BloodHound has been the standard tool for identifying attack vectors in Active Directory for years. With version 8, SpecterOps has significantly broadened its scope: in addition to traditional AD, cloud and SaaS environments are now also mapped. This makes BloodHound the tool for the reality of modern hybrid IT infrastructures, where attack paths no longer end at the boundary of the local network.
New features in BloodHound 8
The new version introduces four key innovations that significantly expand BloodHound’s range of functions.
OpenGraph data model
Active Directory, Azure/Entra, GitHub, Jenkins, Kubernetes and Okta can be represented in a single graph.
Cloud integration
Azure/Entra (including PIM elevations), GitHub repositories with secrets, Kubernetes service accounts and Jenkins credentials are made visible, with attack paths from the cloud to on-premises included.
New Relationship Types
Edges such as ContributorTo, HasSecret, AuthenticatesAs, EligibleFor or ElevatesTo make hybrid privilege escalation traceable.
Improved query engine
Cypher queries can now combine AD and cloud nodes. This enables pathfinding across system boundaries.
The classic features remain relevant
The familiar features of BloodHound also remain crucial for any AD security assessment:
-
GPO abuse:
Workstations can be taken over using WriteDacl.
-
DCSync/Golden Ticket:
GetChangesAll grants permanent control over the domain.
-
Kerberoasting:
Service accounts can be compromised via HasSPN.
-
Local admin rights & sessions:
Reveal Lateral Movement.
-
ADCS/Certificates:
Particularly critical and often overlooked in practice.
Example: Certificate templates in the attack graph
The screenshot shows a typical scenario: several certificate templates
are published on an Enterprise CA, and powerful groups such as Domain Admins
, Enterprise Admins
or even Authenticated Users
possess far-reaching permissions such as Enroll, GenericAll or AllExtendedRights.
Such configurations are risky: using ‘Enroll’ and weak templates, certificates can be requested that allow logins as any user. With ‘GenericAll’ or ‘AllExtendedRights’, templates can be manipulated, laying the groundwork for attacks such as ESC1 or ESC6. Furthermore, an issued certificate is long-lasting and bypasses controls such as password changes or MFA. The crucial question is: Who regularly checks which groups and users actually have access to the certificate templates?
An example query for templates with dangerous permissions:
MATCH p=(t:CertTemplate)<-[:Enroll|:GenericAll|:AllExtendedRights]-(n:Group|User) RETURN p LIMIT 25;
Hybrid paths in practice
BloodHound 8 makes it possible to combine traditional AD paths with cloud-based elements. A typical example of a hybrid attack path:
GitHub secret → Azure service principal → resource group → Key Vault → production systems
Example query for the transition from a GitHub secret to an Azure service principal:
MATCH p=(:GitHubRepo)-[:HasSecret]->(:Secret)-[:AuthenticatesAs]->(:AZServicePrincipal) RETURN p LIMIT 10;
Example query for a PIM elevation in Entra:
MATCH p=(u:AZUser)-[:EligibleFor]->(:AZPIMRole)-[:ElevatesTo]->(:AZRole) RETURN p LIMIT 10;
Mint Secure GmbH
How Mint Secure supports you
We are already using BloodHound 8 in projects to reveal hybrid attack surfaces and raise awareness amongst organisations precisely where risks are often overlooked.
BloodHound Assessment
We map your Active Directory and cloud environments using BloodHound 8 and uncover hidden attack vectors.
Red Teaming
We simulate realistic attacks across AD and cloud boundaries, from GitHub secrets to Azure roles.
ADCS Hardening
We identify and rectify insecure certificate templates before they become a point of entry.
Conclusion
BloodHound 8 combines the new cloud features with traditional AD attack paths in a single graph. This provides a more comprehensive picture for assessments and Red Teaming, ranging from GitHub secrets and PIM roles in Azure to poorly secured certificate templates in AD.
Anyone who only considers attack paths within Active Directory is overlooking a significant portion of the actual attack surface today.
Mint Secure helps you visualise hybrid attack paths and close them in a targeted manner. Get in touch with us.
