BloodHound/SharpHound AD Enumeration for Domain Trust and Privilege Mapping

Ibrahim Saud@tektrix

•updated Jun 25, 2026•2•0•6

This rule detects the execution of the BloodHound or SharpHound Active Directory enumeration tools by monitoring for specific process names, command-line arguments associated with the tool's common flags (e.g., --CollectionMethod, --ZipFileName), and file paths containing these tool names.