Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is BloodHound? How defenders use it to find Active Directory attack paths

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 12 November 2026.

In one sentence: BloodHound is a free tool that draws a map of who can reach whom inside a company’s Windows user directory, so you can see, and cut, the routes an attacker would use to become an administrator.

What it is

Active Directory is Microsoft’s directory service. It holds your users, groups, computers and the permissions between them. Entra ID (formerly Azure AD) is the cloud equivalent. Over the years, permissions pile up. No console shows them all together.

SpecterOps, the company behind it, says BloodHound uses graph theory to reveal hidden and often unintended relationships within Active Directory and Entra ID. Its documentation says defenders (blue teams) and attackers (red teams) both use it to understand privileged relationships. MITRE ATT&CK lists BloodHound as software S0521: an Active Directory reconnaissance tool that can reveal hidden relationships and identify attack paths.

There are two products. According to SpecterOps, BloodHound Community Edition (CE) is free and open source, aimed at penetration testers and red teams to identify, test and validate attack path risk. BloodHound Enterprise is a managed SaaS product for blue teams, with scheduled data collection and tracking of attack paths over time. Since version 8.0, a feature called OpenGraph extends it to other identity services, SpecterOps names GitHub, Okta and Jamf as examples.

This page explains the concept. It does not give collection commands or queries.

How it works

  1. Collect. A collector reads directory data: users, groups, computers, group membership, permissions, sessions and trusts. MITRE records that BloodHound can identify users with local administrator rights, collect domain users, groups and computers, map domain trusts and collect user sessions.
  2. Build a graph. Every object becomes a point (node). Every relationship, such as “is a member of” or “has admin rights on”, becomes a line (edge).
  3. Find paths. The tool searches the graph for chains from an ordinary account to a high-value target such as Domain Admins.
  4. Read the result. Each path is a list of permissions that look reasonable alone but together give control. Fix any one link and that path closes.

What it does not do: it does not exploit anything. It shows relationships. It is also point-in-time in the Community Edition, so it needs re-running as the directory changes.

Ordinary user Help deskgroup Serveradmin Adminsession DomainAdmins member ofadmin onlogged in Illustrative only. Cut one link and the whole path closes.

Who it affects and how badly

Any organisation that runs Active Directory or Entra ID, which includes most offices with Windows servers. Findings matter most where permissions have accumulated for years.

  • 10 to 50 staff (accountancy, legal, construction, recruitment): often a handful of admin groups and old shortcuts. Worst case: one phished account is a short hop from full control.
  • 50 to 250 staff (manufacturing, care providers, schools, retail): more groups, more service accounts. Worst case: ransomware that reaches every server because an ordinary account had a path to admin.
  • Regulated and 250 plus (fintech, insurance, healthcare, telecoms, councils): complex directories and trusts. Worst case: a full domain takeover, extended downtime and regulatory reporting.

For defenders it is a view of risk that scanners cannot give. MITRE shows ransomware and espionage groups, among them Wizard Spider, APT29 and Play, are recorded as using BloodHound, which is why defenders should look at the same map first.

Real examples

  • Recorded use by attackers. MITRE ATT&CK lists groups using BloodHound, including Wizard Spider, APT29, Chimera, TA505, Play and Ember Bear, and the campaign Operation Wocao, where actors used it to discover trust between domains. Source: MITRE ATT&CK S0521.
  • Defender use. SpecterOps documents BloodHound Enterprise as a way for defenders to manage attack paths over time. Source: SpecterOps documentation.

What we check on a test

In an internal test with directory access in scope, a Wolfcore penetration tester looks at:

  • The shortest route from a standard user account, and from a typical help desk account, to Domain Admins and other high-value groups.
  • Permissions on directory objects that let one account change another (reset passwords, edit group membership).
  • Where administrators are logged on, and which machines hold their sessions.
  • Service accounts in privileged groups.
  • Trusts between domains, and cloud identity links such as Entra ID sync accounts.
  • Whether the same path still exists after you fix it, by re-checking.

How to detect it

The collection that BloodHound performs is itself visible.

  1. MITRE maps BloodHound to discovery techniques: account discovery (T1087), permission groups discovery (T1069), remote system discovery (T1018) and system owner or user discovery (T1033). Alert on those behaviours.
  2. On domain controllers, look for a single workstation or account making large numbers of directory lookups in a short time, which is not normal for most users.
  3. Look for ZIP files of directory data written to disk on a workstation, since MITRE records BloodHound can compress collected data into a ZIP file.
  4. Run your own collection at agreed times and note it, so unplanned runs stand out.
  5. Review group membership changes on privileged groups.

How to fix or prevent it

  1. Run it against your own directory first, with approval, and rank paths by how many they affect. Close the shared links first.
  2. Remove users from privileged groups that do not need them (see least-privilege).
  3. Remove excessive permissions on directory objects, such as the right to reset another user’s password or edit group membership.
  4. Keep administrators from logging on to ordinary workstations and servers. The NCSC’s privileged access management guidance describes permitting only trusted devices and users to reach administration interfaces, and using temporary credentials.
  5. Move service accounts out of privileged groups, and give each one only the rights it needs.
  6. Segment the network. The NCSC says segmentation lets you control what access is allowed between networks.
  7. Re-run after each change, and on a schedule, because directories change daily.
  8. Treat tier-zero systems (domain controllers, identity servers) as the most protected assets.

The UK angle

The NCSC’s network security fundamentals page says highly privileged accounts, such as those used for system administration, are prime targets for attackers, and should be secured in proportion to the risk. It points to the NCSC’s secure system administration guidance, which recommends privileged access management, including temporary credentials, so a stolen credential has a short window. BloodHound shows you where those rules have not been applied.

Related terms

least-privilege, how-privilege-escalation-works, kerberos-authentication, ntlm-authentication, port-636-ldaps, nmap

Browse the Security tools and testing methods category.

FAQ

Is BloodHound illegal to use? It is a legitimate, openly published tool used by defenders and testers. Run it only on directories you own or have written permission to test.

Is BloodHound free? The Community Edition is free and open source, per SpecterOps. The Enterprise edition is a commercial SaaS product.

Does BloodHound find vulnerabilities? Not in the patch sense. It finds relationships and permissions that form attack paths.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at free web vulnerability scan and see our penetration testing service.