Anthropic-Cybersecurity-Skills/skills/performing-active-directory-bloodhound-analysis/references/workflows.md

Workflows: BloodHound AD Analysis

BloodHound Analysis Workflow

┌─────────────────────────────────────────────────────────────────┐
│              BLOODHOUND ANALYSIS WORKFLOW                         │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  1. DATA COLLECTION                                              │
│     ├── Select collector (SharpHound/AzureHound)                 │
│     ├── Choose collection method                                 │
│     │   ├── All (comprehensive, noisy)                           │
│     │   ├── DCOnly (LDAP only, stealthier)                       │
│     │   ├── Session (user sessions on computers)                 │
│     │   └── ACL (permission relationships)                       │
│     ├── Execute collection                                       │
│     └── Exfiltrate ZIP to analysis workstation                   │
│                                                                  │
│  2. DATA IMPORT                                                  │
│     ├── Start BloodHound CE/Neo4j                                │
│     ├── Upload collection ZIP                                    │
│     ├── Verify node counts (Users, Computers, Groups)            │
│     └── Mark owned principals and high-value targets             │
│                                                                  │
│  3. INITIAL ANALYSIS                                             │
│     ├── Run pre-built analytics                                  │
│     │   ├── Find all Domain Admins                               │
│     │   ├── Find Kerberoastable accounts                         │
│     │   ├── Find AS-REP Roastable accounts                       │
│     │   ├── Find unconstrained delegation                        │
│     │   └── Find shortest paths to DA                            │
│     ├── Identify high-value targets                              │
│     └── Document initial findings                                │
│                                                                  │
│  4. ATTACK PATH IDENTIFICATION                                   │
│     ├── Mark owned nodes                                         │
│     ├── Shortest path from owned to DA                           │
│     ├── Analyze ACL abuse paths                                  │
│     │   ├── GenericAll / GenericWrite                             │
│     │   ├── WriteDACL / WriteOwner                               │
│     │   ├── ForceChangePassword                                  │
│     │   └── AddMember                                            │
│     ├── Analyze delegation abuse                                 │
│     ├── Analyze GPO abuse paths                                  │
│     └── Prioritize attack paths by feasibility                   │
│                                                                  │
│  5. EXPLOITATION                                                 │
│     ├── Execute selected attack path                             │
│     ├── Kerberoast service accounts                              │
│     ├── Abuse ACL misconfigurations                              │
│     ├── Leverage delegation settings                             │
│     └── Mark newly owned principals                              │
│                                                                  │
│  6. REPORTING                                                    │
│     ├── Export attack path screenshots                           │
│     ├── Document each hop in attack chain                        │
│     ├── Map to MITRE ATT&CK techniques                          │
│     ├── Provide remediation for each finding                     │
│     └── Generate AD hardening recommendations                    │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

SharpHound Collection Method Selection

Collection Method Decision
│
├── Need comprehensive data?
│   └── Use -c All (Collects everything)
│       Warning: Noisy, generates LDAP and SMB traffic
│
├── Need stealth?
│   └── Use -c DCOnly (Queries only DCs via LDAP)
│       Limitation: No session or local group data
│
├── Need session data over time?
│   └── Use -c Session --loop
│       Best for: Finding where admins are logged in
│
├── Azure AD environment?
│   └── Use AzureHound
│       Collects: Roles, App Registrations, Service Principals
│
└── Minimal footprint needed?
    └── Use -c Group,ACL
        Collects: Group memberships and ACL relationships only

Attack Path Exploitation Decision Tree

BloodHound Shows Path to DA
│
├── Path via Kerberoastable account?
│   ├── Request TGS ticket (Rubeus/GetUserSPNs)
│   ├── Crack with hashcat (-m 13100)
│   └── Use cracked credential to continue path
│
├── Path via ACL abuse?
│   ├── GenericAll on user? → ForceChangePassword
│   ├── GenericAll on group? → Add self to group
│   ├── WriteDACL? → Grant self GenericAll, then abuse
│   ├── WriteOwner? → Change owner, then modify DACL
│   └── AddMember? → Add self to privileged group
│
├── Path via delegation?
│   ├── Unconstrained? → Coerce DC auth + capture TGT
│   ├── Constrained? → S4U2Self + S4U2Proxy abuse
│   └── RBCD? → Configure msDS-AllowedToActOnBehalf
│
├── Path via GPO?
│   ├── GenericWrite on GPO? → Add scheduled task
│   └── GpLink control? → Link malicious GPO to OU
│
└── Path via session?
    ├── Admin on computer with DA session?
    ├── Dump LSASS for DA credentials
    └── Or steal token/ticket

BloodHound Edge Reference

Edge Type	Meaning	Abuse Method
MemberOf	Group membership	Inherit group permissions
AdminTo	Local admin rights	PsExec, WMI, WinRM
HasSession	User logged in	Credential theft
GenericAll	Full control	Reset password, modify object
GenericWrite	Write properties	Set SPN, modify attributes
WriteDacl	Modify permissions	Grant self full control
WriteOwner	Change owner	Take ownership then WriteDacl
ForceChangePassword	Reset password	Change user password
AddMember	Add to group	Add self to privileged group
AllowedToDelegate	Constrained delegation	S4U2Proxy abuse
AllowedToAct	RBCD	Resource-based constrained delegation
CanRDP	RDP access	Remote desktop connection
CanPSRemote	WinRM access	PowerShell remoting
ExecuteDCOM	DCOM execution	Remote code execution
GPLink	GPO linked to OU	Modify GPO for code execution