BloodHound and the identity attack path: from a helpdesk account to domain admin
Identity is where the escalation happens, and graphs are how you see it. What BloodHound reveals about Active Directory and Entra ID, how to read the paths, and which edges are worth cutting first.
A list of over-privileged accounts is not very persuasive. A diagram showing that the helpdesk group can reset the password of a service account, which is a member of a group with local administrator on a server where a domain administrator's session is cached, is extremely persuasive. It is also the same information.
That is what BloodHound does: it collects the identity configuration, loads it into a graph database, and then answers the question that matters — what is the shortest path from what an attacker probably has to what they want.
Why the graph beats the list
Directory permissions compose. Each individual grant looks reasonable to whoever made it. The helpdesk resetting passwords is their job. The service account being in that group is how the application works. The administrator logging into that server was a one-off during an incident in March.
No single review catches the combination, because each grant is reviewed by a different person at a different time. The graph catches it because the graph is the composition.
The output of a collection run is not "these 40 accounts have too many rights". It is "there are 11 paths from the standard user group to Tier 0, and cutting these 3 edges removes all of them". That second statement fits in a steering committee slide and produces action.
Collection, with care
SharpHound (for Active Directory) and AzureHound (for Entra ID) read directory objects, group memberships, ACLs, GPO links, trusts, certificate templates and — the sensitive part — session information from member machines.
Two things to agree in advance with the client:
Session collection is intrusive. Enumerating logged-on users across every workstation generates network traffic that looks exactly like an attacker enumerating logged-on users, because it is the same technique. Expect EDR alerts. Tell the SOC before you start, or you will burn an afternoon of somebody's incident response — though if they do not alert on it, that is itself a finding worth reporting.
Collected data is sensitive. The output describes, in machine-readable form, every path to compromising the domain. It is the most useful file an attacker could steal from the engagement. Encrypt it, keep it off shared drives, and delete it at the end with the client's agreement in writing.
Run collection as a normal user account, not as an administrator. The whole point is to see what an attacker with ordinary credentials sees.
Reading the paths
The built-in queries are the starting point: shortest paths to domain admins, paths from Kerberoastable users, principals with DCSync rights. But the query worth writing is specific to the client: mark the accounts that are actually exposed — the ones in the phishing-prone population, the ones on machines with internet access — and compute paths from those. An attacker starts from a phished user, not from a random node.
Look especially at:
ForceChangePasswordandGenericAllon users. Reset the password, log in as them, continue. These edges are usually delegated to a support team and forgotten.- Certificate templates. ADCS misconfigurations (the ESC1 through ESC8 family) frequently provide a direct path from any authenticated user to domain admin, and they are not visible in any group membership report.
- Nested group membership. A group that is a member of a group that is a member of Domain Admins, three levels deep, added for a project in 2019.
- Sessions on shared servers. Tier 0 accounts logging on to Tier 1 machines is the edge that makes most paths work.
In Entra ID, the same problem in different clothes
AzureHound maps role assignments, application registrations, service principals and consent grants. The equivalent findings:
- An application with
RoleManagement.ReadWrite.DirectoryorAppRoleAssignment.ReadWrite.All, which is global administrator by another name. - Owners of a service principal, who can add credentials to it and become it.
- Groups that are assignable to roles, with a membership nobody has reviewed since the group was created for a Teams channel.
- Hybrid accounts that bridge on-premises and cloud, which frequently means an on-premises compromise is a cloud compromise.
The graph makes the hybrid case obvious in a way that two separate reviews never will.
Cut edges, do not fix accounts
The deliverable that changes anything is a short list of edges, ranked by how many paths they appear in. Removing one well-chosen edge often eliminates dozens of paths, and it is a single change a team can make on a Tuesday.
Then re-collect and show the graph again. The before-and-after picture is the most effective security artefact we produce, because it is the only one where the improvement is visible rather than asserted.
Do this on a schedule, not once. Directories accumulate edges continuously, and a graph that was clean in March is not clean in September. A quarterly collection with a diff against the previous run turns identity hygiene into something measurable — which is also, incidentally, how you evidence the access control review that ISO 27001 asks for.