BloodHound Named
BloodHound names attack-path graph literacy — understand nodes and edges on $LAB_AD exports; defenders use same graphs for remediation.
Visual · t25_bloodhound_named
BloodHound graph literacy. $LAB_AD only. Original Cyberlium.
BloodHound is a graph of AD relationships — literacy means reading paths, not harvesting stranger tenants.
BloodHound ingests AD data (users, groups, sessions, ACLs, trusts) and visualizes paths to high-value targets. Nodes: users, computers, groups, domains. Edges: MemberOf, AdminTo, HasSession, GenericAll, etc. Defenders use the same graphs to prioritize remediation (edge removal, tiering). Cyberlium teaches graph reading on YOUR $LAB_AD collector output — not running collectors against unauthorized forests. Next: Enum Hygiene.
1. Graph concepts (named)
Path: sequence of edges from source node to target (e.g., Domain Admins). Shortest path queries answer 'how could this account reach Tier 0?' — purple teams document paths with mitigations.
On $LAB_AD, label three node types and two edge types from course graph screenshot — no live collector on production.
Command guide
Try these commands — Graph concepts (named)
═══ WINDOWS / POWERSHELL (Lab Host) ═══
Discover Domain Controllers in current forest
Command — copy this
nltest /dclist:$env:USERDOMAIN
Enumerate domain admins and high-privilege groups
Command — copy this
net group "Domain Admins" /domain net group "Enterprise Admins" /domain
Query AD objects via LDAP filter
Command — copy this
Get-ADObject -LDAPFilter "(adminCount=1)" -Properties SamAccountName, distinguishedName
═══ LINUX / BASH (Lab Network) ═══ Query AD LDAP anonymously or with lab credentials
Command — copy this
ldapsearch -x -H ldap://${LAB_AD_HOST:-127.0.0.1} -b "dc=lab,dc=local" "(objectClass=organizationalPerson)" sAMAccountName 2>/dev/null | head -15Primary tools to practice this lesson: curl, python3. Reference sites: BloodHound docs (https://bloodhound.readthedocs.io/); SpecterOps BloodHound (https://bloodhound.specterops.io/); MITRE T1069 (https://attack.mitre.org/techniques/T1069/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Collector hygiene (lab scope)
Collectors run inside authorized scope only — $LAB_AD enrollment or GOAD VLAN. Store exports encrypted, chmod 600, delete when lab resets. Never upload stranger domain graphs to public BloodHound instances.
Literacy: collector = sensitive read of directory — treat output like credential-adjacent data.
3. Defender use of same graphs
Blue teams import data to find excessive AdminTo, session on Tier 0, ACL abuse paths — then remove edges via group cleanup, LAPS, tiering, and ACL hardening.
Ship: BloodHound literacy card — three node types, two edges, one remediation action per edge class. Next: Enum Hygiene.
4. What you ship: BloodHound graph literacy card for $LAB_AD
Node/edge definitions, collector scope rule, one remediation example. NO stranger collector runs. chmod 600.
5. What you record before the next lesson
Date. BloodHound card. $LAB_AD named. File t25-m04-l02-bloodhound-named.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run BloodHound collector on employer AD without scope. Share lab graph with real usernames publicly.
- Right: Write graph literacy card from YOUR $LAB_AD course material. Next: Enum Hygiene.
Mission: name BloodHound graph parts
1) Define node and edge in one line each. 2) Name two edge types. 3) One defender remediation per edge. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Same graph defenders use to prioritize ACL cleanup.
APPLY: BloodHound literacy means:
APPLY: True or False: BloodHound visualizes paths via nodes and edges.
APPLY: Collector output should be treated as: