attackers pivot across that boundary and so must the defenders.

The misconception: you cannot patch your way out

Here is the idea that trips up organisations, and it trips up capable ones. The instinct when you hear "attack path to Domain Admin" is to reach for the patch cycle: find the vulnerabilities, apply the updates, close the holes. That instinct is not wrong, it is just aimed at the wrong target. An attack path is not a software vulnerability. As Quest, which resells BloodHound Enterprise, puts it, it is "a chain of abusable privileges and actions," not a code flaw. The Zerologon in the Conti playbook has a patch; the GenericAll edge from the helpdesk group to a domain admin does not, because it is not a defect, it is a configuration somebody chose. You cannot download an update that fixes "this group has slightly too much power." Assessments that use BloodHound in "assumed breach" mode, which start from the premise that an attacker already has one ordinary foothold, routinely find paths that involve no software exploitation at all, only credential abuse and over-privileged accounts. This reframing is the whole point, and it flips the tool's polarity. The same graph that hands an attacker a route hands a defender a punch list. If you can see that 4,000 users all reach Domain Admin, you can also see the single edge that 3,500 of those paths pass through. Cut that one edge and thousands of paths vanish at once.

Fixing paths: choke points, tiering, and the part that never ends

The defensive discipline that grew out of this is called attack path management, and its core move is finding choke points: the edges through which a disproportionate number of paths flow. Remove or shrink those first and you get the most reduction for the least disruption. This is genuinely hard to do optimally. Academic work on the problem, such as a 2022 paper on edge-blocking algorithms for Active Directory attack graphs, shows that computing the perfect set of edges to cut is computationally intractable in the general case, which is why the practical tools rely on heuristics and prioritisation rather than a clean solution. The structural fix underneath is tiering. France's cybersecurity agency ANSSI, among others, advocates a tiered administration model in which the most sensitive assets, the domain controllers and the accounts that manage them, form a "Tier 0" that is walled off. Tier 0 admins never log into ordinary workstations, so their credentials never sit in memory on a machine an attacker might own. Done properly, tiering severs whole classes of edges: the humble laptop compromise no longer leads anywhere near the crown jewels, because the path from tier to tier has been deliberately cut. Concrete remediations tend to be unglamorous: strip service accounts of privileges they never actually use, remove nested group memberships that grant accidental power, reduce who has local administrator rights on shared machines, and monitor the sensitive objects that remain. On the detection side, SharpHound's own behaviour is a tell. Security teams write SIEM rules that flag a single source firing hundreds of LDAP queries in a few minutes, or reaching out to many hosts over SMB in quick succession, and some deploy decoy accounts that no legitimate process should ever touch, so that any query against them raises an alarm. The catch, and it is a real one, is that this is not a project with an end. Every new employee, every new application, every "temporary" permission granted on a Friday afternoon adds edges to the graph. A domain that was clean last quarter is not clean today. This is why SpecterOps eventually rebuilt the whole product line around continuous collection, releasing a free, rewritten BloodHound Community Edition in August 2023 on the same modern architecture (a Neo4j graph database, a Postgres store, a REST API, and a browser front end) as its paid enterprise product. The free version still models the attack; the paid version watches the graph change over time and tells you when a new path opens. Attack path management, as its practitioners are fond of saying, is not a once-and-done task.

What to watch

The uncomfortable thing about BloodHound is that it did not create any of the danger it reveals. Every path it draws was already there, sitting in permission lists nobody had read in years, exploitable by anyone patient enough to trace it by hand. The tool's real contribution was to make the cost of tracing it approximately zero, for attackers and defenders simultaneously. Whether that nets out as good or bad depends entirely on which side moves first. The frontier now is identity that spans on-premises Active Directory and cloud platforms at once, where a compromised laptop can lead to a cloud tenant and back again through relationships neither system fully sees on its own. The graph is getting bigger and more connected, not smaller. The open question is whether defenders, armed with the same map as their attackers, can shrink the number of paths faster than their own sprawling, merging, endlessly reconfigured networks can grow new ones. On current evidence, with that 70% figure barely moving year over year, it is not a race anyone is comfortably winning.

Sources

1. Andy Robbins, Rohan Vazarkar, Will Schroeder, DEF CON 24, "Six Degrees of Domain Admin" (2016)
2. SpecterOps, "Your new best friend: Introducing BloodHound Community Edition" (2023)
3. SpecterOps, "What is Attack Path Management?" (accessed 2026)
4. SpecterOps BloodHound documentation, "GenericAll edge" (accessed 2026)
5. SpecterOps BloodHound documentation, "SharpHound Community Edition Flags" (accessed 2026)
6. CISA, FBI, NSA, "Conti Ransomware, Alert AA21-265A" (2021, updated 2022)
7. Halcyon, "BloodHound in Ransomware Operations" (accessed 2026)
8. Palo Alto Networks Unit 42, "Cloud Discovery With AzureHound" (2024)
9. SpecterOps, "Hybrid Attack Paths, New Views, and Your Favorite Dog Learns an Old Trick" (2024)
10. Mingyu Guo et al., "Scalable Edge Blocking Algorithms for Defending Active Directory Style Attack Graphs" (2022)
11. Quest, "Attack paths in Active Directory: What you should know" (accessed 2026)
12. ANSSI, "Remediation of Active Directory Tier 0" (accessed 2026)
13. Secureworks (Sophos), "Sniffing Out SharpHound on its Hunt for Domain Admin" (accessed 2026)
14. Encyclopaedia Britannica, "Six Degrees of Kevin Bacon" (accessed 2026)
15. SpecterOps, "BloodHound source repository" (accessed 2026)