SharpHound data collection utilizes the open-source SharpHound Common library, maintained by the BloodHound Enterprise Engineering team.
In BloodHound Enterprise you can start scans for different data types via a collection schedule or an on-demand scan.
With BloodHound Community Edition, you run scans by running the executable itself.
The data types are:
SpecterOps recommends collecting all data types because it provides maximum visibility into your environment. Local Group Memberships and Sessions are especially important, as they reveal Attack Paths to individual systems based on non-centralized configurations, see Why perform privileged collection in SharpHound.
AD Structure Data
Information about the objects and relationships within your Active Directory environment makes up the basic information necessary to identify attack paths within your environment.
This information includes:
- Domain trusts.
- Object properties of users, groups, computers, GPOs, OUs containers, and Domain objects.
- ACLs related to users, groups, computers, GPOs, OUs, containers, and Domain objects.
- Enumerated objects contained in every OU, container, and Domain.
- Enumerated memberships of all Groups.
Reference: Current Object Properties collected by SharpHound.
Collection and Permissions
Collection Method: SharpHound collects this information utilizing signed LDAP queries against a domain controller in the domain.
Default Permissions: By default, all Authenticated Users can enumerate almost all AD Structure Data utilized by BloodHound Enterprise.
Additional Data Source (Optional - Deleted Objects Container): SharpHound can also read the contents of the Deleted Objects container (also known as the AD Recycle Bin). By default, SharpHound cannot read the Deleted Objects container, but read access can be delegated. Collecting deleted objects affects data retention behavior in BloodHound Enterprise, see Active Directory Recycle Bin for details. For delegation configuration, see Least-Privileged Collection - AD Structure Data.
Local Group Membership
Members of the following groups are enumerated:
- Administrators
- Remote Desktop Users
- Distributed COM Users
- Remote Management Users
Collection and Permissions
Collection Method: SharpHound collects this information utilizing Remote SAM Enumeration.
Default Permissions: By default, computers beginning with Windows 10 version 1607 and Windows Server 2016 require Administrator access to perform Remote SAM operations.
Least-Privileged Option: This setting may be overridden with Group Policy to allow non-administrative collection. For detailed configuration steps using the “Network access: Restrict clients allowed to make remote calls to SAM” setting, see Least-Privileged Collection - Local Group Membership.
User Rights Assignments
User Rights Assignments (URAs) in Windows define what privileges and capabilities security principals have on a system, independent of group membership. Collecting User Rights Assignments allows BloodHound to accurately determine the CanRDP edge. Before SharpHound Common v3, BloodHound made assumptions based solely on group membership—assuming that membership in the Remote Desktop Users group alone gives users the ability to RDP to a system. However, to successfully use Remote Desktop, a user needs both membership in the Remote Desktop Users group and the User Rights Assignment SeRemoteInteractiveLogonRight.
Collection and Permissions
Collection Method: SharpHound collects this information utilizing the LsaOpenPolicy function.
Required Permissions: Only local Administrators may call the LsaOpenPolicy function.
Least-Privileged Option: There is currently no known method to delegate this permission for least-privileged collection, see Least-Privileged Collection - User Rights Assignments for more details on the implications.
Sessions
SharpHound collects active session information to identify abusable sessions on domain-joined systems. These sessions are vulnerable to OS Credential Dumping from tools such as Mimikatz.
Collection and Permissions
Collection Method: SharpHound collects this information utilizing the NetWkstaUserEnum function.
Default Permissions: Members of the local Administrators group may call this function.
Least-Privileged Options:
- On Windows Server operating systems, members of the local
Print Operators group may also collect session data
- Windows desktop operating systems do not have a local
Print Operators group and require alternate approaches
When using Print Operators for collection, you should remove dangerous default User Rights Assignments (SeInteractiveLogonRight, SeLoadDriverPrivilege, SeShutdownPrivilege) from this group to prevent privilege escalation on DCs.
Print Operators, see Least-Privileged Collection - Sessions.
Certificate Services
Information about the Active Directory Certificate Service hierarchy within your Active Directory environment makes up the basic information necessary to identify ADCS attack paths within your environment. This information includes:
- Certificate Templates
- Root CAs
- Enterprise CAs
Collection and Permissions
Collection Method: SharpHound collects this information utilizing signed LDAP queries against a domain controller in the domain.
Default Permissions: By default, Authenticated Users can enumerate almost all Certificate Services data utilized by BloodHound Enterprise.
Additional Data Sources: Two additional types of data can enhance the findings - DC Registry and CA Registry.
DC Registry
SharpHound collects the registry key values Kdc\\StrongCertificateBindingEnforcement and Schannel\\CertificateMappingMethods (described here) to determine the allowed certificate mapping methods by the DCs. The BloodHound ADCS edges ESC6, ESC9, and ESC10 require this data to be collected.
Collection and Permissions
Collection Method: SharpHound collects these registry key values via remote registry access.
Default Permissions: Collecting these registry key values requires membership of Administrators on the DCs by default.
Least-Privileged Option: Delegation is possible via Group Policy or registry modifications, see Least-Privileged Collection - DC Registry.
CA Registry
SharpHound collects the following registry key values on enterprise CAs stored under SYSTEM\\CurrentControlSet\\Services\\CertSvc\\Configuration\\<CA Name>:
- EnrollmentAgentRights
Contains restrictions for enrollment agents. BloodHound will take the restrictions into account when calculating ADCS ESC3 edges, and assume no restrictions if not collected, as no restrictions are configured by default.
- Security
Contains the security descriptor for the enterprise CA i.e. the permissions for Enroll, ManageCA, and ManageCertificates edges against the enterprise CA. This security descriptor is also stored in the AD object of the enterprise CA. SharpHound collects both. The CA registry security descriptor holds the effective permissions. Changes in the CA registry security descriptor are replicated to the AD copy, however, not the other way. Therefore, collecting the CA registry security descriptor may reveal permissions of the enterprise CA that are not present if only collecting the AD object.
- PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\EditFlags
SharpHound checks if the
EDITF_ATTRIBUTESUBJECTALTNAME2 flag is present, required to calculate ADCS ESC6 edges.
The registry key values are described in detail in the Certified Pre-Owned whitepaper.
Collection and Permissions
Collection Method: SharpHound collects these registry key values via remote registry access on enterprise CAs.
Default Permissions: Authenticated Users may collect these registry key values by default, see Least-Privileged Collection - CA Registry for an explanation of why this is accessible.
