skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

bloodhound

Analyze Active Directory attack paths via BloodHound and Neo4j queries.

11|1|Updated May 4, 2026
Search Tags:#neo4j#active-directory#cypher#red-teaming#bloodhound#attack-path#ad-security
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill bloodhound-dreadnode
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bloodhound
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/bloodhound/skills/bloodhound
Command: npx skills add https://github.com/dreadnode/capabilities --skill bloodhound-dreadnode

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manually mapping Active Directory attack paths, identifying privilege escalation routes, and assessing domain security posture is extremely time-consuming and error-prone in large enterprise environments with thousands of objects and complex trust relationships.

Core Features & Use Cases

  • Graph Database Access: Connect to BloodHound CE and Neo4j instances to query the full Active Directory graph data.
  • Pre-built Attack Path Queries: Run standard queries for common analysis tasks including finding domain admins, Kerberoastable users, unconstrained delegation paths, and vulnerable ADCS templates.
  • Custom Query Support: Execute arbitrary Cypher queries for specialized analysis not covered by the pre-built catalog.
  • Reference Documentation: Access built-in guides for edge abuse steps, OPSEC notes, and node properties to interpret query results correctly.
  • Use Case: A red teamer can use this skill to quickly identify the shortest path from a compromised low-privilege user to domain admin, while a security administrator can use it to audit AD hygiene and find high-risk misconfigurations like computers with SMB signing disabled or WebClient enabled.

Quick Start

Use the bloodhound skill to analyze Active Directory attack paths and domain security posture for your target environment after authenticating to your BloodHound and Neo4j instances.

Frequently Asked Questions about bloodhound

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze Active Directory attack paths to find privilege escalation routes?▼

You can analyze Active Directory attack paths and identify privilege escalation routes by authenticating to BloodHound CE and Neo4j, then executing pre-built standard queries or custom Cypher queries against the graph database.

Can I run custom Cypher queries to map AD security posture in BloodHound?▼

Yes, you can run custom Cypher queries for specialized Active Directory security analysis not covered by pre-built catalogs, allowing you to map complex domain security postures and identify specific misconfigurations.

What standard queries are available for finding domain admins and Kerberoastable users?▼

The skill provides pre-built attack path queries for common red teaming tasks including finding domain admins, Kerberoastable users, unconstrained delegation paths, and vulnerable ADCS templates.

Do I need a Neo4j instance to map AD attack paths with BloodHound?▼

Yes, you need to authenticate to BloodHound CE and a Neo4j instance to query the full Active Directory graph data and identify high-risk misconfigurations or paths to high-value targets.

How do I interpret BloodHound edge abuse steps and node properties during a red team engagement?▼

You can access built-in reference documentation for edge abuse steps, OPSEC notes, and node properties to correctly interpret query results and execute attack path analysis during red teaming operations.

What is the best way to audit Active Directory hygiene for high-risk misconfigurations like disabled SMB signing?▼

Auditing Active Directory hygiene for high-risk misconfigurations like disabled SMB signing or enabled WebClient is best done by running targeted graph database queries to assess domain security posture and identify vulnerable objects.

Related Skills

Explore More Data & Analytics Skills→
trilwutrilwu
109

attacking-active-directory

Automate Active Directory security assessments with Kerberoasting, credential dumping, and BloodHound analysis.

Community
Advanced
florianbuetowflorianbuetow
12

report

Generate security reports from scanner findings in Markdown, HTML, JSON, and SARIF formats.

Community
Advanced
AeonDaveAeonDave
15

bloodhound

Map Active Directory attack paths and identify privilege escalation opportunities.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

ad-bloodhound-review

Analyze offline Active Directory graph data for privilege escalation paths and delegation risks.

Community
Advanced