BloodHound versus Ransomware: A Defender’s Guide

This blog post provides defensive guidance for using the free/open-source BloodHound and SharpHound to discover, assess, and reduce Active Directory attack paths frequently exploited by ransomware operators. It explains how to gauge environment exposure with targeted pathfinding, then details three proactive audits: reviewing object control over Tier 0 principals, analyzing privileged user interactive logons and sessions, and auditing local administrator rights and permissions on sensitive systems (e.g., domain controllers), enabling defenders to identify and remediate risky group nestings, excessive permissions, and unsafe administrative behaviors.