Cato CTRL™ Threat Research: Overview of BloodHound and Associated Collectors Including ShadowHound, SharpHound, and SoapHound 

This report analyzes BloodHound and three associated collectors (SharpHound, SoapHound, ShadowHound), detailing how each gathers Active Directory data (LDAP, SMB/DCERPC, ADWS), their stealth and evasion capabilities, differences in deployment (binaries vs PowerShell), practical defensive and offensive uses, and detection strategies to identify large-scale AD enumeration that could lead to privilege escalation and lateral movement.