Plain English first

Active Directory is a huge web of "who can do what to whom": this person is in that group, that group can manage those accounts, this server lets those people log in, an administrator is logged on over there. Each fact on its own is mundane. An attack path is a chain of those facts that leads from an ordinary account to control of the whole domain.

People and spreadsheets review those facts one at a time. Attackers follow them like routes on a map. Tools such as BloodHound draw the map automatically: every object becomes a dot (a node), every abusable relationship becomes an arrow (an edge), and the computer finds the routes.

The same map works for defenders. Instead of fixing thousands of individual permissions, you find the few Fix: shared links that most routes pass through and cut those.

The analogy: a subway map of trust

Why it matters now

If you remember only 5 things

Thirteen ideas, from "what is a graph" to managing paths continuously. Open "Go deeper" for expert detail.

Step through how the graph gets built, two classic attack paths, and the defender's choke-point cut. Verify: Each attack step names the defense that breaks it.

The main edge families

Ways to see the graph

The data model

BloodHound stores a directed property graph: nodes with types and properties (name, Security Identifier (SID), enabled, last logon, admincount, Tier Zero membership), and typed edges between them. Pathfinding is a graph search over edge types that are marked traversable. Some edges are collected directly (an Access Control Entry (ACE), a membership); others are post-processed, derived after ingest from combinations of data, such as Active Directory Certificate Services (AD CS) escalation edges built from template, Certificate Authority (CA) and enrollment data.

Nodes are keyed on SID or object Globally Unique Identifier (GUID), so renames don't break history, and data from several collections merges into one graph.

How collection works

1. Directory (LDAP). Users, groups, computers, Organizational Units (OUs), Group Policy Objects (GPOs), containers, domains, trusts, AD CS objects, and each object's nTSecurityDescriptor. Readable by any authenticated user by default, apart from a few protected attributes (Local Administrator Password Solution (LAPS) passwords, for example).
2. Hosts (Server Message Block (SMB)/Remote Procedure Call (RPC)). For each reachable computer: sessions (NetSessionEnum, NetWkstaUserEnum, Remote Registry) and local group membership over Security Account Manager Remote protocol (SAMR) or Local Security Authority (LSA) calls. Windows 10 1607 and Server 2016 onward Risk: restrict remote SAMR to administrators, and newer releases restrict session enumeration too, so a low-privilege collector sees far less here.
3. Ingest and post-processing. The collector writes JavaScript Object Notation (JSON) files (usually zipped). BloodHound ingests them, then computes derived edges and zone membership.

Collection methods matter for noise and completeness:

Edges in detail: the ones that come up most

• MemberOf. Free to traverse. The built-in operator groups (Account, Server, Backup, Print Operators) are Risk: effectively Tier 0; check their membership first.
• AdminTo and HasSession. The credential-theft pair. AdminTo comes from local Administrators membership (directly, by group, or by GPO-applied Restricted Groups). HasSession points from computer to user.
• ForceChangePassword. Reset without knowing the old password. Effective but loud, and it locks the real user out, so testers often prefer quieter edges and many engagements forbid resets on live accounts.
• GenericWrite. On a user: set an Service Principal Name (SPN) (targeted Kerberoasting) or add a key credential (shadow credentials). On a computer: set Resource-Based Constrained Delegation (RBCD). On a group: change membership.
• WriteDacl, WriteOwner, Owns. Permission-on-permission. Risk: Any of these is full control one step later.
• AllExtendedRights. Includes reset password and, on the domain object, the replication rights behind DCSync.
• GPLink plus GPO write. Code execution on every computer in scope at next policy refresh.
• CoerceToTGT and delegation edges. Hosts trusted for unconstrained delegation can capture a coerced Ticket Granting Ticket (TGT); AllowedToAct is RBCD (see Kerberos Part 3).
• AD CS edges. Built in post-processing from templates, CAs, the NTAuth store and enrollment rights. Often Risk: the shortest path in the whole graph.

AdminSDHolder and what it does (and doesn't) protect

Every hour, the SDProp process copies the ACL of the AdminSDHolder object onto members of built-in protected groups (Domain Admins, Enterprise Admins, Administrators, the operator groups and a few more) and sets admincount=1. That wipes stray ACEs on those accounts. It does not cover custom privileged groups, and admincount=1 lingers on accounts removed from protected groups, leaving them with odd, non-inheriting ACLs. If AdminSDHolder's own ACL is modified, Risk: the change propagates to every protected account, a known persistence technique.

Querying the graph

The Graphical User Interface (GUI) covers the common questions (shortest paths, inbound to Tier Zero, outbound from an owned node), and BloodHound Community Edition (CE) ships a library of pre-built searches. For anything custom, use Cypher, the graph query language. Typical defensive questions:

// Every principal holding DCSync; anything that isn't a DC or an approved sync account is a finding
MATCH (n)-[:DCSync]->(d:Domain)
RETURN n.name, d.name

// Shortest paths from Domain Users (RID 513) to Domain Admins (RID 512)
MATCH p=shortestPath((g:Group)-[*1..]->(t:Group))
WHERE g.objectid ENDS WITH '-513' AND t.objectid ENDS WITH '-512'
RETURN p

Common misconceptions

Troubleshooting a graph

• Few or no sessions: the collector lacked admin rights, hosts were unreachable (firewall, offline laptops), or session enumeration is restricted. Re-run with a privileged account from a well-connected host, and loop session collection.
• Paths that don't work when tested: stale session, a deny ACE, GPO security filtering, or a control the graph doesn't model (logon restrictions, authentication silos, Endpoint Detection and Response (EDR)). Verify: Record why, and treat it as a data-quality note rather than a mistake.
• Huge, unreadable path counts: group by shared edge and look at choke points; filter out paths through Tier Zero nodes themselves.
• Missing AD CS edges: confirm the collector version supports AD CS collection and that CA and template objects were readable.
• Old queries failing: zone labels and some edge names changed between releases; use the current schema.

Each technique below is covered at the level needed to recognise it, test for it and explain it: prerequisites, what makes an environment vulnerable, the evidence it leaves, and how it reads as a finding. Tools are named so you can build detections and a lab. Exploit steps for each edge are deliberately left out; the BloodHound documentation's per-edge abuse notes and an authorised lab (for example, a deliberately vulnerable Active Directory (AD) range) are the place for hands-on practice.

# Recognise these in command lines and process telemetry
SharpHound.exe -c All            # all collection methods
SharpHound.exe -c DCOnly         # LDAP-only, no host contact (quieter)
SharpHound.exe -c Session --loop # repeated session collection

How a graph-driven engagement usually runs

1. Foothold and collection: an assumed-breach or phished account collects the directory, often DCOnly first for low noise.
2. Mark owned, ask questions: shortest paths from owned principals to Tier Zero, plus Risk: inbound edges from Domain Users and Authenticated Users.
3. Choose a realistic path: prefer quiet, reliable hops (Access Control List (ACL) edges, Active Directory Certificate Services (AD CS)) over noisy ones (password resets, Local Security Authority Subsystem Service (LSASS) access on EDR-heavy hosts).
4. Validate hop by hop, gathering evidence for the report and Verify: noting which alerts fired.
5. Report by root cause: group the paths found by the choke points they share, and lead with the validated one.

The strategy: define Tier 0 honestly, collect with privilege on a schedule, Fix: cut the choke points with the most exposure, keep Tier 0 credentials off lower tiers, and alert when a new edge into Tier 0 appears.

Quick wins (days)

1. Run your own privileged collection and look at inbound paths to Tier Zero. Verify: Start from Domain Users, Authenticated Users and Everyone, since edges from them affect everyone.

   SharpHound.exe -c All --domain corp.example

2. Review the built-in operator groups (Account, Server, Backup, Print Operators) and Fix: empty them unless there's a documented need.

   'Account Operators','Server Operators','Backup Operators','Print Operators' |
     ForEach-Object { Get-ADGroupMember $_ -Recursive | Select @{n='Group';e={$_}},Name }

3. Remove Access Control Entrys (ACEs) granted to broad groups on users, groups, Organizational Units (OUs), Group Policy Objects (GPOs) and the domain object. Fix: Domain Users should hold no write rights on anything privileged.

   # Example: list explicit ACEs on an OU for review
   (Get-Acl "AD:OU=Staff,DC=corp,DC=example").Access |
     Where-Object { -not $_.IsInherited } | Select IdentityReference,ActiveDirectoryRights,ObjectType

4. Find non-DC principals with replication rights and remove any that aren't approved sync accounts. Risk: Any extra DCSync holder is a domain-compromise path.
5. Deploy Windows Local Administrator Password Solution (LAPS) to Fix: break local-admin password reuse, and scope LAPS read rights by tier.
6. Fix the top choke point the analysis shows, usually a jump server, a helpdesk local-admin grant or a nested group. Verify: Re-collect and record the before-and-after exposure.

Longer-term fixes (weeks to months)

1. Define and enforce tiering. Separate admin accounts per tier; Fix: deny Tier 0 accounts logon to lower tiers by GPO (deny logon locally, through Remote Desktop Protocol (RDP), as a batch job or as a service); provide Privileged Access Workstations (PAWs).
2. Shrink Tier 0. Move Tier 0 users, groups and computers into a dedicated OU with its own tightly controlled Access Control List (ACL) and GPOs. Fix: Treat sync, backup, deployment and Certificate Authority (CA) servers as Tier 0 or remove their control edges.
3. Protect credentials in memory: Protected Users for admins, Credential Guard on endpoints and servers, Restricted Admin or Remote Credential Guard for RDP. These reduce what a session edge yields.
4. Fix Active Directory Certificate Services (AD CS): audit templates and CA permissions, remove requester-supplied subjects from authentication templates, and narrow enrollment.
5. Flatten group nesting and give privileged groups Fix: named, individual members only.
6. Adopt attack path management: a weekly privileged collection, a maintained Tier Zero zone, an exposure Key Performance Indicator (KPI), and Verify: alerts when exposure or Tier 0 membership changes.
7. Extend to hybrid: collect Entra with AzureHound, make cloud admins cloud-only accounts, and protect the Entra Connect server as Tier 0.

Detection signals

Verify the fix worked

1. Verify: Re-collect with a privileged account, from a host that can reach every subnet.
2. Re-run the same inbound-path queries and confirm the removed edges and paths are gone; Verify: record the exposure number.
3. Confirm Tier 0 accounts have no sessions on non-Tier-0 hosts across several looped collections.
4. Have testers retry the original path from a standard account and Verify: confirm the alerts above fire.
5. Check that SDProp and GPO refresh haven't reintroduced an edge a day later.

Why remediation stalls, and workable compromises

The risk in plain language

Our computer network keeps a record of who can do what: which staff can manage which accounts, which servers they can log in to, who is an administrator where. Over years, thousands of small, reasonable permissions accumulate. The risk is that Risk: they line up into a route from any employee's account to full control of the network. Attackers use free tools that find those routes automatically, in minutes, without needing any software vulnerability.

Business impact

• A single phished employee can become Risk: a full network compromise: the precondition for large-scale ransomware and data theft.
• Our access reviews can pass while Risk: the real number of people who can reach full control is hundreds or thousands.
• Routes often run through cloud links too, so on-premises compromise can Risk: reach email, files and cloud systems.

What drives likelihood

• Risk: How many accounts have a route to the most sensitive systems, and how short those routes are.
• Administrators logging on everywhere, leaving reusable credentials on everyday machines.
• Old permissions nobody reviews: grants from past projects, migrations and departed staff.
• No ongoing measurement, so new routes appear silently as the organisation changes.

Cost of inaction

The fixes are mostly staff time and configuration changes, not new products, and the biggest gains come from a few changes. Leaving the routes in place means any successful phishing email is Risk: one short, quiet step from a company-wide incident. Ransomware crews look for exactly this.

What good looks like

• A Fix: small, known set of systems and people can control the network, and it's written down.
• Administrators use Fix: separate accounts and dedicated machines for powerful work.
• The share of accounts with a route to full control is Verify: measured monthly and close to zero.
• New routes trigger an alert, and someone owns fixing them.

Questions executives ask

Presenting this finding to leadership

1. Headline: "Any employee's account had a three-step route to full control of the network; one change removes most of those routes."
2. Show the picture: one path diagram and one number (how many accounts can reach full control).
3. Explain the fix in business terms: remove one shared link this month, separate admin access this quarter.
4. The ask: a named owner, staff time for the changes, and Verify: a monthly exposure number reported to leadership.

Jargon decoder

Smart questions to ask

Sysadmins

• What is your written definition of Tier 0, and does it include sync, backup, deployment and Certificate Authority (CA) servers?
• When did someone last run a privileged BloodHound collection, and Verify: what was the exposure to Tier Zero?
• Can Domain Admins log on to workstations or member servers, or Fix: is that denied by policy?
• Who holds replication rights on the domain object besides the Domain Controllers (DCs)?
• Do you audit 5136 changes on Tier 0 objects, and Verify: who gets the alert?
• Is Local Administrator Password Solution (LAPS) deployed, and who can read LAPS passwords for Tier 0 servers?

Executives

• How many of our accounts can reach full control of the network today, and what's the target?
• Who owns keeping that number down?
• When we add a system or a team, who checks whether it creates a new route?

Coworkers

• Was collection privileged, or are session-based paths under-represented?
• Which path are we leading with, and Verify: did we validate every hop?
• What are the top choke points by exposure, so the report says "fix these three"?
• Are Active Directory Certificate Services (AD CS) and hybrid edges in scope and in the data?

Say this, not that

Same point, two audiences

What to learn next, in order

1. Active Directory Certificate Services (AD CS) abuse. The certificate escalation classes behind the ADCSESC edges are the largest single source of short paths, and deserve a note of their own.
2. Tiering and the enterprise access model. How to actually build Tier 0 boundaries: admin account separation, logon restrictions, Privileged Access Workstations (PAWs), and authentication policies and silos (Kerberos Part 3).
3. NT LAN Manager (NTLM) relay and coercion. The techniques that create edges at runtime (coerced authentication relayed into Lightweight Directory Access Protocol (LDAP) or AD CS), which the static graph models only partly.
4. Hybrid identity paths. Entra ID roles, Entra Connect, device management and AzureHound data, where on-premises and cloud graphs join.
5. Cypher for defenders. Enough of the query language to write your own exposure reports and change diffs.

Resources worth seeking out

• BloodHound documentation (SpecterOps): the edge reference pages explain each edge's meaning, abuse and opsec notes, and are the authoritative list of current edge names.
• The Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) entry for BloodHound (S0521) and the discovery techniques it maps to, for findings language.
• Microsoft's documentation on securing privileged access and the enterprise access model, for the tiering vocabulary clients' teams will recognise.
• A practice lab: a deliberately vulnerable Active Directory (AD) range (several open-source projects build one), so you can collect, find and remediate paths Verify: in an environment you're authorised to break.
• Conference talks by the BloodHound authors on attack path management and choke points, for the defender's framing.