Skip to main content
Applies to BloodHound Enterprise and CE SharpHound data collection utilizes the open-source SharpHound Common library, maintained by the BloodHound Enterprise Engineering team. In BloodHound Enterprise you can start scans for different data types via a collection schedule or an on-demand scan. With BloodHound Community Edition, you run scans by running the executable itself. The data types are: SpecterOps recommends collecting all data types because it provides maximum visibility into your environment. Local Group Memberships and Sessions are especially important, as they reveal Attack Paths to individual systems based on non-centralized configurations, see Why perform privileged collection in SharpHound.
The SharpHound collection service account does not require Domain Admin membership. While adding the account to local Administrators groups on domain computers will work, we recommend following the articles Least-Privileged Collection and SharpHound Enterprise Service Hardening.

​
AD Structure Data

Information about the objects and relationships within your Active Directory environment makes up the basic information necessary to identify attack paths within your environment. This information includes:
  • Domain trusts.
  • Object properties of users, groups, computers, GPOs, OUs containers, and Domain objects.
  • ACLs related to users, groups, computers, GPOs, OUs, containers, and Domain objects.
  • Enumerated objects contained in every OU, container, and Domain.
  • Enumerated memberships of all Groups.
Reference: Current Object Properties collected by SharpHound.

​
Collection and Permissions

Collection Method: SharpHound collects this information utilizing signed LDAP queries against a domain controller in the domain. Default Permissions: By default, all Authenticated Users can enumerate almost all AD Structure Data utilized by BloodHound Enterprise. Additional Data Source (Optional - Deleted Objects Container): SharpHound can also read the contents of the Deleted Objects container (also known as the AD Recycle Bin). By default, SharpHound cannot read the Deleted Objects container, but read access can be delegated. Collecting deleted objects affects data retention behavior in BloodHound Enterprise, see Active Directory Recycle Bin for details. For delegation configuration, see Least-Privileged Collection - AD Structure Data.

​
Local Group Membership

Members of the following groups are enumerated:
  • Administrators
  • Remote Desktop Users
  • Distributed COM Users
  • Remote Management Users

​
Collection and Permissions

Collection Method: SharpHound collects this information utilizing Remote SAM Enumeration. Default Permissions: By default, computers beginning with Windows 10 version 1607 and Windows Server 2016 require Administrator access to perform Remote SAM operations. Least-Privileged Option: This setting may be overridden with Group Policy to allow non-administrative collection. For detailed configuration steps using the “Network access: Restrict clients allowed to make remote calls to SAM” setting, see Least-Privileged Collection - Local Group Membership.

​
User Rights Assignments

User Rights Assignments (URAs) in Windows define what privileges and capabilities security principals have on a system, independent of group membership. Collecting User Rights Assignments allows BloodHound to accurately determine the CanRDP edge. Before SharpHound Common v3, BloodHound made assumptions based solely on group membership—assuming that membership in the Remote Desktop Users group alone gives users the ability to RDP to a system. However, to successfully use Remote Desktop, a user needs both membership in the Remote Desktop Users group and the User Rights Assignment SeRemoteInteractiveLogonRight.

​
Collection and Permissions

Collection Method: SharpHound collects this information utilizing the LsaOpenPolicy function. Required Permissions: Only local Administrators may call the LsaOpenPolicy function. Least-Privileged Option: There is currently no known method to delegate this permission for least-privileged collection, see Least-Privileged Collection - User Rights Assignments for more details on the implications.

​
Sessions

SharpHound collects active session information to identify abusable sessions on domain-joined systems. These sessions are vulnerable to OS Credential Dumping from tools such as Mimikatz.

​
Collection and Permissions

Collection Method: SharpHound collects this information utilizing the NetWkstaUserEnum function. Default Permissions: Members of the local Administrators group may call this function. Least-Privileged Options:
  • On Windows Server operating systems, members of the local Print Operators group may also collect session data
  • Windows desktop operating systems do not have a local Print Operators group and require alternate approaches
When using Print Operators for collection, you should remove dangerous default User Rights Assignments (SeInteractiveLogonRight, SeLoadDriverPrivilege, SeShutdownPrivilege) from this group to prevent privilege escalation on DCs.
For detailed configuration instructions, including how to safely configure Print Operators, see Least-Privileged Collection - Sessions.

​
Certificate Services

Information about the Active Directory Certificate Service hierarchy within your Active Directory environment makes up the basic information necessary to identify ADCS attack paths within your environment. This information includes:
  • Certificate Templates
  • Root CAs
  • Enterprise CAs

​
Collection and Permissions

Collection Method: SharpHound collects this information utilizing signed LDAP queries against a domain controller in the domain. Default Permissions: By default, Authenticated Users can enumerate almost all Certificate Services data utilized by BloodHound Enterprise. Additional Data Sources: Two additional types of data can enhance the findings - DC Registry and CA Registry.

​
DC Registry

SharpHound collects the registry values Kdc\StrongCertificateBindingEnforcement and Schannel\CertificateMappingMethods (described here) to determine the allowed certificate mapping methods on domain controllers (DCs). The BloodHound ADCS edges ESC6, ESC9, and ESC10 require this data to be collected. SharpHound Enterprise additionally collects the VulnerableChannelAllowList value under SYSTEM\CurrentControlSet\Services\Netlogon\Parameters (described here) to determine which accounts are allowed to use Netlogon secure channel connections without secure RPC.

​
Collection and Permissions

Collection Method: SharpHound collects these registry key values via remote registry access. Default Permissions: Collecting these registry key values requires membership of Administrators on the DCs by default. Least-Privileged Option: Delegation is possible via Group Policy or registry modifications, see Least-Privileged Collection - DC Registry.

​
CA Registry

SharpHound collects the following registry key values on enterprise CAs stored under SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA Name>:
  • EnrollmentAgentRights: Contains restrictions for enrollment agents. BloodHound will take the restrictions into account when calculating ADCS ESC3 edges, and assume no restrictions if not collected, as no restrictions are configured by default.
  • Security: Contains the security descriptor for the enterprise CA (i.e., the permissions for Enroll, ManageCA, and ManageCertificates edges against the enterprise CA). This security descriptor is also stored in the AD object of the enterprise CA. SharpHound collects both. The CA registry security descriptor holds the effective permissions. Changes in the CA registry security descriptor are replicated to the AD copy, however, not the other way. Therefore, collecting the CA registry security descriptor may reveal permissions of the enterprise CA that are not present if only collecting the AD object.
  • PolicyModules\<Active Policy>\EditFlags: SharpHound checks if the EDITF_ATTRIBUTESUBJECTALTNAME2 flag is present, which is required to calculate ADCS ESC6 edges.
  • RoleSeparationEnabled: SharpHound checks whether role separation is enforced (a user cannot be both CA Administrator and Certificate Manager).
The registry key values are described in detail in the Certified Pre-Owned whitepaper.

​
Collection and Permissions

Collection Method: SharpHound collects these registry key values via remote registry access on enterprise CAs. Default Permissions: Authenticated Users may collect these registry key values by default, see Least-Privileged Collection - CA Registry for an explanation of why this is accessible.