skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-active-directory-bloodhound-analysis

Enumerate Active Directory relationships and attack paths using BloodHound and SharpHound graph analysis.

954|172|Updated Mar 13, 2026
Search Tags:#privilege-escalation#Active-Directory#red-teaming#bloodhound#ad-enumeration#attack-path#sharpHound
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-active-directory-bloodhound-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-active-directory-bloodhound-analysis
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/red-teaming/performing-active-directory-bloodhound-analysis
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-active-directory-bloodhound-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Active Directory environments hide privilege escalation paths across group memberships, ACLs, delegations, and trust relationships that manual review cannot surface. This Skill guides the collection of AD data with SharpHound and the analysis of that data in BloodHound to reveal concrete attack paths from a compromised user to Domain Admin.

Core Features & Use Cases

  • Data Collection: Run SharpHound, Invoke-BloodHound, or AzureHound with the right collection flags, including looped session collection and ADCS certificate data that default runs miss.
  • Attack Path Analysis: Use pre-built and custom Cypher queries to find Kerberoastable users, DCSync rights, unconstrained delegation, ACL abuse chains, and shortest paths to Domain Admin.
  • Remediation Guidance: Map each finding type (Kerberoasting, delegation abuse, excessive ACLs) to concrete remediation steps.
  • Use Case: During an authorized internal pentest, you have a foothold as a low-privilege domain user. Use this Skill to collect full AD data, import it into BloodHound CE, mark your user as owned, and identify a Kerberoastable service account path leading to Domain Admin.

Quick Start

Ask the AI to walk you through collecting Active Directory data with SharpHound and finding the shortest attack path to Domain Admin in BloodHound.

Frequently Asked Questions about performing-active-directory-bloodhound-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I collect Active Directory data for BloodHound?▼

Run SharpHound.exe with the -c All flag to collect users, groups, computers, sessions, ACLs, trusts, and GPOs into a ZIP file. For session coverage over time, use -c Session --loop --loopduration 02:00:00, then import the ZIP into BloodHound.

How do I find attack paths to Domain Admin with BloodHound?▼

Mark your compromised user as Owned in the BloodHound GUI, then run a shortestPath Cypher query from owned users to the Domain Admins group. Pre-built queries also surface Kerberoastable users, DCSync rights, and unconstrained delegation paths.

What is the difference between BloodHound CE and BloodHound Legacy?▼

BloodHound CE (v5+) runs via Docker with a PostgreSQL backend and a web interface on port 8080. BloodHound Legacy 4.x uses a Neo4j database and a desktop GUI where you drag and drop the SharpHound ZIP file.

Why does BloodHound show no attack path in a vulnerable domain?▼

Missing paths usually result from incomplete collection: running -c Default instead of -c All drops ACL, session, and ADCS edges. Confirm looped session collection ran, certificate data was imported, your foothold user is marked Owned, and cross-domain trust edges were checked.

Can BloodHound enumerate Azure AD environments?▼

Yes, AzureHound collects Azure AD data using a tenant ID and refresh token, outputting JSON for import into BloodHound. This covers cloud-only relationships that on-premises SharpHound collection does not capture.

Related Skills

Explore More Software Engineering Skills→
Kisilev13Kisilev13

okta-attack

Identify and exploit vulnerabilities in Okta-based IAM systems.

Community
Advanced
noname300989noname300989

ad-offensive

Orchestrate Active Directory offensive security operations with BloodHound, Impacket, and CrackMapExec.

Community
Advanced
Amazon-QuickAmazon-Quick
47

vulnerability-report-summarizer

Parse vulnerability scan data, deduplicate findings, and score risk with CVSS.

Official
Advanced
brucesongsbrucesongs
60

ad-ldap-attack

Enumerate Active Directory LDAP environments to reveal users, groups, SPNs, and credential artifacts.

Community
Advanced