6.2.8 Enumerate using BloodHound and validate relationships
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A supported collector, compatible BloodHound deployment and a known collection identity. Mark only the identities and capabilities actually controlled.
Where to look: Begin with directory relationships, then inspect the controlled principal's memberships and outbound control. Collect targeted local-group/session facts only where needed. For a chosen path, inspect each edge's object, source, age and missing prerequisite.
Expected behavior / secure boundary: A graph contains potential relationships, including stale, inferred or incompletely collected edges. A missing edge can reflect collection gaps. DCOnly avoids host collection; it is not a complete host/session survey.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.2.8.1 Baseline directory-only collection
Run: Windows with compatible SharpHound CE. Requires: Domain DNS, authenticated directory context and compatible BloodHound ingestion. Effect: Collects directory relationships; DCOnly does not collect live workstation sessions.
.\SharpHound.exe --CollectionMethods DCOnly --OutputDirectory .\bh --ZipFileName domain-dconly.zip
6.2.8.2 Targeted host-group and session collection
Run: Windows with compatible SharpHound CE. Requires: Explicit candidate-host file; required host connectivity and collection rights. Effect: Queries selected hosts; session collection loops and creates network activity.
.\SharpHound.exe --CollectionMethods LocalGroup --ComputerFile .\candidate-hosts.txt --OutputDirectory .\bh --ZipFileName candidate-localgroups.zip
.\SharpHound.exe --CollectionMethods Session --ComputerFile .\candidate-hosts.txt --Loop --LoopDuration 00:10:00 --OutputDirectory .\bh --ZipFileName candidate-sessions.zip
What this checks: The first command collects directory data. The next commands add selected-host group/session evidence. Choose the source matching the deployment; legacy and current collectors are not interchangeable.
6.2.8.3 Interpret the output
Raw/view evidence first. These are synthetic, abbreviated tool or graph-view excerpts. Graph relationship rows are a representative view, not collector console output. Version-specific wording and spacing can differ. The normalized observations below are a separate interpretation.
6.2.8.3.1 Expected — raw evidence
Command/view: Directory-only collection choice and graph results
CollectionMethods: DCOnly
Directory membership/ACL relationships: collected
Live workstation sessions: not part of this collection
Decisive clue: DCOnly collection scope.
Supported: Directory relationships can be analyzed; no workstation session survey is implied.
Still missing: A missing HasSession edge is not evidence of no logged-on users.
Next check: §6.2.7.1 — Enumerate and interpret sessions
6.2.8.3.2 Interesting — raw evidence
Command/view: Graph relationship inspection, representative exported view
analyst --MemberOf--> Support
Support --AddMember--> Helpdesk
Helpdesk --AdminTo--> APP01
Decisive clue: A possible identity-to-group-to-host chain.
Supported: This is a path hypothesis composed of different relationship types.
Still missing: Validate current membership, effective group-write permission, resulting host right, route and compatible service.
Next check: §6.2.5.1 — Enumerate and validate effective object permissions
6.2.8.3.3 Failed / inconclusive — raw evidence
Command/view: Host/session collection summary, representative view
APP01: session collection denied
Session edges returned: 0
Directory import: completed
Decisive clue: The host-derived session operation was denied.
Supported: Directory ingestion succeeded while the session evidence is incomplete.
Still missing: Collection permissions and freshness need validation; importing the ZIP did not repair host-query access.
Next check: §6.2.7.1 — Enumerate and interpret sessions
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
analyst --MemberOf--> Support
Support --AddMember--> Helpdesk
Helpdesk --AdminTo--> APP01
APP01 --HasSession--> admin_ops
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| MemberOf / AddMember | A possible identity-to-group transition. | Validate current membership and exact effective group right. | §6.2.5.1 — Enumerate and validate effective object permissions |
| AdminTo APP01 | A host-control candidate. | Validate current host rights, reachable service and token context. | §6.2.6.1 — Validate host-specific access rights |
| HasSession admin_ops | A volatile lead beyond host control. | Recheck freshness and credential-source prerequisites; no automatic Domain Admin compromise. | §6.2.7.1 — Enumerate and interpret sessions |
Stop when: One candidate path has each required edge classified and its next manual check chosen.
Revisit only when: Collection scope, identity, host rights or session freshness changes.
6.2.8.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | The selected directory-object control edge is effective and useful: choose its permission-backed transition. Host and session edges use their interpretation rows above. | §6.3.7.1 — Choose a permission-backed identity transition |
| Ruled out in this context | One edge is disproven: reject that chain and rank another evidence-backed lead. | §6.2.8.1 — Enumerate using BloodHound and validate relationships |
| Inconclusive / failed check | Host/session data was not collected: collect narrowly or validate manually. | §6.2.8.1 — Enumerate using BloodHound and validate relationships |
6.2.8.5 Tooling and complete procedure
SharpHound CE plus compatible BloodHound CE. Domain DNS and directory connectivity are required; targeted host collection also needs host connectivity/rights. Use --help for the actual installed collector. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.