BloodHound Edge Risk
Severity is contextual, it scales with proximity to Tier 0 and how many principals can reach the edge. Ratings below assume the target is privileged/near Tier 0.
🟥 Critical: Immediate/Complete Compromise
| Edge | Why |
|---|---|
MemberOf (→ Tier 0) | Direct membership in Domain Admins / Enterprise Admins |
DCSync (GetChanges+GetChangesAll) | Replicate DC data → dump all domain password hashes |
AllExtendedRights | Force password reset, read sensitive attrs, etc. |
AllowedToAct (RBCD) | Machine can impersonate any user to target computer |
Owns | Ownership lets you grant yourself DACL rights even without WriteOwner |
AddKeyCredentialLink (Shadow Credentials) | Add cert-based auth key, authenticate via PKINIT |
🟧 High: Full Control of Target Object
| Edge | Why |
|---|---|
GenericAll | Full control: reset password, add to group, edit ACLs |
WriteDacl | Modify ACLs, grant self GenericAll |
WriteOwner | Take ownership → rewrite permissions |
ADCSESC1-13 | Misconfigured ADCS templates → request certs as admin |
🟨 Moderate: Building Blocks / Partial Control
| Edge | Why |
|---|---|
GenericWrite / WriteProperty | Modify object properties (scripts, paths, etc.) |
AddMember | Add account into a security group |
HasSession | Active session, dump memory for creds/tokens |
CanRDP / ExecuteDCOM / AllowedToDelegate | Lateral movement primitives |
ForceChangePassword | Set new password without knowing old one, near 1-hop takeover if target privileged |
ReadLAPSPassword | Cleartext local admin password on target host |
SQLAdmin | MSSQL admin, often leads to xp_cmdshell code exec as service account |
WriteSPN | Set fake SPN → targeted Kerberoasting |
AddSelf | Self-add to group, severity = severity of that group |
ReadGMSAPassword / DumpSMSAPassword | Extract managed service account creds |
🟦 Low: Recon / Surface Expansion
Edges that reveal misconfigs or expand attack surface without direct escalation (context-dependent, mostly non-privileged targets).
Rule of thumb: what does the edge reach, and how close is that to Tier 0? Don't rely on a fixed table.
Post-Compromise Edges to Recheck
After compromising a domain-joined workstation, run a fresh SharpHound collection from the new privilege level. The graph can change materially once you control the host.
Prioritise:
HasSession— privileged user logged onto a host you control.ReadLAPSPassword— recover a target's local Administrator password.ReadGMSAPassword— recover a managed service account credential.GenericAll/WriteDacl/WriteOwner— control of the next useful object.GenericWrite/WriteProperty— possible modification of computer/user properties.ForceChangePassword— reset a useful account without knowing its old password.AllowedToAct— RBCD path to the target computer.AllowedToDelegate/ delegation edges — check when the compromised account or computer can authenticate on behalf of another principal.SQLAdmin— MSSQL administration can provide code execution in the SQL service context.
Computer-account review
Search for the compromised machine account, e.g. WS26$, and inspect its outbound edges. Do not only follow the user's path; a controlled computer account may have a different route to the next host or a Tier 0 object.
Re-collect BloodHound after gaining a stronger foothold. The second graph is often more useful than the first because you now own a computer and may have visibility into sessions and additional relationships.