Guide
How to read a BloodHound attack path
BloodHound turns an Active Directory collection into a graph, and the most valuable thing it produces is a path: a chain of relationships that lets a low-privilege principal reach Domain Admin. Reading those chains fluently is the difference between a wall of data and a prioritised fix list.
The edges you will see most
MemberOf: a user or group is a member of another group, inheriting its privileges. AdminTo: a principal is a local administrator on a computer. HasSession: a user has a session on a computer, so compromising that computer yields their credentials from memory.
The ACL edges — GenericAll, GenericWrite, WriteDacl, WriteOwner, ForceChangePassword — mean a principal can take control of an object directly. These are frequently the quiet, over-permissive grants that turn a foothold into domain compromise.
The findings that outrank paths
Some issues are severe regardless of path length. DCSync rights (GetChanges + GetChangesAll on the domain) let a principal replicate directory secrets, including the KRBTGT hash — full domain compromise in one step. Kerberoastable accounts (a Service Principal Name on an enabled user) can have their service tickets cracked offline. AS-REP roastable accounts give up a crackable hash with no credentials at all.
Unconstrained delegation on a non-domain-controller is another standing risk: the host caches the tickets of anyone who authenticates to it.
Prioritising the fix
Shortest paths first — a one-hop path to Domain Admins is a quick win for an attacker and should be a quick win for the defender too. Then the critical findings, then the longer chains.
ApexDrift ranks paths by hop count, surfaces the critical findings above them, and produces a client-ready report so the write-up is done before you have finished reading the graph.