CmdID

CmdID / Commands

bloodhound-python

A Python ingestor for BloodHound, used to enumerate Active Directory relationships. tldr-pages

On several platforms 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Collect all data using default collection methods (includes groups, sessions, and trusts)

bloodhound-python --username username --password password --domain domainIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Collect data using Kerberos authentication without requiring a plaintext password

bloodhound-python --collectionmethod All --kerberos --domain domainIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Authenticate using NTLM hashes instead of a password

bloodhound-python --collectionmethod All --username username --hashes LM:NTLM --domain domainIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Specify a custom name server for DNS queries

bloodhound-python --collectionmethod All --username username --password password --domain domain --nameserver nameserverIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Save the output files as a compressed ZIP archive

bloodhound-python --collectionmethod All --username username --password password --domain domain --zipIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

What detects it

Sigma process creation rules that name bloodhound-python
highLinux HackTool ExecutionNasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])