XUTS LABS
Back to Red Team Playbooks
Active DirectoryRed Team Playbook

BloodHound Collection

Collect AD graph data after credentials are available and scope permits collection.

BloodHoundGraphACL

Purpose

Create graph evidence for privilege path analysis without over-collecting by default.

Inputs

  • - DOMAIN
  • - DC_IP
  • - username/password
  • - collection methods

Prerequisites

  • - Valid domain account
  • - Domain/DC context
  • - BloodHound or compatible importer
  • - Collection permission

Operator Assumptions

  • - Start with narrower collections on fragile networks.
  • - Keep JSON output as evidence.

Commands

Python collector

Kali
bloodhound-python -u user -p 'Password' -d DOMAIN -dc DC_IP -c DCOnly,ObjectProps,ACL,Session

Why: Collect core domain graph data from Linux.

Expected: BloodHound JSON files.

SharpHound

Windows host
SharpHound.exe -c DCOnly,ObjectProps,ACL,Session -d DOMAIN

Why: Collect from a Windows context when approved.

Expected: Zipped JSON collection.

Decision Points

  • - If no credentials exist, do not collect.
  • - If collection is too noisy, reduce methods.
  • - If path exists, validate each edge before action.

Follow-On Actions

  • - Attack-path triage
  • - Finding validation
  • - Report evidence mapping

Evidence To Capture

  • - Collection command
  • - JSON/zip artifact
  • - BloodHound queries/screenshots
  • - Validated path notes

Common Failures

  • - DNS failures
  • - Clock skew
  • - Insufficient rights for session collection

Operational Cautions

  • - Session collection can be noisy.
  • - Graph edges are hypotheses until validated.

Related Content

BloodHound CollectionAsk EXO