Effective Active Directory (AD) analysis often requires interpreting large amounts of data to identify real risks. While BloodHound is the industry standard for graphing these relationships, manual analysis can be arduous, especially with large datasets.

BreakPoint Labs developed AD-RECON, a Python utility that quickly triages BloodHound data to address this challenge.

Senior Offensive Security Engineer Luke Hudson provides a technical walkthrough to help security practitioners get started with this capability. The guide shows how to configure the tool and start identifying escalation paths right away.

Optimizing the Assessment Workflow

How does AD-RECON fit into your workflow? AD-RECON bridges the gap between raw data ingestion and actionable findings in Bloodhound. It works by communicating directly with the Neo4j backend, automating impactful queries that usually require manual analysis.

For Red Teams and Penetration Testers, this automation enables quick wins early in analysis, reduces the strain of analyzing complex datasets, and allows operators to focus more on executing the engagement.

For Blue Teams and Defenders, it provides a repeatable way to quickly audit Active Directory health and potentially uncover latent risks before they are exploited.

Technical Breakdown & Capabilities

1. Prerequisites & System Requirements

AD-RECON is lightweight and intended to work with all recent versions of Python 3.

  • Dependencies: AD-RECON utilizes the Python Neo4j driver for communication and querying of the Neo4j database. It supports the Neo4j Rust driver extension for faster queries.
  • Data Source: A bloodhound Neo4j instance with engagement data. AD-RECON supports analysis across multiple Bloodhound instances via configuration in config.toml file.

2. Automating “Quick Wins.”

AD-RECON’s core value is its ability to rapidly parse the Bloodhound database for misconfigurations or interesting targets for further analysis. This is especially impactful for identifying escalation paths, especially when visualizing the data becomes unrealistic.

The tool automates the detection of critical vectors, including:

  • Privilege Escalation Risks: Detecting Kerberoasting and AS-REP Roasting opportunities.
  • Infrastructure Vulnerabilities: Identifying Certificate Template Abuse and Delegation Permissions.
  • Account Hygiene: Flagging “Ghost Accounts” (enabled accounts with no authentication history).

3. Customization & Extensibility

AD-RECON is designed to be extensible. While it includes our team’s most effective queries, users can add their own Cypher queries. The config.toml file provides flexible configuration, letting you easily connect to local or remote Neo4j databases, which is ideal for teams on shared instances.

Step-by-Step Command Reference

For those following along with the video, here are the specific commands required to get up and running:

1. Environment Preparation: Ensure you have Bloodhound installed and running, and that data is successfully ingested. AD-RECON supports any recent version of Neo4j and Bloodhound (local, remote, or Docker installation). The demo video utilizes Bloodhound CE version 8.3.1 from the Kali apt repo.

2. Cloning the Repository Pull down the tool from GitHub and navigate into the directory:

git clone https://github.com/tid35/ad-recon.git
cd ad-recon

3. Setting Up a Virtual Environment. It is highly recommended to use a virtual environment.

python3 -m venv ad-recon-demo
source ad-recon-demo/bin/activate

4. Installing Dependencies: Install the required Neo4j driver and Toml parser at minimum, though some additional dependencies can be helpful for analyzing output:

pip3 install -r requirements.txt

Configuration (config.toml) Open the config.toml file to configure your database connection.

  • URL: Defaults to bolt://localhost:7687 (Change this if using a remote instance or non-standard port).
  • Credentials: Use the username and password for the Neo4j backend that was configured during Bloodhound setup (NOT the Bloodhound GUI account).

6. Running AD-RECON

AD-RECON help:

python3 ad-recon.py -h

Run default queries:

python3 ad-recon.py

List all available queries:

python3 ad-recon.py -L

Execute a specific query (e.g., List admincount=true users):

python3 ad-recon.py -Q get_adminUsers

Conclusion

AD-RECON enables operators to perform Active Directory analysis quickly and reliably, reducing the overhead required to analyze complex environments.

Resources:

Next Steps:

Now that you have the tool configured and your “quick wins” identified, it is time to tackle the complex graphs. In Part II, we cover:

  • Pathing Queries: Finding users with hidden paths to Domain Admin.
  • Transitive Rights: Uncovering nested permissions that standard triage misses.

Check out Part II: Analyzing Attack Paths and Transitive Rights

Frequently Asked Questions (FAQ)

Q: How can AD-RECON be integrated into automated pipelines or CI/CD? AD-RECON can be easily integrated into automated Red Team pipelines or CI/CD workflows. You can simply call the script with the necessary flags (e.g., -Q get_adminUsers or –transitive) and export the output for downstream analysis.

Q: What is the output format? Can findings be exported? AD-RECON outputs finding data to the console and to text-based output. Users can use the –dump flag to print raw queries for reporting or analysis. The upcoming 2.0 update of AD-RECON will support additional reporting formats. 

Q: Is it compatible with the latest versions of BloodHound? AD-RECON communicates directly with the Neo4j backend database using Cypher queries. As long as the database structure is intact, it is designed to work with virtually any version of BloodHound (including modern forks) and is regularly tested against recent updates. The Neo4j driver supports Bolt versions 4.4-6.0, though older versions of the driver can be installed to support especially out-of-date instances of Neo4j.

Q: Are there real-world examples of its impact? On most Active Directory networks where we deploy AD-RECON, it uncovers at least one significant misconfiguration that had previously gone unnoticed. We routinely use it to identify obscure Attack Paths, such as legacy object permissions or trust relationships where manual visual analysis fails.

Q: Where can I get support or share custom queries? We encourage community collaboration. The project is hosted on GitHub, where users can submit issues for troubleshooting, contribute new detection logic via Pull Requests, or discuss use cases.

Author Image

About the Author

Luke Hudson is a Senior Offensive Security Engineer at BreakPoint Labs, where he applies deep technical expertise to assess client systems against advanced adversarial threats. He is an expert in adversarial tradecraft, specifically in payload development and bypassing endpoint detection (AV/EDR), leading engagements from initial planning through execution and reporting. Luke holds a variety of advanced certifications, including OSCE, OSEP, OSCP, CRTL, and CISSP.