How do you detect BloodHound and SharpHound?

Detect SharpHound by making its traffic visible and looking for fan-out. Enable Event 1644 LDAP search logging on a subset of Domain Controllers, with lowered thresholds, and alert on a single client returning thousands of entries with wide filters. Use Event 5145 or Zeek to find one source touching srvsvc or samr on many hosts in minutes. Correlate LDAP and SMB signals in the same window, detect the binaries and output files on endpoints, and exclude known scanners and inventory tools by source.

Detecting BloodHound and SharpHound Recon: LDAP Bursts and SMB Session Queries

BloodHound maps attack paths by collecting users, groups, ACLs, sessions and local-admin relationships. The collector does that with wide LDAP queries against Domain Controllers and with SMB and SAMR calls against many endpoints. Neither is hidden, but neither is logged by default, so the first job is turning the visibility on.

Signals at a Glance

Signal	Where	ATT&CK
Wide LDAP searches returning thousands of entries from one client	DC Directory Service 1644	T1087.002
Filters for samAccountType, objectCategory=* and delegation attributes	DC 1644, MDI	T1069.002
One source touching srvsvc on many hosts (NetSessionEnum)	Security 5145, Zeek smb	T1018
SAMR local-group and member enumeration across hosts	Security 4798, 4799, 5145	T1069.001
SharpHound binary, zip or JSON output on disk	EDR, file events	T1087

LDAP: Make It Visible First

Event ID 1644 in the Directory Service log records expensive, inefficient or long-running searches along with the client address, filter and entry counts, but only if you lower the thresholds and raise the diagnostic level. It can be voluminous, so enable it on a subset of Domain Controllers and watch performance:

rem tune/validate: test first; logging every search is costly on busy DCs
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics" /v "15 Field Engineering" /t REG_DWORD /d 5 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" /v "Expensive Search Results Threshold" /t REG_DWORD /d 1000 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" /v "Inefficient Search Results Threshold" /t REG_DWORD /d 1000 /f

index=wineventlog source="WinEventLog:Directory Service" EventCode=1644
| rex "Client:\s*(?<client>[^:\s]+)"
| rex "Entries returned:\s*(?<returned>\d+)"
| rex "Filter:\s*(?<filter>.+)"
| where tonumber(returned) > 1000
| bin _time span=10m
| stats count sum(returned) AS total_entries dc(filter) AS filters values(filter) AS sample by _time, client
| where count >= 5
# tune/validate: exclude your IAM, sync and vulnerability tooling by client IP.

SMB and SAMR Sweeps

The session and local-admin collection methods contact many endpoints in quick succession. That fan-out is the most robust signal, since the collector can rename itself but not avoid the calls. Detailed file share auditing records the pipe names:

SecurityEvent
| where EventID == 5145 and ShareName endswith "IPC$"
| where RelativeTargetName in~ ("srvsvc", "samr", "wkssvc")
| summarize hosts = dcount(Computer), pipes = make_set(RelativeTargetName)
          by IpAddress, SubjectUserName, bin(TimeGenerated, 10m)
| where hosts >= 25
// tune/validate: exclude asset-management and vulnerability scanners;
// on busy file servers 5145 volume is high, so scope to workstations and servers selectively.

Pair LDAP and SMB signals: one client doing both within the same window is far stronger than either alone.
Detect the tool as well: SharpHound and AzureHound binaries, in-memory loads of the collector and zipped JSON output on disk.
Reduce what the tool finds by limiting NetSessionEnum with the Net Cease approach and by fixing the ACL paths BloodHound shows.
Run BloodHound yourself on a schedule and treat its findings as a remediation backlog.

Vetted sources

Use the BloodHound documentation for the collection methods, the SigmaHQ and Elastic SharpHound rules, Splunk ESCU LDAP and enumeration analytics and Microsoft’s guidance on LDAP diagnostic logging. Baseline your own environment — identity governance, vulnerability scanning and inventory tools produce the same fan-out and must be excluded by source.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

LDAP: Make It Visible First

SMB and SAMR Sweeps

Build Detections That Fire

Active Directory Attack Detection

Detection Hub

LAPS Abuse Detection

AD ACL Abuse Detection