T1087.002DiscoveryIntermediateDefense plan →

Active Directory Reconnaissance with BloodHound: Collection Behavior, Attack Path Analysis, and Defense

HARDEC · Savunma Güvenliği Ekibi·Published: June 13, 2026·Updated: July 15, 2026·13 min read

A comprehensive map of Active Directory reconnaissance with BloodHound/SharpHound: collection methods (Default, All, DCOnly, Session, LoggedOn, ACL, Trusts, Container), node/edge types and Cypher attack path queries, OpSec/noise assessment, LDAP 1644 + 5145-based detection, session enumeration hardening, and ACL hygiene. A technical reference for SOC/DFIR and red/purple teams.

Exploit

Prevention

Detection

Defense profile:6 detection rules 3 mitigations 6 baseline controls 3 response playbooks

Swipe or use the arrows to move between sections

Section 1 / 3

Zafiyet (Vulnerability)

Tehdit bağlamı, zafiyet ve istismar senaryosu

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 2 / 3

Prevention & Hardening

Savunma teknolojileri, policy ve sertleştirme

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 3 / 3

Detection

Davranış, loglama ve detection kuralları

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Information note

Defense note: Using BloodHound exclusively on the offensive side means missing a major opportunity; the same tool can be run periodically by the blue team to proactively identify dangerous ACL paths and misconfigured administrator sessions. The high LDAP query volume and session enumeration traffic produced by collectors provides a meaningful signal for anomaly detection systems. A common mistake: using BloodHound data only for a pentest report and then neglecting it, rather than incorporating it into a continuous cyclic audit process (MITRE ATT&CK T1069.002).

Detection rules

Directly copyable rules (Sigma/KQL/…) that detect this technique. Each rule specifies its required telemetry, maturity, and source.

AD Privileged Users or Groups Reconnaissance

Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

high

sigmaTest

Show ruleHide rule

title: AD Privileged Users or Groups Reconnaissance
id: 35ba1d85-724d-42a3-889f-2e2362bcaf23
status: test
description: Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs
references:
    - https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html
author: Samir Bousseaden
date: 2019-04-03
modified: 2022-07-13
tags:
    - attack.discovery
    - attack.t1087.002
logsource:
    product: windows
    service: security
    definition: 'Requirements: enable Object Access SAM on your Domain Controllers'
detection:
    selection:
        EventID: 4661
        ObjectType:
            - 'SAM_USER'
            - 'SAM_GROUP'
    selection_object:
        - ObjectName|endswith:
              - '-512'
              - '-502'
              - '-500'
              - '-505'
              - '-519'
              - '-520'
              - '-544'
              - '-551'
              - '-555'
        - ObjectName|contains: 'admin'
    filter:
        SubjectUserName|endswith: '$'
    condition: selection and selection_object and not filter
falsepositives:
    - If source account name is not an admin then its super suspicious
level: high

Not validated

Telemetry required to run: windows; securitywindows / securitywindows

False positive: If source account name is not an admin then its super suspicious

Source: SIGMA · Detection Rule License (DRL) 1.1 · original rule

Mitigations

Prevention and hardening measures that mitigate or block this technique.

Audit

Prevention

Advanced audit policy + command-line auditing + Sysmon + directory access auditing: the telemetry that detection requires.

Information note

Informational note: Default Windows audit policies are insufficient; critical events such as failed logons, sensitive privilege use, and object access require additional configuration. Process creation command-line records and network connection logs must be collected with Sysmon. On Linux, auditd default settings are extremely minimal and must be customized for security use cases. Since collection is impossible without log generation, audit policy configuration must be completed before SIEM integration.

Operating System Configuration

Hardening

Bringing the operating system to a secure baseline configuration.

Information note

Informational note: In operating system hardening, SELinux/AppArmor mandatory access controls, removal of unnecessary services, and SSH key-based authentication should be applied together for Linux. Shell history files and configuration files carrying the risk of containing passwords should be audited regularly. For Windows environments, a full audit policy, Sysmon deployment, and secure WinRM configuration constitute the baseline requirements. Passwordless sudo and ANY:ANY sudo policies must be removed for all accounts.

Baseline controls against this technique

The following security baseline controls mitigate this technique. Compare your organization's configuration against the relevant baseline by .

Response playbooks

NIST/SANS phase-based response workflows to follow when this technique is detected.

References

MITRE ATT&CK — T1087.002: Active Directory Reconnaissance with BloodHound: Collection Behavior, Attack Path Analysis, and Defense ↗

This article is based on the MITRE ATT&CK framework; the detection, defense, and response content was prepared independently.

title: SharpHound veya BloodHound Toplayici Sureci Tespit Edildi id: c5e9f4a1-73d2-4b8c-9e1a-7f3d5c2b4e89 status: experimental description: | BloodHound Active Directory guzergah analizi icin kullanilan SharpHound veya AzureHound toplayici surecinin calistirilmasini tespit eder. Bu araclar saldirganlar tarafindan domain hesaplarini, gruplarini, oturum bilgilerini ve ACL'leri toplu olarak sorgulamak (T1087.002) ve yuksek degerli saldiri yollarini bulmak icin kullanilir. Kural AI tarafindan uretilmis / dogrulanmamistir. references: - https://attack.mitre.org/techniques/T1087/002/ - https://github.com/BloodHoundAD/BloodHound - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bloodhound_sharphound_collector.yml - https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf author: CyberSecLab (AI) date: 2026-06-13 modified: 2026-06-13 tags: - attack.t1087.002 - attack.discovery - attack.t1069.002 logsource: product: windows category: process_creation detection: selection_image: Image|endswith: - '\SharpHound.exe' - '\AzureHound.exe' - '\SharpHound3.exe' selection_cmdline: CommandLine|contains: - 'SharpHound' - 'Invoke-BloodHound' - 'CollectionMethod' - '-c All' - '-c Default' - '-c Session' - '-c DCOnly' - '--Stealth' - 'SessionLoop' - '--ZipPassword' - '--EncryptZip' selection_renamed: CommandLine|contains: - '--CollectionMethods' - '--OutputDirectory' - '--Domain ' - '--LdapUsername' CommandLine|contains: - 'LDAP' filter_pentest: ParentImage|contains: - '\PenTest' - '\RedTeam' - '\Assessment' condition: (selection_image or selection_cmdline or selection_renamed) and not filter_pentest falsepositives: - Yetkilendirilmis sizma testi veya kirmizi takim tatbikatlari - BloodHound Community Edition guvenlik degerlendirme projeleri level: high

title: Active Directory Database Snapshot Via ADExplorer id: 9212f354-7775-4e28-9c9f-8f0a4544e664 related: - id: ef61af62-bc74-4f58-b49b-626448227652 type: derived status: test description: Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field. references: - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24 - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/ - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ - https://trustedsec.com/blog/adexplorer-on-engagements author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 modified: 2025-07-09 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.t1482 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - '\ADExp.exe' - '\ADExplorer.exe' - '\ADExplorer64.exe' - '\ADExplorer64a.exe' - OriginalFileName: 'AdExp' - Description: 'Active Directory Editor' - Product: 'Sysinternals ADExplorer' selection_cli: CommandLine|contains: 'snapshot' condition: all of selection_* falsepositives: - Unknown level: medium

title: ADExplorer Writing Complete AD Snapshot Into .dat File id: 0a1255c5-d732-4b62-ac02-b5152d34fb83 related: - id: 9212f354-7775-4e28-9c9f-8f0a4544e664 type: similar status: experimental description: Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field. references: - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24 - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/ - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ - https://trustedsec.com/blog/adexplorer-on-engagements author: Arnim Rupp (Nextron Systems), Thomas Patzke date: 2025-07-09 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.t1482 logsource: category: file_event product: windows detection: selection: Image|endswith: - '\ADExp.exe' - '\ADExplorer.exe' - '\ADExplorer64.exe' - '\ADExplorer64a.exe' TargetFilename|endswith: '.dat' condition: selection falsepositives: - Legitimate use of ADExplorer by administrators creating .dat snapshots level: medium

title: Supheceli LDAP Kitlesel Sorgu - Domain Hesap Kesfetme id: d2b8e5f3-46a1-4c7d-8b2e-9a5f1c3d7e04 status: experimental description: | Tek bir istemci surecinin kisa sure icerisinde cok sayida LDAP baglantisi kurmasini veya domain denetleyicisine cok sayida SMB/SAMR sorgusu gondermesini tespit eder. BloodHound/SharpHound domain hesap ve grup kesifleri (T1087.002) icin domain denetleyicisine yogun LDAP sorgusu gonderir. Bu desen NetBIOS/SAMR uzerinden 'net group /domain' veya 'dsquery' komutlariyla da olusabilir. Kural AI tarafindan uretilmis / dogrulanmamistir. references: - https://attack.mitre.org/techniques/T1087/002/ - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_ldap_recon.yml - https://github.com/BloodHoundAD/SharpHound - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Rohan%20Vazarkar/DEFCON-26-Rohan-Vazarkar-Hunting-for-Privilege-Escalation-in-Windows-Environment.pdf author: CyberSecLab (AI) date: 2026-06-13 modified: 2026-06-13 tags: - attack.t1087.002 - attack.discovery - attack.t1069.002 logsource: product: windows category: network_connection detection: selection_ldap: DestinationPort: - 389 - 636 - 3268 - 3269 Initiated: 'true' filter_legitimate: Image|endswith: - '\svchost.exe' - '\lsass.exe' - '\MsMpEng.exe' - '\dns.exe' - '\dfsr.exe' - '\dfsrs.exe' - '\mmc.exe' - '\AdExplorer.exe' - '\ldp.exe' filter_system_accounts: User|contains: - 'SYSTEM' - 'NETWORK SERVICE' - 'LOCAL SERVICE' condition: selection_ldap and not 1 of filter_* timeframe: 5m aggregation: type: count group-by: - Image - User - SourceIp condition: count(DestinationHostname) >= 15 falsepositives: - Sistem yonetim araclari (SCCM, Intune, AD yonetim konsolllari) - Domain denetleyicisi replikasyon surecleri - Merkezi kimlik dogrulama servisleri level: medium

Active Directory Reconnaissance with BloodHound: Collection Behavior, Attack Path Analysis, and Defense

Zafiyet (Vulnerability)

This section is not open yet

Prevention & Hardening

This section is not open yet

Detection

This section is not open yet

Detection rules

AD Privileged Users or Groups Reconnaissance

Mitigations

Audit

Operating System Configuration

Baseline controls against this technique

Response playbooks

References

SharpHound/BloodHound Process Detection

Active Directory Database Snapshot Via ADExplorer

Active Directory Structure Export Via Csvde.EXE

ADExplorer Writing Complete AD Snapshot Into .dat File

LDAP Bulk Domain Account Query (BloodHound Network Activity)

User Account Management

BloodHound / AD Discovery Combined with Credential Theft or Lateral Movement Response

AD CS Misconfiguration and Discovery Response

BloodHound / SharpHound AD Reconnaissance Response