# Bloodhound

> Use for Active Directory relationship analysis during authorized internal assessments. Trigger on AD path mapping, privilege chain review, delegated access analysis, and understanding how directory relationships affect attacker movement.

- Skill: `timsonner/bloodhound` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/bloodhound`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/bloodhound/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/bloodhound

---


# BloodHound

## Purpose

Use this skill to analyze Active Directory relationships and privilege paths after scope and collection boundaries are clearly defined.

## Phase Fit

- Primary: Threat Modeling and Test Planning, Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to understand privilege paths, delegation issues, or relationship-driven attack paths.
- Need to prioritize AD findings by practical movement potential.
- Need to retest whether a privilege path was removed.

## Avoid When

- Domain collection scope is not explicit.
- Broad collection would exceed the approved impact level.

## Inputs

- Approved domain, collectors, and credential context
- Narrow collection scope aligned to the current objective
- Evidence handling rules for AD graph data

## Procedure

1. Limit collection to the minimum scope needed for the question.
2. Review relationship paths that materially change privilege or data exposure.
3. Correlate graph findings with real hosts, groups, and business impact.
4. Avoid presenting theoretical paths as confirmed compromise.
5. Preserve the exact collection scope for retest.

## Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

```bash
# Collect all data using bloodhound-python (agentless, remote)
bloodhound-python -u auditor -p '<password>' -d contoso.com -c All -ns 10.10.10.10 -o contoso-bh/

# DC-only collection (faster, less noisy)
bloodhound-python -u auditor -p '<password>' -d contoso.com -c DCOnly -ns 10.10.10.10

# Pass-the-Hash collection
bloodhound-python -u auditor --hashes :<NTLM_hash> -d contoso.com -c All -ns 10.10.10.10

# Target a specific domain controller
bloodhound-python -u auditor -p '<password>' -d contoso.com -c All --dc dc01.contoso.com

# Launch GUI for analysis
bloodhound

# SharpHound collection from Windows (run on target)
# SharpHound.exe -c All -d contoso.com --outputdirectory C:\temp\bh\
```

## Evidence to Capture

- Material privilege paths and delegated access issues
- Nodes and relationships that create real risk
- Exact collection scope and credential context

## Safety Boundaries

- Keep collection narrow and approved.
- Treat graph relationships as analysis leads until validated against the environment.