security enabled verified medium v1.0.0

sharphound

BloodHound data collector written in C# that enumerates Active Directory relationships, ACLs, group memberships, and session information for attack path analysis.

📋 Live Preview 
SharpHound.exe {flags}
📎 flags 
SharpHound.exe {flags}

Sandbox: execFile · Timeout: 600s

Capabilities

security.ad.enum.domain
security.ad.enum.users
security.ad.enum.groups
security.ad.enum.computers
security.ad.enum.sessions
security.ad.enum.acl
security.ad.graph

Parameters

Name Type Required Default Description Aliases
CollectionMethod string No - Data collection method (Default, Group, LocalGroup, RDP, DCOnly, All) -c, --CollectionMethod
Domain string No - Target domain -d, --Domain
LdapUsername string No - LDAP bind username -u, --Username
LdapPassword string No - LDAP bind password -p, --Password
SearchBase string No - LDAP search base DN -sb, --SearchBase
Stealth boolean No - Use stealth collection mode -s, --Stealth
ZipFilename string No - Output zip file name -z, --ZipFilename
flag-json boolean No - Output as JSON (not zip) -j, --json

Artifacts

TypeDescriptionMIMESchemaTrust
security.ad.graphBloodHound JSON data filesapplication/json-verified

Contract

Inputs

network.target.ip

Domain controller IP address

credential.username

Domain username

credential.password

Password or NTLM hash

domain.name

Target domain name

Outputs

security.ad.graph

Collected AD relationship data as JSON

Side effects: network_trafficfilesystem_write

Workflow Edges

Produces

security.ad.graph

Consumes

network.target.ipcredential.usernamecredential.passworddomain.name

Resource Profile

ResourceValue
CPUlow
Memory256 MB
Networkmedium
Disk I/Olow

Examples

Run all collection methods

SharpHound.exe -c All -d example.com

Run with credentials

SharpHound.exe -c All -d example.com -u USER -p PASS

Stealth collection

SharpHound.exe -c Default,Group -d example.com --Stealth

Collect only from domain controller

SharpHound.exe -c DCOnly -d example.com

Documentation

SharpHound — BloodHound AD Data Collector

SharpHound is the official C# data collector for BloodHound that enumerates Active Directory environments, collecting information about users, groups, computers, sessions, ACLs, and trust relationships for attack path analysis.

Collection Methods

Method Data Collected
Default Groups, sessions, local groups
Group Group membership only (fast)
LocalGroup Local admin rights enumeration
RDP Remote Desktop users
DCOnly Domain controller queries only
All Everything (slowest, most complete)

Usage

# Transfer SharpHound.exe to target
# Run collection
SharpHound.exe -c All -d domain.local

# Transfer resulting ZIP to BloodHound
# Import ZIP file in BloodHound GUI

Related Tools

bloodhoundcertipyimpacketnetexec

References