Skip to main content

Documentation Index

Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt

Use this file to discover all available pages before exploring further.

Applies to BloodHound Enterprise and CE

​
Abuse Info

To abuse this privilege, use Whisker: 
Whisker.exe add /target:<TargetPrincipal>
For other optional parameters, view the Whisker documentation.

​
Opsec Considerations

Executing the attack will generate a 5136 (A directory object was modified) event at the domain controller if an appropriate SACL is in place on the target object. If PKINIT is not common in the environment, a 4768 (Kerberos authentication ticket (TGT) was requested) ticket can also expose the attacker.

​
Edge Schema

Source: User, Group, Computer
Destination: User, Computer
Traversable: Yes

​
References