BloodHound

BloodHound is an open-source Active Directory and Azure AD attack path analysis tool that uses graph theory to reveal hidden privilege escalation paths and lateral movement routes in identity infrastructure.

Identity Security open-source active-directory attack-path-analysis penetration-testing

Overview

BloodHound is a free and open-source tool developed by SpecterOps that uses graph theory to reveal hidden and often unintended relationships within Active Directory and Azure AD (Entra ID) environments. It ingests data collected by its companion tools SharpHound, AzureHound, and SOAPHound, then builds a graph database where nodes represent users, computers, groups, sessions, and ACLs, and edges represent relationships such as admin rights, session activity, and delegation. Security teams use BloodHound both offensively, to map paths to Domain Admin, and defensively, to identify and remediate dangerous attack paths before attackers exploit them. BloodHound CE (Community Edition) is the current open-source release, with a commercial Enterprise edition available from SpecterOps.

Primary Use Cases

✔ Mapping attack paths to Domain Admin and other high-value targets during Active Directory penetration tests and red team engagements.

✔ Defensive attack path management by identifying and remediating dangerous privilege relationships and misconfigured ACLs before adversaries can exploit them.

✔ Azure AD and Entra ID attack path analysis using AzureHound to assess cloud identity risk alongside on-premises Active Directory.

Frequently Asked Questions

Yes. BloodHound Community Edition (CE) is released under the Apache 2.0 license and is freely available. SpecterOps also offers a commercial BloodHound Enterprise edition with additional features for continuous attack path management.

As of September 2026, BloodHound CE is at version 8.x, following the 7.x line that introduced a redesigned UI, PostgreSQL backend, and improved OpenGraph support. SharpHound, AzureHound, and SOAPHound collectors are updated regularly to support new Active Directory and Entra ID features.

BloodHound relies on separate collector tools to gather data. SharpHound collects on-premises Active Directory data, AzureHound collects Azure AD / Entra ID data, and SOAPHound is an alternative AD collector that queries AD Web Services. These produce JSON output that is ingested into the BloodHound graph database.

Yes. Blue teams use BloodHound to proactively identify and remediate dangerous attack paths before attackers can exploit them. This practice is known as attack path management. BloodHound Enterprise is specifically designed for continuous defensive use, but the open-source CE version is also widely used by blue teams for periodic assessments and remediation prioritization.

No. BloodHound collectors such as SharpHound can gather a significant amount of data with a standard domain user account, which is part of what makes the tool powerful for attackers and useful for defenders. Collection scope and stealth options can be configured, and some data requires elevated privileges, but much of the attack path graph is available to any authenticated user.

Metadata

Official Website Visit Website

Category Info

Identity Security covers tools used to analyze, audit, and secure identity infrastructure such as Active Directory, Entra ID, and other directory services, focusing on privilege relationships, attack paths, and access governance.

Added On

September 16, 2026

Last Updated

September 16, 2026