BloodHound and its associated collectors—SharpHound, SoapHound, and ShadowHound—are powerful tools used to analyze and visualize Active Directory relationships, identifying potential attack paths and privilege escalation routes within networks. These tools, employed by advanced threat actors such as the Ryuk and Play ransomware gangs, enable both attackers and defenders to discover vulnerabilities related to permissions, misconfigurations, and domain structures. #BloodHound #SharpHound #SoapHound #ShadowHound #Ryuk #PlayRansomware
Keypoints
- BloodHound is an attack path management solution designed to analyze Active Directory (AD) relationships and uncover potential privilege escalation routes.
- SharpHound is the core collector tool that gathers AD data via LDAP, SMB, and DCERPC protocols, including network permissions and user sessions, and offers a PowerShell version for stealth.
- SoapHound collects data over Active Directory Web Services (ADWS) using SOAP messages, enabling enumeration of AD objects, certificate templates, and DNS nodes.
- ShadowHound is a lightweight, PowerShell-based collector supporting both LDAP and ADWS, focusing on stealth and evasion by avoiding binary execution.
- SharpHound extends beyond domain controllers by accessing network devices through SMB named pipes, providing detailed session and permission data.
- All collectors implement stealth techniques such as obfuscated queries and selective data gathering to evade detection by security tools.
- The tools are used by notable threat actors including the Ryuk ransomware gang, Play ransomware gang, Ember Bear, and Cozy Bear for reconnaissance and lateral movement.
MITRE Techniques
- [T1087] Account Discovery – BloodHound and SharpHound identify and map user-group memberships, logged-on users, and active sessions to discover accounts (‘…mapping AD relationships like user-group memberships, logon sessions, permissions…’).
- [T1018] Remote System Discovery – SharpHound leverages SMB named pipes to gather network permissions and sessions from endpoints beyond Domain Controllers (‘SharpHound leverages SMB pipes (samr, srvsvc, winreg, lsarpc, and wkssvc)’).
- [T1046] Network Service Scanning – SoapHound enumerates DNS nodes and certificate templates, revealing internal network structure and potential attack surfaces (‘…harvesting certificate templates and DNS nodes from the DC’).
- [T1059] Command and Scripting Interpreter – ShadowHound uses PowerShell scripts to perform AD enumeration stealthily without binaries (‘ShadowHound implements its functionality through PowerShell scripts…’).
- [T1083] File and Directory Discovery – SharpHound collects Group Policy and permission configurations (‘…collect network permissions, user sessions, and group configurations’).
- [T1082] System Information Discovery – SoapHound collects ADWS data regarding authentication tracking and Group Policy (‘…collecting naming attributes, security access control, authentication tracking, and Group Policy information’).
Indicators of Compromise
- [File Hashes] Known SharpHound executables and PowerShell scripts – used for AD data collection in environments and can be detected via unusual execution patterns.
- [Network Queries] LDAP/SMB and ADWS query patterns – high volumes of LDAP or ADWS queries, including obfuscated LDAP queries by SoapHound, are signals of reconnaissance activity.
- [File Names] PowerShell script names associated with ShadowHound – indicative of stealthy AD enumeration attempts when executed on endpoints.
Read more: https://www.catonetworks.com/blog/cato-ctrl-overview-of-bloodhound-and-associated-collectors/