domains / families / security / mapping-attack-paths-with-bloodhound-ce

mapping-attack-paths-with-bloodhound-ce

separate

Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths using built-in queries and custom Cypher. Use during authorized red-team or penetration-test engagements to map privilege-escalation chains toward domain/tenant compromise.

When to use

• During an authorized internal penetration test or red-team engagement after obtaining any domain foothold or Entra credentials
• When you need to prioritize escalation routes from owned principals to Tier-0 assets (Domain Admins, Global Administrator)
• When assessing hybrid identity risk where on-prem AD is synced to Entra ID
• During purple-team exercises to validate that detections fire on collection and on path-execution steps
• When producing attack-path evidence and remediation guidance for a defensive client

When not to use

• unauthorized use
• environments without explicit written authorization

Skill page

Source