BloodHound

Adversary Tools · BloodHound

· ToolS0521 · Dual-use Araç

Type

Tool

Techniques

Used By

6 groups

Platforms

Windows

Description

BloodHound is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.(Citation: GitHub Bloodhound)(Citation: CrowdStrike BloodHound April 2018)(Citation: FoxIT Wocao December 2019)

Used By (6 threat groups)

G0016APT29 G0114Chimera G1003Ember Bear G1040Play G0092TA505 G0102Wizard Spider

Techniques (11)

T1018Remote System Discovery

discovery

T1033System Owner/User Discovery

discovery

T1059.001PowerShell

execution

T1069.001Local Groups

discovery

T1069.002Domain Groups

discovery

T1087.001Local Account

discovery

T1087.002Domain Account

References

https://attack.mitre.org/software/S0521 https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/https://github.com/BloodHoundAD/BloodHound