Active Directory Attack Paths: BloodHound and Kerberoasting

An Active Directory attack path is the specific chain of permissions, group memberships, and trust relationships an attacker follows to escalate from a single compromised low-privilege account to Domain Admin. Tools like BloodHound map these paths automatically from AD data collected by SharpHound, exposing routes that are invisible when you check permissions object by object. Kerberoasting and AS-REP Roasting are two of the most common techniques attackers use along the way: both let an attacker request Kerberos tickets tied to service or user accounts and crack them offline for credentials, without triggering a lockout. For Indian enterprise identity and security teams running an authorised internal pentest, understanding this methodology is the difference between finding attack paths before an adversary does, and finding out after.

Why Attack Paths Matter More Than Individual Vulnerabilities

Most AD environments accumulate privilege sprawl over years: a helpdesk account added to a server admins group "temporarily" in 2019, a service account with domain-wide rights nobody remembers granting, nested groups three or four levels deep. No single one of these looks dangerous in isolation. Chained together, they form a direct route to Domain Admin — and that chain is exactly what an attack path graph reveals.

Enumerating AD with SharpHound and BloodHound

BloodHound, built and maintained by SpecterOps, is a graph-analysis tool that ingests Active Directory relationship data and renders it as attack paths using graph theory — the same underlying approach used to model social networks. It answers a question flat permission listings never could: not "who is in this group," but "what is the shortest route from any user I control to Domain Admin."

SharpHound is BloodHound's collector, run from a domain-joined host (or in authorised engagements, sometimes from a non-joined host with valid credentials). It queries AD via LDAP and, for session data, via SMB/RPC calls to individual hosts, then exports the results as JSON for BloodHound to ingest. A standard collection run gathers:

1. Group memberships, including nested and indirect membership.
2. User and computer object properties — logon scripts, admin count flags, delegation settings.
3. ACLs on AD objects — who can reset a password, write to a group, or take ownership of an OU.
4. Active sessions, showing which users are currently logged onto which hosts.
5. Domain trusts, relevant when the environment spans multiple domains or forests.

Reading the Active Directory Attack Path Graph

BloodHound represents the domain as nodes (users, groups, computers, GPOs, domains) connected by edges that represent a capability, not just a relationship. An edge like AdminTo means a user has local admin rights on a computer; CanRDP means remote desktop access; WriteOwner or GenericAll mean the object can be taken over outright; HasSession means a privileged user is currently logged onto a machine a lower-privileged account can reach.

The value of the graph is that these edges chain. A help desk account might have no direct path to Domain Admin, but if it can RDP into a workstation where a domain admin has an open session, and that session can be hijacked or its credentials harvested from memory, the attack path exists — even though no single ACL entry looks alarming on its own. This is what "attack path mapping" means in practice: finding the shortest, least-monitored route between "what I have" and "what I want," across dozens of possible intermediate hops.

Kerberoasting: Cracking Service Account Passwords Offline

Kerberoasting abuses a basic feature of the Kerberos authentication protocol. Any authenticated domain user can request a service ticket (a TGS) for any service registered with a Service Principal Name (SPN) — that's by design, since Kerberos needs to issue tickets for legitimate access. The ticket is encrypted using a hash derived from the service account's own password.

The attack: a low-privileged user requests TGS tickets for every SPN-registered account in the domain, then takes those tickets offline and attempts to crack them with tools like Hashcat, targeting weak or reused service account passwords. No further contact with the domain controller is needed once the tickets are captured, and because ticket requests are a completely normal Kerberos operation, the initial step generates minimal, easily-missed logging on its own.

GetUserSPNs.py domain.local/user:password -dc-ip 10.0.0.1 -request

Service accounts are disproportionately vulnerable because they're often created once, given a long or "permanent" password, and never rotated — frequently with sweeping rights across the domain because a deployment years ago needed them and nobody scoped them back down.

AS-REP Roasting: The Quieter Cousin

AS-REP Roasting targets a narrower but equally exploitable condition: accounts with Kerberos pre-authentication disabled. Normally, a client must first prove knowledge of a password before the domain controller issues an Authentication Server Reply (AS-REP). When pre-auth is disabled — sometimes deliberately for compatibility with older systems, sometimes by accident — an attacker can request the AS-REP for that account with zero credentials at all, then crack the encrypted portion offline.

Common Misconfigurations That Create Attack Paths

Three categories of misconfiguration show up repeatedly across BloodHound-driven internal pentests, and each is independently sufficient to hand an attacker a path to Domain Admin.

Excessive rights and ACL abuse. Objects in AD carry access control lists just like files do, and permissions like GenericAll, WriteDacl, or ForceChangePassword granted to a broad group — often inherited from an OU-level delegation set up for a one-time task — let an attacker reset passwords or take ownership of objects far above their intended privilege level.

Unconstrained delegation. A computer object configured for unconstrained delegation can request tickets on behalf of any user who authenticates to it, and caches those users' Kerberos TGTs in memory. If a domain admin ever authenticates to that host — including a scheduled task or an administrative session — their credentials can be extracted and reused. This is one of the highest-value misconfigurations BloodHound flags, because a single unconstrained-delegation host reachable by a low-privileged account can be a direct line to full domain compromise.

Nested and nested-again group membership. Group-in-group-in-group structures make manual permission auditing effectively impossible; a user can be an indirect member of Domain Admins through three or four layers of nesting that nobody reviews as a set. BloodHound resolves this automatically and is often the first tool to surface it.

Defending Against BloodHound-Style Attack Paths

Adopt a tiered administration model. Microsoft's privileged access model separates domain controllers and Tier 0 assets from workstation and server administration, so that a compromised helpdesk credential can never reach a domain admin session even if every downstream host is compromised. This single control breaks the majority of attack paths BloodHound surfaces, because most paths rely on privilege bleeding across tiers that were never meant to touch.

Move service accounts to gMSA. Group Managed Service Accounts (gMSA) use automatically rotated, 240-character random passwords managed by AD itself, making Kerberoasting against them computationally infeasible — there is no human-chosen password to crack. Migrating legacy service accounts to gMSA closes the single most common Kerberoasting target directly.

Enforce Kerberos pre-authentication domain-wide and audit for accounts where it has been disabled, since this is frequently a legacy setting nobody remembers enabling.

Monitor for the specific event signatures. Kerberoasting shows up as a burst of TGS requests (Event ID 4769) with RC4 encryption type against multiple SPNs from a single account in a short window — a pattern that is unusual for normal application behaviour and detectable with basic SIEM correlation rules. AS-REP Roasting produces AS-REQ events (Event ID 4768) without prior successful authentication for the target account.

Run periodic BloodHound collections defensively. Security teams can use the same collection-and-graph approach attackers use, on a schedule, to catch newly introduced attack paths — a service account added to a privileged group during a routine change, a new host configured with delegation enabled — before they accumulate into a real exposure.

Where This Fits Into a Full VAPT Engagement

AD attack path analysis is advanced internal-pentest methodology, not a checkbox scan — it requires a tester who understands Kerberos internals, delegation semantics, and how to safely crack captured tickets without disrupting production authentication. Bachao.AI builds this kind of identity and attack-path assessment into its VAPT workflow, and where regulatory submission requires it, delivers the engagement with a CERT-In empanelled partner. Dhisattva AI Pvt Ltd designed the platform around exactly this gap: most Indian enterprises run AD as critical infrastructure but have never had an independent team map what an attacker could actually reach from a single compromised laptop.

Organisations handling personal data under India's privacy law should treat AD compromise as a direct DPDP exposure path, since domain-wide access usually means access to every system storing personal data behind it — see our DPDP compliance guide.

Next Steps

Attack path mapping turns a sprawling, unreviewable permission structure into a short, prioritised list of exactly what to fix first. Whether you run BloodHound internally on a schedule or bring in an external team for a full internal pentest, the goal is the same: know your shortest path to Domain Admin before an attacker finds it for you.

Ready to see what an attacker could actually reach inside your Active Directory environment? Get a free VAPT scan, or browse our blog for more advanced internal-pentest methodology.