Skip to content
Get packs

Guide · Agent skill

How to use the BloodHound CE Active Directory recon skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This skill is an agent skill: a packaged set of instructions and helper scripts that an AI agent such as Claude loads when a task matches it. Once installed, it lets the agent run an internal Active Directory reconnaissance workflow built around BloodHound Community Edition, from deploying the server to ranking attack paths from a low-privileged account to Domain Admin. It is written for authorized red team operators, blue teams checking that known attack paths are closed, and students working in a lab.

BloodHound CE Active Directory Reconmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. In the Claude apps you can upload it under Settings → Capabilities → Skills.
  2. 2Confirm you have authorization. Check that you have written permission for the target domain. Do not run the skill against production without a change window and sign-off.
  3. 3Deploy BloodHound CE. Run the Docker Compose commands from the skill on your analysis machine, then open the web interface and change the default admin password.
  4. 4Collect AD data. Run SharpHound on a Windows host in the domain, or use BloodHound.py from Linux with valid domain credentials. Collect the resulting ZIP.
  5. 5Import and analyse. Upload the ZIP via File Ingest, mark owned accounts, and run the built-in queries and the custom Cypher queries the skill provides.
  6. 6Prioritise and report. Rank attack paths by hops, stealth, tool availability and detection risk, then fill in the report template for your engagement records.

What does the BloodHound CE recon skill make the agent do?

The skill teaches the agent a five-phase workflow. It covers deploying BloodHound CE with Docker Compose, collecting Active Directory data with SharpHound or BloodHound.py, importing that data into the web interface, running built-in and custom Cypher queries, and prioritising the attack paths it finds.

Collection covers ACLs, sessions, group memberships and trust relationships. The skill also describes AzureHound for Entra ID data. Its prioritisation step scores paths by number of hops, stealth requirements, tool availability and likelihood of detection at each step.

The package includes two Python scripts: scripts/agent.py, which calls the BloodHound ingestor and queries a Neo4j database, and scripts/process.py, which summarises exported JSON into reports such as Kerberoastable and DCSync-capable accounts. It also includes a report template in assets/template.md.

How do you install the BloodHound CE skill?

Download the skill ZIP from this page and unzip it. For a personal setup, place the folder in ~/.claude/skills/. To scope it to one project, put it in that project's .claude/skills/ folder instead.

If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills. Either way, the folder should contain SKILL.md, which is the file that describes the skill to the agent.

  • Personal install: ~/.claude/skills/
  • Project install: .claude/skills/ inside your project
  • Claude apps: Settings → Capabilities → Skills, then upload

Set up the BloodHound CE server

Phase 1 of the skill deploys BloodHound CE with Docker Compose. The commands below are the ones given in the skill. Run them on the analysis machine, not on the target host.

After the containers start, the skill says to open the web interface and log in with the default admin password, which is printed in the Docker logs. Change that password immediately.

  • Access the web interface at https://localhost:8080 as the skill specifies
  • Find the initial password with the log grep shown below
  • Change the default admin password before doing anything else
curl -L https://ghst.ly/getbhce -o docker-compose.yml docker compose pull docker compose up -d docker compose logs | grep "Initial Password"

Collect and import Active Directory data

SharpHound is a Windows-only collector and runs on a host inside the domain. The skill lists several collection modes: a full collection, a DCOnly mode that uses LDAP only and is described as stealthier, and a session mode that can loop for a set duration. From Linux, the skill offers BloodHound.py as an alternative.

Copy the resulting ZIP to your analysis workstation, upload it in the BloodHound CE interface using File Ingest, and mark the accounts you have compromised as Owned. Then run the built-in queries, such as Shortest Path to Domain Admin, Kerberoastable Users with Path to DA and Users with DCSync Rights.

  • SharpHound: full (All), DCOnly, or Session collection
  • BloodHound.py: alternative collector run from Linux
  • Upload the ZIP via File Ingest, then mark owned principals
bloodhound-python -u user -p 'Password123' -d domain.local -ns 10.10.10.1 -c All

Ask the agent for a recon run in plain language

You do not need to name the skill. Describe what you need in normal terms, for example: help me map attack paths from our test user to Domain Admin in the lab domain, or check whether the known AD paths to Domain Admin are still closed after our hardening changes. The agent should load the skill when the request matches its description.

Be specific about scope. State the domain, the account you have, and whether the work is an offensive test or a validation of fixes. The skill's workflow depends on those facts, such as which accounts are owned and which domains are in scope.

  • Name the domain and the starting account you control
  • Say whether the goal is finding attack paths or confirming they are closed
  • Ask for the report template if you need engagement documentation

Safety, scope and what you need before you start

The skill is for authorized security testing and education only. Use it only on domains you own or have written permission to test. The skill itself states that unauthorized use is illegal and may violate computer fraud laws.

Collection and session enumeration generate significant LDAP and authentication traffic. The skill's scope warns that this can be detected or disrupt services, so production domains need a change window and sign-off. The package runs scripts and uses the network, so review scripts/agent.py and scripts/process.py before running them.

The skill requires Docker and Docker Compose, Python 3.8+, the bloodhound-python ingestor and the bloodhound pip package, the neo4j Python driver, a Windows host for SharpHound, valid domain credentials, and AzureHound if you collect Entra ID data.

  • Authorized targets only, with written permission
  • Avoid production domains without a change window and sign-off
  • Requires Docker, Python 3.8+, valid domain credentials and a Windows host for SharpHound
  • AzureHound for Entra ID is optional
pip install neo4j

What people use it for

  • A red team operator with a foothold on a test account maps the shortest paths to Domain Admin.
  • A blue team checks whether previously known ACL-based or Kerberoasting paths are still open after remediation.
  • A security student uses the Kerberoastable and DCSync queries in a lab domain to see how graph analysis reveals escalation chains.
  • An assessor fills in the engagement report template with hop counts, start and end nodes and risk ratings.

Frequently asked questions

Is the BloodHound CE agent skill free?

The skill is published under the Apache-2.0 licence, as listed on this page. BloodHound CE, SharpHound, BloodHound.py and AzureHound are separate tools, and this page does not state their pricing, so check their own project pages.

What do I need to run the BloodHound CE recon skill?

You need Docker and Docker Compose, Python 3.8+, the bloodhound-python ingestor and bloodhound pip package, the neo4j Python driver, and valid domain credentials. SharpHound needs a Windows host, and AzureHound is optional for Entra ID data.

How do I install an agent skill like this one?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder. In the Claude apps, upload it under Settings → Capabilities → Skills.

What is the difference between SharpHound and BloodHound.py?

According to the skill, SharpHound is the Windows-only collector and BloodHound.py is the Python alternative you can run from Linux. Both gather Active Directory data for import into BloodHound CE.

Why does the skill say not to run it on production domains?

Collection and session enumeration generate significant LDAP and authentication traffic. The skill warns that this can be detected or disrupt services, so production use needs a change window and sign-off.

Can the skill be used to check that AD hardening worked?

Yes. The skill's description says it can validate that AD hardening has closed known attack paths to Domain Admin, by rerunning the same queries after changes and comparing the results.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits authorized red team operators with a foothold in a test domain, blue teams validating that known Domain Admin attack paths are closed, and students learning BloodHound graph analysis in a lab. It is a poor fit for anyone without written permission to test, for production domains without a change window, or for general AD administration help, since it is oriented toward attacking rather than managing Active Directory.

Download the skill