In Active Directory (AD) security assessments, data collection is the first step. In large environments, the volume of data in BloodHound can make graphs challenging to analyze.
In Part II of our AD-RECON series, we examine the advanced Pathing and Transitive modules. These features help convert large datasets into actionable output, making it easier to identify critical attack paths without being limited by unusable graphs.
Prerequisites: This guide assumes you have AD-RECON installed and connected to your database. If you are just getting started, please review How to Triage BloodHound Data Faster for installation steps and basic configuration.
With BloodHound running and your data populated, view the help menu by running:
python3 ad-recon.py --helpThis displays available options, including the two focused on here: –pathing and –transitive.
1. Pathing Queries: Finding the Path to Domain Admin
The –pathing switch runs path-specific analysis alongside the usual default modules. This is especially useful for identifying accessible high-value targets.
Command:
python3 ad-recon.py --pathingWhen executed, AD-RECON generates output such as:
- Users with first-degree outbound rights.
- Users with paths to Domain Admin (DA).
- Groups, computers, and GPOs with interesting relationships.
The output provides critical context, such as the number of hops required to reach accounts or groups with sensitive privileges.
In the video example, we identify a user (Viserys Targaryen) who does not have the admin count flag enabled, but still has a path to DA. By cross-referencing this user in BloodHound, we see they are a member of the “Domain Users” group, which has Active Directory Certificate Services (ADCS) rights over the domain. This nested permission set effectively grants them Domain Admin privileges, a critical finding that might be missed in a crowded graph.
2. Transitive Queries: Uncovering Nested Rights
Transitive queries let you look deeper into outbound rights that propagate through group memberships.
Command:
python3 ad-recon.py --transitiveThis switch helps investigate the following:
- Users with Outbound Transitive Rights: Identifying where a user has enrollment rights or generic rights over other objects via nested groups.
- Common Groups (e.g., Domain Users): In our demo, we analyze the Domain Users group to find excessive permissions, like enrollment rights across the domain.
- Computer Outbound Transitive Rights: We examine a specific machine and find it has GenericAll privileges over a Certificate Authority (CA) server. This is a significant escalation path derived from a nested group permission.
The Scale Problem
In small datasets, you can often visually spot these issues in BloodHound. In enterprise environments with thousands of users and systems, the graphs become illegible without targeted searching.
AD-RECON acts as a filter, allowing you to quickly identify specific systems or users that require manual investigation.
Watch the Full Walkthrough
Watch the full video below as we walk through command-line execution and analyze the results in BloodHound.
Resources:
- Download the Tool: https://github.com/tid35/ad-recon
- Read the Documentation: https://github.com/tid35/ad-recon#getting-started
Stay tuned for Part III, where we cover extending AD-RECON with custom query development.
Frequently Asked Questions
What is the difference between –pathing and –transitive?
The –pathing switch focuses on direct and multi-hop routes to high-value targets like Domain Admin. It tells you who has a path and how many steps it takes to get there. The –transitive switch goes deeper into group membership chains, surfacing rights that a user or computer holds indirectly through nested group memberships.
Do I need BloodHound Community Edition or Enterprise for AD-RECON to work?
AD-RECON works with BloodHound Community Edition. It communicates directly with the Neo4j backend using the Python Neo4j driver. As long as your BloodHound instance is running and your data is ingested, AD-RECON will connect to it. The config.toml file lets you point the tool at local, remote, or Docker-based Neo4j instances.
What does it mean when a user has a path to Domain Admin but the admin count flag is not set?
The adminCount attribute is only set on accounts that are currently, or were previously, members of a protected group. A user without that flag is not under SDProp protection, meaning their permissions are less likely to be audited or flagged. When AD-RECON identifies these accounts, it signals a path that defensive tooling and manual reviews often miss.
How do I know which transitive rights are worth investigating first?
Start with rights over Certificate Authorities and Domain Controllers. GenericAll or enrollment rights over a CA are high-priority findings because they often lead directly to domain compromise without requiring credential theft. From there, focus on any object where a transitive chain originates from a broad group like Domain Users.
When will Part III of the AD-RECON series be published?
Part III will cover custom query development, extending AD-RECON beyond its built-in modules. Check back on the BreakPoint Labs blog or follow us on LinkedIn for updates.
About the Author
Luke Hudson is a Senior Offensive Security Engineer at BreakPoint Labs, where he applies deep technical expertise to assess client systems against advanced adversarial threats. He is an expert in adversarial tradecraft, specifically in payload development and bypassing endpoint detection (AV/EDR), leading engagements from initial planning through execution and reporting. Luke holds a variety of advanced certifications, including OSCE, OSEP, OSCP, CRTL, and CISSP.