BloodHound
Software · ATTACK:enterprise:S0521
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0521",
"title": "BloodHound",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0521",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--066b057c-944e-4cfc-b654-e3dfba04b926",
"external_id": "S0521",
"domain": "enterprise",
"created": "2020-10-28T12:51:29.358Z",
"modified": "2025-03-12T20:27:03.654Z",
"version": "1.7",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "FoxIT Wocao December 2019",
"url": "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"
},
{
"source_name": "CrowdStrike BloodHound April 2018",
"url": "https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/"
},
{
"source_name": "GitHub Bloodhound",
"url": "https://github.com/BloodHoundAD/BloodHound"
}
]
}Explicit source assertions (18)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:S0521
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0473a627-abe8-4cfe-9574-a15c1c33da29
FoxIT Wocao December 2019ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1280542b-4574-4567-ad3d-76692271699e
CrowdStrike BloodHound April 2018ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1615
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14debfee-3a2d-4184-8f2a-bc07977ce909
GitHub BloodhoundATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2762485e-c8a2-4bbe-b3d8-8b20ca70197b
Trend Micro Black Basta October 2022 · GitHub BloodhoundATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0521
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b3c27ed-0129-48bf-8c79-e86d73e5b212
DHS/CISA Ransomware Targeting Healthcare October 2020 · FireEye KEGTAP SINGLEMALT October 2020 · Sophos New Ryuk Attack October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0521
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41760330-2558-4781-bc4e-1e4c7a1f5f92
ESET T3 Threat Report 2021ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1069.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42a87d45-8dd1-4767-a6a2-d7bd19d3b0ef
CrowdStrike BloodHound April 2018ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e2594cc-f6e0-4153-b878-930bc03fc0ad
CrowdStrike BloodHound April 2018ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:S0521
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5db02c00-0d28-4831-bad9-66737bb62eca
Cycraft Chimera April 2020ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63895b27-aeba-4001-8039-b7b1bc41f8fc
CrowdStrike BloodHound April 2018ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73717937-3d8f-402d-a222-b40d15a49cea
CrowdStrike BloodHound April 2018ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0521
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77d30a4e-d267-4416-85f2-edebc0a6af29
NCC Group TA505ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--841f6044-8c12-4063-b911-d1da4c8d6fdc
CrowdStrike BloodHound April 2018ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d512a95-702d-4670-ab33-069552494102
GitHub BloodhoundATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a62885f2-38a3-4030-b28d-bff5b3d692df
CrowdStrike BloodHound April 2018ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a79a17c4-02d1-463f-ac0a-d62b20d10b2f
CrowdStrike BloodHound April 2018ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0521
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c46ab316-6976-41ab-87ea-97f9d435b6cc
Trend Micro Ransomware Spotlight Play July 2023ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0521
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9ed5461-b123-4cb8-88e7-b24675858747
CISA GRU29155 2024