BloodHoundTool
BloodHound is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.From MITRE ATT&CK
Last reported 3 days ago, by Help Net Security15 reports
ATT&CK techniques
6 of 44 · each with the sentence it comes from- T1003.006DCSync
“When you request both together, you're essentially asking for exactly what you need to target accounts for DCSync attacks.”
- T1110Brute Force
“Recon and brute-force token usage leave a tail of 403s and 404s as tools walk endpoints they don't have permission for, ask for object IDs they don't have, or use a client ID unauthorized for AAD Graph.”
- T1110.004Credential Stuffing
“At least 29 of 3,158 cyberattacks reported by the ITRC last year involved “credential stuffing” attacks using compromised logins and passwords, attacks that could have been prevented with MFA or passkeys.”
- T1558.003Kerberoasting
“That's Kerberoasting prep right there.”
- T1684Social Engineering
“Almost 2 in 5 (38%) IT professionals say AI-powered social engineering is the biggest unanticipated risk to their organization this year, and 42% believe AI-powered attacks will be the biggest game-changer in cybercrime over the next five years.”
- T1003.001LSASS Memory
“LSASS Memory - T1003.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
15 reports, newest first · the exact sentence from each-
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June“…est also tracked exploitation by several threat groups, including the Qilin and Settra ransomware operations, and found Cobalt Strike, BloodHound and SharpHound in the related activity.”
-
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups“…are groups are actively exploiting the flaw, with observed accompanying deployment of offensive security tools, such as Cobalt Strike, BloodHound and SharpHound.”
-
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use“…d RustHound, a cross-platform Rust-based tool used to collect Active Directory (AD) information required for attack path analysis with BloodHound; exploit code targeting CVE-2025-2479, a SQL injection vulnerability that can allow unauthorized manipulation of databases; the advers…”
-
Threat Actors Abuse Cursor Agent AI to Assist Ransomware Operations“This included enumerating the domain to report which privileges a supplied user holds, using NetExec’s BloodHound collector and scanning the internal subnets for hosts with Nmap or NetExec.”
-
Ransomware is the Scoreboard“BloodHound and the defensive graph concept debuted over a decade ago and still maintain a vibrant open-source community.”
-
AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration“For years, defenders have relied on identifying the signatures and behaviors of off-the-shelf offensive tooling, like BloodHound, PowerSploit, or Cobalt Strike.”
-
From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never Will“The rest of this series covers the authenticated side: how BloodHound, PowerView, and SOAPHound query the directory, what Event 1644 sees, when it doesn't fire, and how to detect low-and-slow enumeration that stays below every threshold.”
-
Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap“…eceives traffic from user-agent strings matching offensive tooling families (Python, aiohttp, curl, Go-http-client, axios, AzureHound, BloodHound, AADIntenals, etc.).”
-
dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025“Someone comfortable with BloodHound, Certipy, and bloodyAD could pull it off.”
-
The 60ms Window: How Event 5156 Solves the ADWS Attribution Problem“…ost on the ADWS blind spot (originally scoped to be part 6, but now Part 5A), I observed an interesting conversation take place in the BloodHound Slack #red-team channel.”
-
The ADWS Architecture That Hides PowerShell AD Enumeration“BloodHound does.”
-
SDFlags“The "aha!" moment: This is how BloodHound works”
-
The OID Problem: Writing LDAP Detections That Actually Work“This approach works for any LDAP-based reconnaissance tool—BloodHound collectors, custom PowerShell scripts, commercial pen testing tools, whatever.”
-
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs“sh.exe also wrote the following files, indicative of BloodHound/SharpHound execution.”
-
141 Key Cybersecurity Statistics for 2026 and Beyond“Hacking tools like Cobalt Strike and BloodHound were used more often against government entities than other industries.”
Indicators in its reports
named in the reports above- delete[.]mein 1 report
- hxxps://cwe.mitre[.]org/data/definitions/427.htmlin 1 report
- 45.141.87[.]55in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.