In Active Directory (AD) security assessments, data collection is the first step. In large environments, the volume of data in BloodHound can make graphs challenging to analyze.
In Part II of our AD-RECON series, we examine the advanced Pathing and Transitive modules. These features help convert large datasets into actionable output, making it easier to identify critical attack paths without being limited by unusable graphs.
Prerequisites: This guide assumes you have AD-RECON installed and connected to your database. If you are just getting started, please review How to Triage BloodHound Data Faster for installation steps and basic configuration.
With BloodHound running and your data populated, view the help menu by running:
python3 ad-recon.py --helpThis displays available options, including the two focused on here: –pathing and –transitive.
The –pathing switch runs path-specific analysis alongside the usual default modules. This is especially useful for identifying accessible high-value targets.
Command:
python3 ad-recon.py --pathingWhen executed, AD-RECON generates output such as:
The output provides critical context, such as the number of hops required to reach accounts or groups with sensitive privileges.
In the video example, we identify a user (Viserys Targaryen) who does not have the admin count flag enabled, but still has a path to DA. By cross-referencing this user in BloodHound, we see they are a member of the “Domain Users” group, which has Active Directory Certificate Services (ADCS) rights over the domain. This nested permission set effectively grants them Domain Admin privileges, a critical finding that might be missed in a crowded graph.
Transitive queries let you look deeper into outbound rights that propagate through group memberships.
Command:
python3 ad-recon.py --transitiveThis switch helps investigate the following:
The Scale Problem
In small datasets, you can often visually spot these issues in BloodHound. In enterprise environments with thousands of users and systems, the graphs become illegible without targeted searching.
AD-RECON acts as a filter, allowing you to quickly identify specific systems or users that require manual investigation.
Watch the full video below as we walk through command-line execution and analyze the results in BloodHound.
Resources:
Stay tuned for Part III, where we cover extending AD-RECON with custom query development.
The –pathing switch focuses on direct and multi-hop routes to high-value targets like Domain Admin. It tells you who has a path and how many steps it takes to get there. The –transitive switch goes deeper into group membership chains, surfacing rights that a user or computer holds indirectly through nested group memberships.
AD-RECON works with BloodHound Community Edition. It communicates directly with the Neo4j backend using the Python Neo4j driver. As long as your BloodHound instance is running and your data is ingested, AD-RECON will connect to it. The config.toml file lets you point the tool at local, remote, or Docker-based Neo4j instances.
The adminCount attribute is only set on accounts that are currently, or were previously, members of a protected group. A user without that flag is not under SDProp protection, meaning their permissions are less likely to be audited or flagged. When AD-RECON identifies these accounts, it signals a path that defensive tooling and manual reviews often miss.
Start with rights over Certificate Authorities and Domain Controllers. GenericAll or enrollment rights over a CA are high-priority findings because they often lead directly to domain compromise without requiring credential theft. From there, focus on any object where a transitive chain originates from a broad group like Domain Users.
Part III will cover custom query development, extending AD-RECON beyond its built-in modules. Check back on the BreakPoint Labs blog or follow us on LinkedIn for updates.
Luke Hudson is a Senior Offensive Security Engineer at BreakPoint Labs, where he applies deep technical expertise to assess client systems against advanced adversarial threats. He is an expert in adversarial tradecraft, specifically in payload development and bypassing endpoint detection (AV/EDR), leading engagements from initial planning through execution and reporting. Luke holds a variety of advanced certifications, including OSCE, OSEP, OSCP, CRTL, and CISSP.
Effective Active Directory (AD) analysis often requires interpreting large amounts of data to identify real risks. While BloodHound is the industry standard for graphing these relationships, manual analysis can be arduous, especially with large datasets.
BreakPoint Labs developed AD-RECON, a Python utility that quickly triages BloodHound data to address this challenge.
Senior Offensive Security Engineer Luke Hudson provides a technical walkthrough to help security practitioners get started with this capability. The guide shows how to configure the tool and start identifying escalation paths right away.
How does AD-RECON fit into your workflow? AD-RECON bridges the gap between raw data ingestion and actionable findings in Bloodhound. It works by communicating directly with the Neo4j backend, automating impactful queries that usually require manual analysis.
For Red Teams and Penetration Testers, this automation enables quick wins early in analysis, reduces the strain of analyzing complex datasets, and allows operators to focus more on executing the engagement.
For Blue Teams and Defenders, it provides a repeatable way to quickly audit Active Directory health and potentially uncover latent risks before they are exploited.
1. Prerequisites & System Requirements
AD-RECON is lightweight and intended to work with all recent versions of Python 3.
n config.toml file.2. Automating “Quick Wins.”
AD-RECON’s core value is its ability to rapidly parse the Bloodhound database for misconfigurations or interesting targets for further analysis. This is especially impactful for identifying escalation paths, especially when visualizing the data becomes unrealistic.
The tool automates the detection of critical vectors, including:
3. Customization & Extensibility
AD-RECON is designed to be extensible. While it includes our team’s most effective queries, users can add their own Cypher queries. The config.toml file provides flexible configuration, letting you easily connect to local or remote Neo4j databases, which is ideal for teams on shared instances.
For those following along with the video, here are the specific commands required to get up and running:
1. Environment Preparation: Ensure you have Bloodhound installed and running, and that data is successfully ingested. AD-RECON supports any recent version of Neo4j and Bloodhound (local, remote, or Docker installation). The demo video utilizes Bloodhound CE version 8.3.1 from the Kali apt repo.
2. Cloning the Repository Pull down the tool from GitHub and navigate into the directory:
git clone https://github.com/tid35/ad-recon.git
cd ad-recon
3. Setting Up a Virtual Environment. It is highly recommended to use a virtual environment.
python3 -m venv ad-recon-demo
source ad-recon-demo/bin/activate
4. Installing Dependencies: Install the required Neo4j driver and Toml parser at minimum, though some additional dependencies can be helpful for analyzing output:
pip3 install -r requirements.txt
Configuration (config.toml) Open the config.toml file to configure your database connection.
bolt://localhost:7687 (Change this if using a remote instance or non-standard port).6. Running AD-RECON
AD-RECON help:
python3 ad-recon.py -hRun default queries:
python3 ad-recon.pyList all available queries:
python3 ad-recon.py -LExecute a specific query (e.g., List admincount=true users):
python3 ad-recon.py -Q get_adminUsers
AD-RECON enables operators to perform Active Directory analysis quickly and reliably, reducing the overhead required to analyze complex environments.
Resources:
Now that you have the tool configured and your “quick wins” identified, it is time to tackle the complex graphs. In Part II, we cover:
Check out Part II: Analyzing Attack Paths and Transitive Rights
Q: How can AD-RECON be integrated into automated pipelines or CI/CD? AD-RECON can be easily integrated into automated Red Team pipelines or CI/CD workflows. You can simply call the script with the necessary flags (e.g., -Q get_adminUsers or –transitive) and export the output for downstream analysis.
Q: What is the output format? Can findings be exported? AD-RECON outputs finding data to the console and to text-based output. Users can use the –dump flag to print raw queries for reporting or analysis. The upcoming 2.0 update of AD-RECON will support additional reporting formats.
Q: Is it compatible with the latest versions of BloodHound? AD-RECON communicates directly with the Neo4j backend database using Cypher queries. As long as the database structure is intact, it is designed to work with virtually any version of BloodHound (including modern forks) and is regularly tested against recent updates. The Neo4j driver supports Bolt versions 4.4-6.0, though older versions of the driver can be installed to support especially out-of-date instances of Neo4j.
Q: Are there real-world examples of its impact? On most Active Directory networks where we deploy AD-RECON, it uncovers at least one significant misconfiguration that had previously gone unnoticed. We routinely use it to identify obscure Attack Paths, such as legacy object permissions or trust relationships where manual visual analysis fails.
Q: Where can I get support or share custom queries? We encourage community collaboration. The project is hosted on GitHub, where users can submit issues for troubleshooting, contribute new detection logic via Pull Requests, or discuss use cases.
Luke Hudson is a Senior Offensive Security Engineer at BreakPoint Labs, where he applies deep technical expertise to assess client systems against advanced adversarial threats. He is an expert in adversarial tradecraft, specifically in payload development and bypassing endpoint detection (AV/EDR), leading engagements from initial planning through execution and reporting. Luke holds a variety of advanced certifications, including OSCE, OSEP, OSCP, CRTL, and CISSP.