BloodHound collects the same kind of data AD Enumeration (Credentialed) does manually, users, groups, computers, sessions, ACLs, GPOs, trusts, and loads it into a graph database instead of a flat list. Every object becomes a node, every relationship (group membership, admin rights, session presence, a dangerous ACL) becomes very clear. The payoff: instead of manually chaining “this user is in that group, which has this privileges over this computer, where that other user has …” by hand, BloodHound’s graph queries compute the shortest actual attack path to Domain Admin for you. It’s a very powerful tool.
netexec ldap <dc-ip> -u '<user>' -p '<pass>' --bloodhound -c All
-c All / -CollectionMethod All pulls every collection method at once (sessions, ACLs, group membership, trusts, etc.), the most thorough option but also the noisiest.
BloodHound’s GUI covers the common pre-built queries (shortest path to Domain Admin, Kerberoastable users, etc.), but custom Cypher queries reach things the defaults don’t. Here you can find a huge list with Custom Queries for Bloodhound. Two examples:
// Find users with WinRM rights to a computerMATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group))MATCH p2=(u1)-[:CanPSRemote*1..]->(c:Computer)RETURN p2
// Find users with SQL Server Admin rights on a computerMATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group))MATCH p2=(u1)-[:SQLAdmin*1..]->(c:Computer)RETURN p2
