Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

BloodHound Activity Detected [CHK-3027]

This ticket is opened when Microsoft Defender detects BloodHound or its collector SharpHound in your environment. These tools map Active Directory and Entra ID relationships to find paths from an ordinary account to a privileged one. The affected device and account, and what Attic has already done, are written into the ticket by the MDR pipeline.

Rationale

BloodHound answers one question extremely well: given this account, what is the shortest route to Domain Admin? It collects users, groups, sessions, ACLs and trust relationships, builds a graph, and highlights the chains that a person reading group memberships by hand would never spot.

That makes it valuable to defenders and equally valuable to attackers. In an intrusion it is used shortly after the initial foothold, at the point where the attacker has access but does not yet know what that access is worth. Detection is therefore an early warning: it usually means someone is orienting themselves inside your network, before the privilege escalation rather than after it.

The collection itself is quiet by design. SharpHound largely uses the same LDAP and SMB queries that ordinary domain-joined machines make constantly, which is why endpoint detection of the tool is the practical signal, and why acting on it quickly is worthwhile. The window between reconnaissance and escalation is often short.

Legitimate use does occur: security teams and penetration testers run BloodHound as part of authorised assessments. That is the first thing to rule out.

Follow-up

Follow these steps to adequately address this detection:

  1. Establish whether this is authorised assessment work. Check whether a penetration test, red team exercise or internal AD review was scheduled at that time, and whether the device and account match it.
    • If no (not authorised): Treat the account and device as compromised, and assume the attacker now has a map of your directory:
      1. Isolate the device in Microsoft Defender and preserve it for investigation.
      2. Reset the password and revoke sessions for the account that ran the collector, and for any other account that had signed in to that device.
      3. Assume your privilege paths are known. Review the shortest paths to Tier 0 yourself: the attacker has already done so. Prioritise removing them over investigating how they were found.
      4. Check for follow-on escalation: new members of privileged groups, changes to ACLs and group policy, Kerberoasting activity, and service account abuse.
      5. Review what the collection reached. SharpHound run with default options enumerates the entire domain, so treat the whole directory structure as disclosed.
      6. Escalate to IR. Contact Attic for incident response support. Reconnaissance of this kind rarely stands alone.
    • If yes (authorised): Confirm and record:
      1. Verify the tester, scope and time window against the engagement documentation.
      2. Ask for the findings. An authorised BloodHound run produces exactly the attack paths you should be closing.
      3. Record the confirmation on the ticket.
  2. Act on the underlying paths regardless of the outcome. Whether the run was hostile or authorised, the attack paths it found exist either way. Reducing them (trimming privileged group membership, removing unnecessary ACLs, adopting tiered administration) is the durable fix.

More information