Loading malware…
BloodHound is a legitimate, dual-use Active Directory enumeration and attack-path analysis tool used by security practitioners and adversaries. It maps relationships among domain accounts, computers, groups, sessions, and trust relationships to identify paths to privileged access. Its discovery capabilities include enumerating domain computers and domain controllers, collecting their properties, and identifying user sessions. Data collection can use PowerShell and the SharpHound collector, which accesses Active Directory information through .NET APIs.
Adversaries deploy BloodHound after obtaining network access to understand Windows domain environments and identify opportunities for privilege escalation and lateral movement. Discovering an attack path does not itself execute the associated exploitation or steal credentials. BloodHound has been used by Chimera, OPERA1ER, LockBit affiliates, and Russian state-sponsored actors targeting U.S. cleared defense contractors. Its legitimate administrative and assessment uses mean that its presence alone does not establish malicious activity; operational context and authorization are essential.
13 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
BloodHound, CertiHound (ESC1–ESC17), PrivHound for AD attack-path mapping and privilege path discovery.
Credential Harvesting Querying internal LDAP / Active Directory via established VPN tunnel BloodHound, native adsi searches, Kerberoasting
Credential Harvesting Querying internal LDAP / Active Directory via established VPN tunnel BloodHound, native adsi searches, Kerberoasting
Observed accompanying deployment of offensive security tools, such as Cobalt Strike, BloodHound and SharpHound.
Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.
Enables identification of AD relationships that can be exploited to gain access onto a victim’s network.
+7 more in the app. View in Mallory
38 distinct techniques documented for this family, organized by ATT&CK tactic.
Mythic/Athena, Sliver, Ligolo-ng, Chisel, NetExec, BloodHound
Это Valid Accounts (T1078, Initial Access / Persistence / Privilege Escalation / Defense Evasion) в комбинации с Unsecured Credentials (T1552, Credential Access). Атакующему не нужен эксплойт - он использует легитимный аккаунт.
«Для T1059.001: Mimikatz, Run BloodHound from local disk, Run Bloodhound from Memory using Download Cradle — все через PowerShell на Windows.»
Discovery (e.g. BloodHound) T1087.001, T1087.002, T1106, T1069.001, T1069.002
Annotations ID Technique Tactic T1204.003 Malicious Image Execution Default Configuration
Это Valid Accounts (T1078, Initial Access / Persistence / Privilege Escalation / Defense Evasion) в комбинации с Unsecured Credentials (T1552, Credential Access). Атакующему не нужен эксплойт - он использует легитимный аккаунт.
There are also built-in escalation path queries, such as built-in queries for Active Directory Certificate Services (ADCS) privilege escalation techniques.
Это Valid Accounts (T1078, Initial Access / Persistence / Privilege Escalation / Defense Evasion) в комбинации с Unsecured Credentials (T1552, Credential Access). Атакующему не нужен эксплойт - он использует легитимный аккаунт.
Zachary_Hunt had either GenericWrite or WriteProperty with all 0s on quite a few users... if we hold WriteProperty with GUID f3a64788–5306–11d1-a9c5–0000f80367c1 on a user account we can set a SPN on their account.
Access Control Lists (ACL) misconfiguration is one of the most common issues Microsoft Incident Response finds in Active Directory environments... These attack paths create an escalation path from a low privileged user to total domain control.
jon.peters had GenericWrite access on 3 different users... I used targetedKerberoast.py tool to obtain the Kerberos hash for these 3 users.
"You could detect it with traffic to 9389 (ADWS) but there's an even bigger problem there, all of RSAT uses ADWS. So sysadmins doing normal operations would trigger false positives."
Another deception example is the use of the infamous Right-To-Left Override (RLO) character... Invoking a PowerShell command that downloads and executes BloodHound, with argv[0] containing the RLO character \u202E, makes it much harder to understand what is going on when looking at the reported command line.
Это Valid Accounts (T1078, Initial Access / Persistence / Privilege Escalation / Defense Evasion) в комбинации с Unsecured Credentials (T1552, Credential Access). Атакующему не нужен эксплойт - он использует легитимный аккаунт.
Zachary_Hunt had either GenericWrite or WriteProperty with all 0s on quite a few users... if we hold WriteProperty with GUID f3a64788–5306–11d1-a9c5–0000f80367c1 on a user account we can set a SPN on their account.
Access Control Lists (ACL) misconfiguration is one of the most common issues Microsoft Incident Response finds in Active Directory environments... These attack paths create an escalation path from a low privileged user to total domain control.
По классификации MITRE ATT&CK - подтехника T1003.006 (DCSync). ... ты прикидываешься вторым контроллером домена и запрашиваешь у настоящего DC репликацию учётных данных через протокол MS-DRSR.
Background This was a nifty little room that stressed basic enumeration, eleciting NTLMv2 authentication attempts, enumeration with BloodHound, and abusing msds-AllowedToDelegateTo... BloodHound immediately found a path from svc.scanner to the DC
They can also use BloodHound/SharpHound to enumerate Active Directory, abuse Kerberoastable service accounts, or exploit trust relationships between VMware-hosted systems and the broader domain.
In BOFHound output mode, all attributes for every object are parsed and outputted to BOFHound format... Computers collection
“ENDPOINT_ENUMERATION alerts” and “SAMR enumeration across many different endpoints, including Finance, HR, factory and POS systems.”
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
For target finding, I recommend using AzureHound, the Azure component to BloodHound.
System Networks Connections Discovery [T1049]: A common tool used for this network enumeration tactic is Bloodhound.
Énumération du domaine AD (droits utilisateur) via le collecteur BloodHound de NetExec.
Discovery (e.g. BloodHound) ... T1069.001, T1069.002 Enumeration of local administrators
Discovery (e.g. BloodHound) T1087.001, T1087.002, T1106, T1069.001, T1069.002
T1069.003: Permission Groups Discovery: Cloud Groups Once threat actors know the identities within the target environment, they need to understand the relationships between the identities by discovering permission structures... For Permissions Groups Discovery: Cloud Accounts, AzureHound has the following capabilities: list groups list roles list group-members list group-owners list role-assignments list app-role-assignments list key-vault-access-policies list management-group-role-assignments list resource-group-role-assignments list subscription-role-assignments list virtual-machine-role-assignments
Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI...
After gaining access to networks, the threat actors used BloodHound to map the Active Directory.
"BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory or Azure environment. Attackers can use BloodHound to easily identify highly complex attack paths"
Discovery (e.g. BloodHound) T1087.001, T1087.002, T1106, T1069.001, T1069.002
BloodHound, CertiHound (ESC1–ESC17), PrivHound for AD attack-path mapping and privilege path discovery.
“ROADrecon's gather command uses aiohttp by default and walks every directory object type” and produces “Bulk enumeration across every object type ROADrecon knows.”
Vice Society has been seen using the attack path reconnaissance tool Bloodhound during the initial stages of their attack before ransomware is deployed.
T1580: Cloud Infrastructure Discovery To fully grasp the architecture of the target environment, a threat actor must discover the foundational infrastructure components... For Cloud Infrastructure Discovery, AzureHound has the following capabilities: list tenants list subscriptions list resource-groups list management-groups list virtual-machines list key-vaults
“It also collected ... Group Policy exports.”
“subsequently pivoting through Active Directory environments” and “discover lateral movement vectors.”
Attackers can deploy tools within systems to aid in lateral movement. This includes tools such as PsExec, Bloodhound, and AdFind.
“Confluence and SharePoint hold the narrative layer about runbooks, deployment guides, network diagrams, vendor contacts, and ‘how we do X’ pages... This is where you learn what to attack next and why.”
The data collected by BloodHound was then compiled into several .json files ... These files were subsequently compressed into a BloodHound.zip archive.
BYOT (Bring Your Own Tools) We are astonished by the number of tools brought into an intrusion.
Oracle CSV spooling to /tmp followed by exfiltration; TFTP pull-based retrieval of network-device configurations; compressed 407 MB BloodHound Active Directory dataset exfiltration.
77 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.