How do you detect SharpHound and BloodHound reconnaissance in Active Directory?

Detect them by looking for enumeration-heavy LDAP, SMB, and Kerberos activity that maps users, groups, sessions, local administrators, and trust paths. SharpHound and BloodHound produce broad directory queries and host sweeps rather than normal user traffic. Correlate directory queries with endpoint process telemetry and network patterns, and alert on collection bursts from non-administrative systems.

What SharpHound and BloodHound collection looks like in the logs

SharpHound and BloodHound are noisy because they are built to map how active directory is actually connected: who belongs to what, where sessions exist, which machines are local admin targets, and which trust paths can be chained into privilege. That means detection usually starts with the shape of the activity, not a single signature. Broad LDAP enumeration, repeated SMB access, and Kerberos-heavy lookups from a workstation are the core behavioral clues.

In practice, the useful question is whether the activity is behaving like an operator or an inventory tool. Normal user traffic is usually narrow and task-driven. Reconnaissance from SharpHound tends to be wide, repetitive, and graph-building in nature, with bursts of queries that span users, groups, computers, logons, sessions, and administrative relationships. The most reliable detections come from correlating directory activity with endpoint process telemetry and network flow data so you can tie the enumeration to the collecting host.

That collection pattern is easier to spot when you understand the attacker workflow. BloodHound data collection often touches multiple domain controllers, nearby hosts, and administrative surfaces in quick succession, because the objective is not one lookup but a map of reachable privilege. The host doing the collection is often not a normal admin workstation, and the access pattern is often broader than the user or service role attached to that machine would justify.

Signals that are more useful than a single event ID

The strongest detections come from combinations of weak signals. A single LDAP query is rarely enough, but a burst of directory queries paired with SMB access to many systems, Kerberos requests that spike over a short window, and a process lineage that points to a recon tool is much more meaningful. This is why teams should build detections around collection bursts, unusual source hosts, and lateral-looking enumeration rather than only around one protocol or one log source.

One especially useful pattern is a non-administrative endpoint suddenly performing directory-wide discovery. If a user workstation or jump box starts pulling broad object data, exploring group membership at scale, or querying for local admin and session relationships across many hosts, that activity deserves review even if no payload execution follows. You are looking for discovery that is too broad, too fast, or too systematic for the host’s normal function.

To make those signals actionable, pair them with a baseline of what each workstation, server, and admin tier normally queries. If a finance laptop, kiosk, or developer endpoint starts generating directory traffic that resembles a compromise assessment exercise, treat that as suspicious until you can explain the business purpose. For deeper path analysis and attack-path context, the Identity Attack Paths Guide is a useful companion because BloodHound collection is ultimately about turning discovery into path mapping.

How to investigate and reduce the chance of missing it

The first investigation step is to identify the collecting process and the source host, then ask whether that host should ever be performing broad directory enumeration. If the answer is no, preserve the process tree, command line, network destinations, and the time window of the queries. That evidence matters because SharpHound collection is often one stage in a larger attack chain, and the collection itself may be the earliest clear indicator that an adversary is building privilege paths.

Next, compare the activity to your normal administrative workflows. BloodHound-style enumeration often shows up alongside SMB access to many endpoints, repeated LDAP reads across multiple naming contexts, and host sweeps that are much broader than a help desk or server admin tool would need. If the access pattern also lines up with unusual logons, stale admin rights, or trust exploration, you may be looking at a foothold that has moved from access to reconnaissance. The Lateral Movement Guide helps because these collection patterns often sit next to the same SMB and remote-access behaviors used after initial compromise.

Reducing detection gaps also means hardening the directory visibility itself. Limit who can query at scale, segment administrative access, and make sure endpoint telemetry is available on the systems most likely to be used for collection. If you can see the process that launched the enumeration, the host it came from, and the directory scope it touched, you can distinguish routine admin work from a graph-building recon burst much faster. The Active Directory and Entra ID Hardening Guide is relevant here because reducing the reachability of privileged paths also reduces what a collector can learn from one compromised endpoint.

Risk and Threat Considerations

SharpHound and BloodHound are not dangerous because they are exotic, they are dangerous because they let an attacker turn ordinary directory visibility into a privilege map. Once that map exists, the next step is usually targeted lateral movement, credential abuse, or trust path exploitation. The main operational risk is that the reconnaissance phase can look like normal enterprise administration if the environment has weak baselines or too much directory visibility.

Failure mechanism: The collector abuses legitimate LDAP, SMB, and Kerberos access to enumerate relationships at scale, then uses that data to identify the shortest path to higher privilege, session hijacking, or trust abuse.

Impact: The result is faster privilege escalation, more precise lateral movement, and a much lower chance that defenders will notice the path before the attacker starts using it.

Practitioner Guidance

What to verify: Confirm whether the source host is allowed to perform broad directory enumeration at all, then verify whether the traffic volume and object types match its role. If the host is not an admin workstation, domain management system, or approved security tool, treat collection bursts as suspicious until proven otherwise.

What to measure: Track bursts of LDAP reads, SMB touches across many hosts, and short-window spikes in directory lookups from non-administrative systems. The useful metric is not just event count, but breadth of objects touched and whether the access pattern crosses normal role boundaries.

Common mistake: Teams often overfocus on one tool signature and miss the broader pattern of graph-building reconnaissance. If you only alert on a known binary name, you may miss renamed collectors, alternate execution paths, or manual enumeration that produces the same behavioral footprint.

Practitioner takeaway: Detect the collection pattern, not just the tool, because BloodHound-style reconnaissance is most visible as an unusual blend of breadth, repetition, and privilege-oriented directory access from a host that should not need that reach.

Related resources from NHI Mgmt Group

• How do you detect a new domain trust being created in Active Directory?
• How do you detect Active Directory enumeration using PowerShell cmdlets?
• How do you detect Active Directory enumeration with AdFind?
• How do you detect DSRM account abuse for Active Directory persistence?