BloodHound Cheat Sheet

BloodHound maps the actual relationships inside an Active Directory domain — who has admin rights on what, whose session is sitting on which machine, what chain of group memberships leads to Domain Admins — as a graph, then finds the shortest attacker path through it. Group membership lists alone hide this; a Cypher query against the graph doesn't.

Red Team / Offensive Use

Enumeration tools like NetExec tell you what a credential can directly touch. BloodHound answers a different question: given everything the domain knows about itself, what's the shortest real path from where you are to Domain Admin, factoring in nested group memberships, ACL grants, and cached sessions that no single net group command surfaces. It's collected with a low-privilege domain credential and no agent, then explored entirely offline in the BloodHound interface — a normal part of the enumeration loop, re-run after every new credential, not a one-time step.

Established Cheatsheet

SpecterOps/BloodHound — the official repository for BloodHound Community Edition, including setup instructions and the current Cypher query reference.

PWNMI's Top 6 Use Cases

• bloodhound-python -u user -p 'password' -d domain.local -ns 10.10.10.5 -c All — collect the full graph (users, groups, computers, sessions, ACLs, trusts) using a domain credential, from a Linux attack box with no agent on any target
• docker compose up -d in BloodHound CE's own compose setup — the current recommended way to run the BloodHound web interface + Neo4j database locally, since the standalone desktop app has been superseded by the containerized Community Edition
• Upload the ingestor's output ZIP through the BloodHound UI's Upload Data panel — loads the collected graph into the running instance
• Mark a user as Owned in the UI after confirming a credential — keeps every subsequent path-finding query centered on what you've actually compromised, not a hypothetical starting point
• Built-in query: Shortest Paths to Domain Admins — the single most-used query, showing every route from any node to full domain compromise
• Custom Cypher: MATCH (u:User)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-512' RETURN u.name — a raw Cypher query example (Domain Admins' well-known RID is 512); most real usage is the pre-built queries, but knowing you can drop into raw Cypher matters once a specific question isn't already a canned button

Next step

For the full sequence this fits into — enumeration, Kerberoasting, DCSync — see the Active Directory attack chain. For the credential-extraction tools that often feed a new account into another BloodHound collection pass, see secretsdump.py and the Impacket suite.