BloodHound — Install, Use, Optimise (2026)

Active Directory attack-path graph tool — finds the shortest path from a low-priv user to Domain Admin.

Installation

Pick the install method that matches your stack. The Docker option is the cleanest for one-off scans where you don’t want to pollute your workstation.

BloodHound CE (Docker)

curl -L https://ghst.ly/getbhce | docker compose -f - up

Legacy BH (deprecated)

sudo apt install bloodhound bloodhound-python neo4j

Collector (SharpHound)

Download SharpHound.exe from BloodHound CE releases

Core commands

The handful of invocations you’ll actually run on 90% of engagements:

Collect (Windows in-domain)

SharpHound.exe -c All --zipfilename collected.zip

Collect (Linux remote)

bloodhound-python -u user -p pass -d corp.local -ns 10.0.0.1 -c All

Stealthy collection

SharpHound.exe -c DCOnly,Trusts --stealth

Import to BloodHound CE

Drop ZIP into BH UI → File Ingest

Find shortest path to DA

In UI: "Shortest Paths to Domain Admins"

Custom Cypher query

MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN [email protected]"})) RETURN p

Performance optimisation

What separates a junior who runs the default invocation from a practitioner who knows the knobs:

• BloodHound CE (Community Edition, 2026) replaces legacy. New ingest format (BloodHound CE schema) — old Neo4j queries don’t map 1:1.
• Collection at scale: SharpHound’s --throttle 5000 --jitter 30 adds 5s delay ±30% — slips past basic SOC alerting.
• Mark owned nodes with :mark owned before pathfinding — drives realistic attack scenarios.
• For 100k+ user domains, run --zipfilename with -c DCOnly first (fast), then targeted -c LocalAdmin,Sessions (slow).
• Cypher queries: pre-load BloodHoundQueries + custom domain-specific queries to a saved-queries JSON.

Common pitfalls

Real failure modes that bite people on engagements. Most are recoverable; a few are reputation-damaging.

• SharpHound is detected by Defender/SentinelOne by default. Compile-from-source with renamed strings, or use bloodhound-python from Linux.
• -c All collects EVERYTHING — generates 50k+ LDAP queries. Splunk/QRadar will alert. Use stealth modes for active engagements.
• BloodHound CE’s default password is set on first launch — don’t expose port 8080 to internet. Tunnel via SSH.
• Stale data: Sessions collection is point-in-time. Re-run collection during active hours for accurate session-based paths.

Modern alternatives in 2026

The ecosystem moves fast. These are tools you should at least be aware of:

• PowerView — manual AD enumeration; slower but stealthier.
• SOAPHound — newer collector, less detected (uses ADWS).
• ADExplorer (Sysinternals) — read-only AD browse, GUI.

India context and engagement notes

Indian-context AD: most enterprise Active Directories in India are 5-15 years old, full of nested-group sprawl and stale service accounts. BloodHound finds DA paths in minutes on these. Always document the path in the report — defenders need to see “User → Group → Group → DCSync rights” to fix it.

⚖️ Legal: Use only on systems you own or have explicit written authorisation to test. In India, unauthorised access is punishable under Section 66 of the IT Act, 2000 (up to 3 years imprisonment + fine). Pair every engagement with a signed Statement of Work or Rules of Engagement before running anything from this page.