This note documents detection patterns related to BloodHound Collection within Active Directory environments.

Direct Indicators

Log	Event ID	Meaning	Forensic Value	Notes
Security	4662	Directory object accessed	High	LDAP queries against AD objects during enumeration.
Security	4624	Successful logon	Medium	Authentication used for enumeration session.
Security	4648	Explicit credentials used	High	Tools authenticating using alternate credentials.
Sysmon	1	Process creation	High	Execution of SharpHound collector.
Sysmon	3	Network connection	Medium	LDAP or SMB communication with domain controllers.

Indirect Indicators

Indicator	What To Look For	Forensic Value	Notes
Large LDAP query volume	Multiple LDAP queries within short period	High	Typical enumeration behavior.
SharpHound execution	Process command line containing SharpHound	Critical	Direct BloodHound collection evidence.
SMB session enumeration	Access to multiple hosts during collection	Medium	Used to gather session data.
Domain controller query spikes	High LDAP query load from workstation	High	Possible automated enumeration.

Common Tools

Tool	Usage
SharpHound	Primary BloodHound data collector.
BloodHound.py	Python collector for Linux environments.
PowerView	Used to collect AD relationship data.
CrackMapExec	Can enumerate AD relationships.

Relevant Artifacts

Security logs (4662, 4624, 4648)
Sysmon process and network logs
LDAP query telemetry
EDR process monitoring
Network traffic to domain controllers

MITRE ATT&CK References

T1087 Account Discovery
T1069 Permission Groups Discovery
T1482 Domain Trust Discovery

Decision Tree

Detect enumeration-related process execution.
Identify querying host.
Inspect LDAP query volume.
Determine authenticated account.
Evaluate scope of enumeration.

Example Detection Templates

KQL

DeviceProcessEvents
| where ProcessCommandLine contains "SharpHound"

EQL

process where process.command_line like "*SharpHound*"

Sigma

title: BloodHound Enumeration Activity
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains: SharpHound
  condition: selection
level: high

Splunk

index=main earliest=1690195896 latest=1690285475 source="WinEventLog:SilkService-Log" | spath input=Message | rename XmlEventData.* as * | table _time, ComputerName, ProcessName, ProcessId, DistinguishedName, SearchFilter | sort 0 _time | search SearchFilter="*(samAccountType=805306368)*" | stats min(_time) as _time, max(_time) as maxTime, count, values(SearchFilter) as SearchFilter by ComputerName, ProcessName, ProcessId | where count > 10 | convert ctime(maxTime)

Mitigation & Hardening

Control Area	Mitigation	Effectiveness	Notes
Monitoring	Alert on SharpHound execution	High	Detects BloodHound collection.
LDAP monitoring	Detect large query volumes	Medium	Identifies automated enumeration.
Least privilege	Limit domain read access where possible	Medium	Reduces enumeration scope.