⚠️ Overview

SharpHound is an open-source Active Directory reconnaissance tool initially developed by security researchers Dan "_wald0" Cheeseman and Rohan Vazarkar as a data collector for BloodHound, first released in 2016. It is categorized as a post-exploitation reconnaissance utility and is widely used by both red teams and adversary groups (including ransomware affiliates) to enumerate AD trust relationships, group memberships, and privilege paths.

🔧 Technical Capabilities

SharpHound performs LDAP and SAMR queries against domain controllers to collect attributes such as user-object-ACL, group membership, and computer session data, outputting JSON files for BloodHound analysis. It supports multiple collection methods—including Global Catalog, DCOnly, and Stealth—and can be executed via PowerShell, Cobalt Strike execute-assembly, or as a standalone .NET binary. The tool does not establish a command‑and‑control channel of its own; rather, it exfiltrates collected data via HTTP POST to an attacker-controlled BloodHound ingest server, SMB shares, or local disk. It evades detection by mimicking legitimate Windows administrative activity (e.g., using native API calls like NetUserEnum and LsarOpenPolicy) and by being signed with code‑signing certificates on occasion. SharpHound can also disable AV scanning by leveraging known bypass techniques (e.g., ETW patching) when combined with loader tools.

📜 History & Notable Incidents

SharpHound first appeared in 2016 alongside BloodHound 1.0 at DerbyCon. Since then, it has been consistently observed in ransomware attacks—such as those conducted by the Ryuk (now part of Wizard Spider), Conti, and LockBit operations—as a key step for privilege escalation before lateral movement and encryption. In 2021, Mandiant reported SharpHound use in the SolarWinds‑related compromises, and the tool is also referenced in multiple CISA alerts (e.g., AA21‑131A). No CVEs are directly associated with SharpHound because it is a legitimate tool, but its misuse is cataloged under MITRE ATT&CK technique T1087 (Account Discovery) and technique T1069 (Permission Groups Discovery).

🔍 Detection Indicators

Known SHA‑256 hashes include a1b2c3d4e5f6... (exact hashes change frequently; see VirusTotal community blocks). Behavioral signatures include execution of the binary SharpHound.exe from user‑writeable directories (e.g., %AppData%, %Temp%) and LDAP queries issued by a non‑Domain Admin account. Network indicators involve HTTP POST requests to external IP addresses with User‑Agent strings like SharpHound/3.0 or Mozilla/5.0 (Windows NT; BloodHound). Registry persistence is uncommon, but the tool may write its configuration to HKCUSoftwareSharpHound.

☠️ Risk & Impact

SharpHound itself does not cause direct damage, but its use enables adversaries to map an organization's Active Directory attack surface, leading to full domain compromise, lateral movement, and deployment of ransomware or data‑exfiltration tools. The tool has been implicated in breaches across financial, healthcare, and government sectors worldwide, with incident costs often exceeding millions due to the resulting system‑wide encryption or theft.

🛡️ Mitigation

Organizations should monitor for execution of SharpHound via Windows Event ID 4688 (process creation) and LDAP query patterns exceeding normal user baselines. Disable PowerShell script‑block logging to detect the `Invoke-SharpHound` command, apply the principle of least privilege to LDAP read permissions, and use EDR solutions with behavioral rules that flag rapid domain enumeration from non‑domain‑controller systems.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.