# Sharphound

> Use for Active Directory graph collection during authorized pentests. Trigger on approved AD relationship mapping, privilege-path review, local admin exposure review, and generating focused data for BloodHound analysis.

- Skill: `timsonner/sharphound` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/sharphound`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/sharphound/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/sharphound

---


# SharpHound

## Purpose

Use this skill when the methodology needs focused AD graph collection for later path analysis, and the domain collection scope is explicitly approved.

## Phase Fit

- Primary: Threat Modeling and Test Planning, Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to map privilege relationships, session exposure, or local admin paths.
- Need to generate input for `bloodhound` analysis.
- Need a repeatable retest after AD path remediation.

## Avoid When

- Broad collection scope is not explicitly approved.
- The environment cannot tolerate the chosen collection mode.

## Inputs

- Approved domain and collection scope
- Authorized credential context if needed
- Output handling rules for collected graph data

## Procedure

1. Limit collection to the minimum methods needed for the question.
2. Record exact collection scope, host, and account context.
3. Analyze only the relationships that materially affect privilege or exposure.
4. Avoid presenting unvalidated graph theory as confirmed compromise.
5. Preserve the exact collection profile for retest.

## Command Syntax

Replace sample collection sets with the minimum approved scope.

```cmd
:: Collect all data methods
SharpHound.exe -c All

:: Session and local admin collection only
SharpHound.exe -c Session,LocalAdmin

:: Collect against a specific domain
SharpHound.exe -c All -d contoso.com

:: DC-only collection (faster, less noisy)
SharpHound.exe -c DCOnly --ldapusername auditor --ldappassword '<password>'

:: Output to a specific directory with custom zip name
SharpHound.exe -c All --outputdirectory C:\temp\bh\ --zipfilename contoso-bh.zip

:: Stealth collection (computer-targeted only)
SharpHound.exe -c ComputerOnly --stealth
```

## Evidence to Capture

- Material AD relationships and paths uncovered by the approved collection
- Exact collection scope and credential context used
- Output files needed for later analysis or retest

## Safety Boundaries

- Keep collection narrowly scoped and approved.
- Protect graph data as sensitive evidence.