How to detect BloodHound and Active Directory enumeration

Threat snapshot

Active Directory enumeration is the reconnaissance phase that every sophisticated attack against an AD environment goes through. Before an attacker can escalate privileges, move laterally, or deploy ransomware, they need to understand the environment: which accounts exist, which groups have administrative rights, which machines are domain-joined, which service accounts have delegated permissions, and which attack paths exist from their current position to Domain Admin.

BloodHound changed the economics of this reconnaissance permanently. Before BloodHound, mapping AD attack paths required hours of manual LDAP queries and careful analysis. BloodHound automated that analysis entirely, ingesting bulk AD data collected by its companion tool SharpHound and producing a graph-based visualization of every privilege escalation path in the domain within minutes. An attacker who runs SharpHound from a single compromised workstation with a standard domain user account now has a complete map of the shortest path to Domain Admin before the SOC has even noticed the initial compromise.

What is less well understood is that BloodHound and SharpHound are not the only tools in this category. AdFind, SOAPHound, SharpView, net.exe, and ADExplorer all perform AD enumeration using different methods and leave different log signatures. A detection strategy that only looks for SharpHound process creation will miss the majority of AD enumeration activity in practice. This page covers the full spectrum of enumeration tooling and the detection rules Log360 uses to catch each variant.

AD enumeration, at a glance

How AD enumeration attacks work

AD enumeration is not a single technique but a collection of methods for querying the directory to understand its structure. Different tools use different query mechanisms, leave different log signatures, and provide different types of information to the attacker. Understanding the method determines the detection approach.

SharpHound and SOAPHound: bulk LDAP collection for BloodHound

SharpHound is the data collection component of the BloodHound toolkit. When executed, it performs a series of bulk LDAP queries against the domain controller to retrieve all users, computers, groups, group memberships, organizational units, GPOs, and access control entries. It also queries each domain-joined machine via SMB and RPC to map local administrators and session information. The collected data is written to a set of JSON files that are ingested by the BloodHound analysis application to produce an attack path graph.

SOAPHound is a newer alternative to SharpHound that performs the same enumeration but uses the Active Directory Web Services (ADWS) interface instead of LDAP. ADWS operates on TCP port 9389 and uses a SOAP-based protocol, which means it bypasses LDAP-based detection and monitoring tools. For environments that are not monitoring ADWS connections, SOAPHound enumeration is largely invisible. The Uncommon Connection to Active Directory Web Services and HackTool - SOAPHound Execution rules address this gap directly.

Log signals: Sysmon Event 1 with SharpHound or SOAPHound binary signatures. High-volume LDAP queries from a single non-DC source within a short time window (SharpHound's bulk collection is characteristically loud in LDAP logs). Network connections to TCP 9389 from non-standard hosts (SOAPHound via ADWS).

AdFind: targeted LDAP queries via command-line

AdFind.exe is a standalone command-line LDAP query tool that has been used in AD enumeration for over a decade. Unlike SharpHound, which performs a comprehensive collection run, AdFind is used for targeted queries: finding specific user attributes, listing group memberships, querying for accounts with specific properties such as unconstrained delegation, or enumerating organizational unit structures. AdFind does not require installation and runs from any accessible path, making it a living-off-the-land-adjacent tool that has historically been underdetected.

AdFind is explicitly named in multiple ransomware operator playbooks (including leaked Conti documentation) as a standard pre-ransomware enumeration tool. Its presence on a machine that is not a known IT administration workstation is a high-confidence indicator of active attack reconnaissance.

Log signals: Sysmon Event 1 with AdFind.exe process creation. Common AdFind command-line patterns include -b dc=domain,dc=com -f objectcategory=computer for computer enumeration and -b cn=users -f objectcategory=person for user enumeration.

ADExplorer: GUI-based AD snapshot

ADExplorer is a Sysinternals tool from Microsoft that provides a graphical interface for browsing Active Directory. While legitimate in IT administration contexts, attackers use its snapshot feature to capture the entire AD database to a local file in a single operation. An ADExplorer snapshot contains all AD objects, attributes, and relationships in a format that can be analyzed offline without any further network connectivity. This makes it particularly useful for exfiltration: the attacker takes the snapshot, exfiltrates the file, and analyzes the AD structure at leisure without generating any further LDAP traffic. Two rules cover this: one for standard ADExplorer database snapshot usage and one for the pattern identified as suspicious based on context.

Log signals: Sysmon Event 1 with ADExplorer process creation and the -snapshot argument. File creation events for .dat files in user-writable paths following ADExplorer execution.

Net.exe, SharpView, SharpShares, Csvde, and PsLogList

Net.exe is a Windows built-in utility that can enumerate local and domain groups, users, and sessions. While entirely legitimate in isolation, a pattern of net.exe commands targeting domain group membership (net group "Domain Admins" /domain, net user /domain) executed from a non-administrative context within a short window is characteristic of manual or scripted AD reconnaissance. SharpView is a .NET reimplementation of PowerView that performs the same queries but through a compiled binary rather than a PowerShell script, making it harder to detect via PowerShell script block logging.

SharpShares enumerates network file shares across all domain-joined machines, providing the attacker with a map of accessible data repositories. Csvde.exe is a Windows built-in that exports AD objects to CSV files, and PsLogList is a Sysinternals tool for remotely reading event logs from other machines, both of which are abused for AD data collection in the reconnaissance phase.

Log signals: Sysmon Event 1 for SharpView, SharpShares, and PsLogList process creation. Windows process creation audit (Event 4688) for net.exe with domain enumeration arguments. Sysmon Event 1 for csvde.exe with arguments indicating bulk AD object export.

Real-world campaigns

Conti ransomware: AdFind as standard pre-encryption reconnaissance

The 2021 Conti ransomware playbook leak provided a rare inside view of how a major ransomware operation structures its AD enumeration phase. The leaked documentation explicitly references AdFind.exe as the standard tool for domain reconnaissance, with specific command-line examples for enumerating domain controllers, all computers, all users, organizational unit structures, and trust relationships. The enumeration typically occurs within the first two hours of domain access, before any lateral movement begins, and the output is used to identify the shortest path to domain-wide ransomware deployment. The Conti playbook's reliance on AdFind is why the PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE rule is particularly valuable: it directly catches a technique confirmed in documented ransomware operator tradecraft.

APT campaigns: SharpHound and SOAPHound for pre-APT attack path mapping

Multiple APT groups have been documented using BloodHound and SharpHound as standard tools in their post-compromise AD reconnaissance phase. The appeal is the same as for ransomware operators: SharpHound automates what would otherwise require extensive manual LDAP work and delivers a complete privilege escalation map within minutes. More recently, sophisticated threat actors have shifted to SOAPHound specifically to avoid LDAP-based detection deployed in response to SharpHound detections, underlining why ADWS-based detection (Uncommon Connection to Active Directory Web Services and HackTool - SOAPHound Execution) is a necessary complement to process-level detection.

Tool reference table

Business impact

• Enumeration is the prerequisite for everything that follows. An attacker who has not enumerated the AD environment is operating blind. An attacker who has run SharpHound has a complete map of every privilege escalation path, every misconfiguration, and every high-value target in the domain. Detecting and stopping enumeration before it completes denies the attacker the intelligence they need to execute targeted follow-on attacks.
• Low bar to execute, high value of output. Every tool in this category requires only a standard domain user account to run. No elevated privileges, no special access, no vulnerability exploitation. A single compromised employee workstation is sufficient to run SharpHound and collect a complete AD map. This makes enumeration one of the earliest and most reliable signals of an active intrusion beyond the initial foothold phase.
• Offline analysis eliminates time pressure. Tools like ADExplorer's snapshot feature and Csvde export allow the attacker to collect the entire AD dataset and exfiltrate it for offline analysis, meaning subsequent attack planning generates no further AD query traffic. Detection after the snapshot is taken but before exfiltration is the last reliable opportunity to prevent the attacker from having a complete AD map.
• Enumeration feeds downstream attacks at scale. SharpHound output directly feeds BloodHound's attack path analysis, which identifies Kerberoastable accounts, accounts with unconstrained delegation, users with DCSync rights, and ACL abuse paths. Each of these findings becomes a discrete exploitation opportunity. A single SharpHound run can identify dozens of attack paths that an attacker can pursue independently over days or weeks.

Detecting BloodHound and AD enumeration with Log360

Log360's 12 detection rules cover all major AD enumeration tools across two detection approaches: process creation signatures (catching the tool at the moment of execution via Sysmon Event 1) and behavioral anomaly rules (catching unusual LDAP query patterns, ADWS connections, and reconnaissance activity that may not match a specific tool signature). For process-creation-based rules, Sysmon must be deployed on domain-joined endpoints with process creation logging (Event 1) forwarding to Log360. For LDAP and ADWS-based rules, Active Directory audit logs and network connection logs must be forwarding from domain controllers.

BloodHound and SOAPHound detection

AdFind and ADExplorer detection

Built-in and Sysinternals tool abuse

Attack chain visibility

AD enumeration is not a standalone attack; it is the reconnaissance phase of a broader intrusion. The sequences below show what the enumeration phase looks like in the logs and how it connects to the lateral movement and privilege escalation phases that follow.

Sequence A: SharpHound collection followed by Kerberoasting

Sequence B: AdFind reconnaissance in ransomware pre-positioning

Investigation playbook

When an AD enumeration detection rule fires, the most important question is not just "which tool ran" but "what did the attacker learn and what are they likely to do next." Enumeration is a means to an end; the investigation goal is to understand the scope of information collected and anticipate the next attack phase before it starts.

Step 1: Triage - identify the tool and scope of collection

Step 2: Determine the scope of what was collected

• For process-based detections, retrieve the full command-line arguments from the Sysmon Event 1 record. The command line tells you exactly what the tool was configured to collect: all objects (broad collection indicating pre-BloodHound ingestion) or specific attributes (targeted reconnaissance indicating a more specific objective).
• For SharpHound or SOAPHound, check whether JSON output files were created on the host (file creation events in Sysmon). The presence of the output files confirms collection completed. The absence may indicate the collection was interrupted by the detection and response, which is a meaningful win.
• For ADExplorer snapshots, check the file path and size of the created snapshot file. A multi-gigabyte .dat file confirms a complete AD snapshot was taken. Check immediately for outbound network transfers of that file size or the specific file path.
• Check whether multiple enumeration tools ran on the same host in the same session. A host that ran AdFind followed by SharpHound followed by Rubeus within an hour is further along in the attack chain than one that only ran a single tool.

Step 3: Investigate using the Incident Workbench

• Click on the source hostname or compromised account username in the alert to open the Incident Workbench. Use the Process analytics tab to view the full process tree on the source host. This shows what spawned the enumeration tool, what ran before it (indicating how the attacker got to that host), and what ran after it (indicating what they did with the collected data).
• Use the User analytics tab to check the UEBA risk score and activity baseline for the account that ran the enumeration tool. A standard domain user account suddenly running SharpHound or AdFind is a maximum-anomaly behavioral event. The User analytics tab also shows recent logon history, helping identify whether the account was used from unusual locations or at unusual times.
• Use Advanced Threat Analytics on any external IPs involved (for example, if the host made connections to external IPs following the enumeration run, which may indicate C2 communication or data exfiltration).
• Save the Incident Workbench session to an incident. The process tree and user activity timeline from this session are the primary evidence record for determining the full scope of the compromise.

Step 4: Anticipate the next attack phase

• If SharpHound or SOAPHound completed collection, the attacker now has a complete attack path map. Expect Kerberoasting (TGS requests for service accounts with SPNs), AS-REP roasting (TGT requests for accounts without pre-auth), DCSync attempts, or targeted lateral movement to machines identified as stepping stones to Domain Admin. Monitor for these patterns immediately.
• If AdFind queried for computers or domain controllers, expect lateral movement attempts from the source host to those machines within hours. Monitor for Event 4624 (Type 3 logons) from the source host IP to other machines.
• If SharpShares ran, the attacker knows where data is stored. Monitor for unusual file access from the source account to file servers identified during the share enumeration, particularly large-volume reads or access to directories the account has never previously accessed.
• Check whether any accounts identified by the enumeration (domain admins, service accounts with SPNs, accounts with DCSync rights) show anomalous activity in the hours following the enumeration event. UEBA score spikes on these accounts are the earliest indicator that the attacker is moving from reconnaissance to exploitation.

Step 5: Collect evidence and build the timeline

• Export Sysmon Event 1 logs from the source host covering the attack window. Preserve the full command-line field for each enumeration tool invocation.
• Export AD LDAP query logs from domain controllers for the relevant time period, showing the query volume and patterns from the source host. This documents what was queried even if the process-creation log has gaps.
• If an ADExplorer snapshot was created, preserve the file creation event including file path, size, and timestamp. Check whether the file was subsequently accessed or transferred.
• Export the Incident Workbench session timeline from Log360 as the compliance artifact for NIST CSF DE.AE-5 and HIPAA Section 164.308(a)(6) incident procedures documentation.

Response and remediation

Immediate containment

• Isolate the source host. The machine that ran the enumeration tool is the attacker's operational workstation for this phase of the attack. Isolation prevents the attacker from using the collected AD data for immediate follow-on attacks from that machine and from running additional enumeration tools.
• Disable the account used to run the enumeration. Whether the account belongs to a compromised employee or is a service account, disable it immediately. A standard domain user account running SharpHound or AdFind indicates credential compromise; the account should be treated as attacker-controlled until investigation confirms otherwise.
• Locate and delete any collected output files. For SharpHound JSON files, ADExplorer snapshots, and Csvde CSV exports, identify the file paths from the Sysmon logs and delete them before they can be exfiltrated. Check staging directories (user temp, downloads, and any custom output paths specified in the tool command line).
• Alert on accounts identified as high-value targets by the enumeration. If the tool queried for Domain Admins, Kerberoastable accounts, or accounts with DCSync rights, place those accounts under enhanced monitoring immediately. Any anomalous activity from those accounts in the hours following the enumeration event should be treated as active exploitation.

Response actions by trigger

Hardening

• Deploy Sysmon on all domain-joined endpoints with a configuration that captures process creation (Event 1) including full command-line logging. Most of the detection rules in this use case depend on Sysmon Event 1. Without Sysmon, process-creation-based detection of enumeration tools is not possible.
• Enable LDAP query logging on domain controllers to capture the query volume and patterns that SharpHound and similar tools generate. LDAP diagnostic logging can be enabled via the Windows registry: set HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics\16 Field Engineering to 5.
• Restrict access to ADWS (TCP 9389) via host firewall rules on domain controllers to only allow connections from known IT administration workstations and servers. This prevents SOAPHound from reaching the ADWS interface from arbitrary workstations.
• Block known enumeration tool binaries via AppLocker or WDAC for standard user accounts. SharpHound, SOAPHound, AdFind, SharpView, and SharpShares have no legitimate use by standard domain users. Blocking execution of these binaries from user-writable paths eliminates a large class of enumeration attempts.
• Audit and restrict LDAP query permissions. Standard users should not be able to query all user objects, all computer objects, and all group memberships in a single session. Implementing LDAP query result size limits and requiring authenticated binding for privileged attribute queries reduces the effectiveness of bulk collection tools.

False positive tuning