BloodHound

BloodHound was created by Andy Robbins, Rohan Vazarkar, and Will Schroeder, a group of penetration testers who would go on to found the security company SpecterOps. Schroeder had already built PowerView, a PowerShell framework for gathering Active Directory situational awareness, and Robbins and Vazarkar drew on that data collection work to build an analysis layer on top of it. The trio released BloodHound as free and open-source software and introduced it to the public in a talk titled "Six Degrees of Domain Admin" at DEF CON 24 in August 2016.

A Graph, Not a List

The tool's core insight was to stop treating Active Directory permissions as a set of independent, tabular facts and instead model an entire domain as a directed graph stored in the Neo4j graph database. Users, groups, and computers become nodes; group memberships, administrative rights, active logon sessions, and access-control entries become edges connecting them. Data is gathered by a PowerShell (and later C#, via the companion collector SharpHound) ingestor and loaded into the graph, after which an analyst can ask the graph engine to compute shortest paths from a low-privileged foothold to a target such as Domain Admin.

Why It Mattered

Before BloodHound, finding a viable privilege-escalation chain in a large AD environment meant manually cross-referencing group memberships and ACLs, an effort that could consume days or weeks even for experienced testers. By reframing the problem in graph terms, BloodHound could surface non-obvious multi-hop escalation routes in a fraction of the time. The tool was adopted almost immediately by red teamers as a mapping and targeting aid, and by defenders and AD administrators trying to see their environment the way an attacker would.

From Free Tool to Commercial Platform

The open-source project continued to be maintained by SpecterOps, and in July 2021 the company launched BloodHound Enterprise, a commercial SaaS product built on new architecture that continuously maps attack paths and prioritizes the choke points whose remediation eliminates the largest number of paths at once. SpecterOps has said it remained committed to supporting the free, open-source edition alongside the paid product.

Legacy

Nearly a decade after its release, BloodHound is considered a standard component of Active Directory penetration testing and red-team tradecraft. It reshaped how both attackers and defenders reason about identity risk in Windows domains, shifting the conversation from individual misconfigurations to the chains of relationships that connect them.

Timeline

• 2016-08Andy Robbins, Rohan Vazarkar, and Will Schroeder publicly release BloodHound and present it at DEF CON 24 in the talk 'Six Degrees of Domain Admin.'
• 2021-07-27SpecterOps launches BloodHound Enterprise, a commercial SaaS attack-path-management platform, while continuing to support the open-source edition.