BloodHound
Active Directory relationship graphs.
Category: Post-exploitation 🎯 Trench — Active Directory relationship graphs. You feed enumerated data (SharpHound) and it draws who can reach Domain
Admin from where.
🔗 Kill chain — Prerequisite: authenticated user. Output:
visualized paths (Shortest Path to DA from Owned). Speeds up AD
escalation 10×.
📡 Defensive footprint — SharpHound LDAP queries are very
noisy: thousands in seconds. Microsoft Defender for Identity has
specific detection
Reconnaissance using Active Directory queries (SharpHound).
⚠️ False friend — Running SharpHound with all methods
(-c All). Generates LDAP traffic comparable to an Nmap scan.
Better iterate (-c Group, then -c LocalAdmin…).
🛡️ Remediation — Detect LDAP query volume per user. Honeypot
accounts (decoy accounts in privileged groups that fire alerts
when queried).
← Back to the full glossary Last updated: 2026-06-11