H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Tool

BloodHound

[BloodHound](https://attack.mitre.org/software/S0521) is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.(Citation: GitHub Bloodhound)(Citation: CrowdStrike BloodHound April 2018)(Citation: FoxIT Wocao December 2019)

Tool
TypeTool
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[BloodHound](https://attack.mitre.org/software/S0521) is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.(Citation: GitHub Bloodhound)(Citation: CrowdStrike BloodHound April 2018)(Citation: FoxIT Wocao December 2019)

Labels

tool
18 recorded

Relationships

uses
from APT29
Group
uses
to Archive Collected Data
Technique
uses
to Domain Account
Technique
uses
to Domain Groups
Technique
uses
to Domain Trust Discovery
Technique
uses
to Group Policy Discovery
Technique
uses
to Local Account
Technique
uses
to Local Groups
Technique
uses
to Native API
Technique
uses
to PowerShell
Technique
uses
to Remote System Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
from Chimera
Group
uses
from Ember Bear
Group
uses
from Operation Wocao
Campaign
uses
from Play
Group
uses
from TA505
Group
uses
from Wizard Spider
Group
4 external

References

mitre-attack
S0521
open
FoxIT Wocao December 2019
https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf
open
CrowdStrike BloodHound April 2018
https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/
open
GitHub Bloodhound
https://github.com/BloodHoundAD/BloodHound
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance