BloodHound data collection, aka Sharphound, is quite a complex beast.
When giving BloodHound workshops, the part where I get the most questions is
always data collection.
How is the BloodHound data collected? What methods do what? Who am I talking
to? How do I fly under the radar?
These are all very relevant questions when you think about it.
After all, the rest is just a gorgeous UI sitting on top of a cool data model,
but the only bit of BloodHound code that ever touches the targeted network is
SharpHound. And so questions about it should be mandatory.
Now even thought I’ve been working with BloodHound for quite a while, there is
always this moment where I have to check before answering… (I feel the older I
get, the quicker I understand, but the less I remember… but that’s another story
I guess…)
A lot of info is available online to understand what happens under the
SharpHound hood.
The official BloodHound documentation
here,
a couple of very helpful posts from @CptJesus
here and
here, and of course the
SharpHound source code itself
here.
But that’s a lot to read to be honest… and in the BloodHound philosophy we have
to think in graphs…
So I made one.
(TL;DR get it
here)
The challenge was to have it all fit on a single slide, so I could add it to my
deck and fall back to it when in need for a cheat.
The result may be a bit complicated to follow at first, so in this post I’ll
quickly detail how to read the document.
On the top left are all the methods. Horizontally are individual methods, vertically are bunbles of individual methods. The “metro map” representation shows what individual methods are executed in each bundle.
Below are the classic switches to add some randomness in timing between queries on all methods (–Throttle & –Jitter), and a quick explanation of the difference between Session and loggedOn when it comes to collecting the “HasSession” relationship, as well as the basic session loop collection switches to increase session data coverage.
To the right, for each of the individual methods, you will find extra info on the targeted object and communication used (LDAP to DC vs. RPC/SMB to Hosts), with extra switches to fine tune collection to both target types.
The next two columns will give you a Cypher-like representation of what is collected, and some extra info for each of the individual methods.
The last column maps each method to the matching ATT&CK technique ID so as to further connect them to associated detection data sources and possible mitigation.
Finally, and with the tiny bit of space left, I added some of the extra output switches that can come in handy when trying to avoid being caught writting to disk with default BloodHound file names…
This cheat sheet covers only the basics when it comes to BloodHound Data
Collection, but I really couldn’t fit more on it. Still, I hope you will find it
useful…
As for flying under the radar, it will of course depend on what you are up
against, but avoiding the Default/All methods is probably a good start… In
general, low and slow and understanding what you are doing is the way to go… and
I hope this document can help.
There are many more switches available and the
BloodHound documentation
is the most complete and up-to-date source of info there is out there (a part
from the SharpHound source code
itself ofc…) so make sure to check it out…
One last thing… my BloodHound slide deck is dark-themed so the cheat sheet is
too, but I also made a printer-friendly version if you prefer (Hack the planet
AND Save the planet).
Both can be downloaded
here in
PDF format.
Please feel free to ping me on the BloodHound Slack if you have any questions or feedback,
Until next time…
Cheers,
Take Care,