blog.safetech.red
FR
Microsoft Active Directory Rust BloodHound

The origins of RustHound-CE

A field note on my BloodHound collector written in Rust: why I built it in the first place, and why BloodHound's move to the Community Edition pushed me to release RustHound-CE.

10 Oct 2026 9 min – views Quentin Texier (g0h4n)
Table of content

This article is an automatic translation of the original French post. If something reads a little off, the French version is the reference.

TL;DR

A few years ago (early 2021, more than 5 years already..), I built RustHound, an Active Directory data collector for BloodHound, in Rust. The idea was simple: one single binary, cross-platform, to drop on any target. Since then, BloodHound took a big turn with its Community Edition, and the data model changed. So I released RustHound-CE, the version that works with this new edition. This article is a short field note on why I built the tool in the first place, and on what this move to the CE changes.

What is RustHound, again?

For those just arriving, a quick reminder. RustHound is an Active Directory data collector over LDAP. In plain words, it queries a domain's directory (users, groups, computers, ACLs, trusts...) and generates JSON files that BloodHound then ingests to map everything as a graph.

BloodHound is created and maintained by SpecterOps, and it uses graph theory to highlight AD misconfigurations and trace attack paths. It is useful both to a Red Team, to find how to climb up to Domain Admin, and to a Blue Team, to see its own weaknesses before others do. You could even say it has become a reference, a must-have tool during an internal Active Directory audit.

The official collector is SharpHound, written in C#. There is also BloodHound.py, built by @_dirkjan in Python, and very recently a TUI Golang version called flashingestor, built by @MacmodSec. RustHound, as its name says, is the same idea but in Rust. And that language choice was not random.

Why RustHound in the first place

Back then, at Armature Technologies (which became Opencyber, then NeverHack), we kept running into the same pain points on engagements, and that is what started the project.

First case: an external penetration test where we had compromised a web server whose authentication was backed by an Active Directory. From that compromised Linux server, no outbound connection was possible, so no SOCKS proxy and no port forwarding. In that scenario, SharpHound.exe is unusable, it is made for Windows. The alternative, BloodHound.py, relies on impacket and needs a pile of Python dependencies to run. With no python3 on the server and no way to install anything, it was impossible, and frustrating to not be able to pull the directory content from that environment.

Second case: after compromising a Windows 10 workstation, SharpHound.exe simply got blocked. Its signature is known, and so is its behavior. Any antivirus flags it, and a SOC can easily spot its use on an information system.

And at the time, I did not have the know-how to easily pack it and get around the protections in place (AV, EDR...).

And a third, more personal reason: a colleague who loves Rust dared me to get into it. I took the challenge, and RustHound was born out of all that.

By the way, a little anecdote: it almost ended up being a GoHound! Back in early 2021, I had hesitated between getting into Golang and Rust, hehe.

And now I do everything in Rust for my Red Team engagements, so thanks Charles!

The BloodHound Community Edition turn

This is where it gets interesting for this article. In 2023, SpecterOps released BloodHound Community Edition. It is not a cosmetic update, it is a full rewrite, on the same codebase as BloodHound Enterprise. New architecture, multi-user, API, authentication, a real web interface, in short a different world from the BloodHound "Legacy" we knew. I got a lot of feedback from auditors who were unsure about moving to this new version.

A new platform means a new data model on the ingest side. And that is where it breaks for a collector: the files made for the old BloodHound no longer fit as-is into the Community Edition. So a collector that speaks the CE language was needed.

RustHound-CE, what changes

Rather than break the existing tool, I chose to build a new project.

The original RustHound stays maintained on the NeverHack git and serves BloodHound Legacy. And RustHound-CE targets BloodHound Community Edition. It generates the JSON in the format the CE expects, and it only works with it. If you moved to BloodHound CE, RustHound-CE is the one you want.

The philosophy does not change. Still Rust, still a single binary, cross-compiled for Linux, Windows and macOS, dropped on the target with no dependencies to install. What made RustHound interesting at the start is still the heart of RustHound-CE.

What it can do today

RustHound-CE does a lot more than a simple LDAP collection today.

Authenticating, every useful way

On an engagement, you never start with the same material. So RustHound-CE covers a wide range:

  • Simple bind with username and password, with the option to type it at a prompt.
  • NTLM Pass-the-Hash, when you have the NT hash and not the clear-text password.
  • Kerberos, through a cached ticket.
  • Pass-the-Certificate (PFX or PEM), RustHound-CE can authenticate directly with a certificate and its private key. It is actually the same auth brick I released standalone as PassTheCert-rs.
  • All of it over LDAP (389) or LDAPS (636).

What it collects

Beyond the classic objects (users, groups, computers, OUs, GPOs, containers, domains), RustHound-CE also brings back everything related to AD CS, which is valuable given the attack surface around certificates: the authorities (root, enterprise, AIA), the certificate templates, the issuance policies and the NTAuthStore. All of it packed into a .zip ready for BloodHound CE.

Modules and collectors

This is where it has really grown:

  • LAPS: automatic retrieval of local administrator passwords, when the account has the read rights.
  • FQDN resolver (--fqdn-resolver): DNS resolution of machines to show their IP.
  • Sessions: user session collection over SRVSVC, WKSSVC and WINREG.
  • GPO from SYSVOL: parsing of GptTmpl.inf, Groups.xml and GPOChanges.
  • Local groups over SAMR.
  • WebClient/WebDAV probe (useful for relay scenarios) and detection of AD CS HTTP enrollment endpoints.

The collection method is driven with -c (All by default, or DCOnly/LdapOnly to do LDAP only and stay discreet).

The relationships that matter

On the graph side, the ACEs that draw the nice attack paths are there: GenericAll, GenericWrite, WriteDacl, WriteOwner, Owns, AllExtendedRights, AddKeyCredentialLink, the DCSync rights (GetChanges, GetChangesAll, GetChangesInFilteredSet) and the rights tied to the certification authorities (Enroll, AutoEnroll, ManageCA, ManageCertificates).

To give an idea, coverage is around 86% of the attributes compared to SharpHound v2.16, and it keeps going up.

And as a bonus, a library

RustHound-CE can also be used as a Rust library, to reuse its collection brick in your own tools. That is actually what served as a base for other projects of mine. More information about how integrate it in your Rust projetc here.

The full and up-to-date list is in the HELP.md and the ROADMAP.md of the repo.

Usage examples

A few concrete commands (here on the GOAD lab):

# Full collection, zip output ready for BloodHound CE
rusthound-ce -d north.sevenkingdoms.local -u 'jeor.mormont@north.sevenkingdoms.local' -p '_L0ngCl@w_' -o /tmp/demo -z

# DCOnly mode, quieter (LDAP only)
rusthound-ce -c DCOnly -d north.sevenkingdoms.local -u 'jeor.mormont@north.sevenkingdoms.local' -p '_L0ngCl@w_' -o /tmp/demo -z

# Targeting the DC IP directly
rusthound-ce -d north.sevenkingdoms.local -i 192.168.56.11 -u 'jeor.mormont@north.sevenkingdoms.local' -p '_L0ngCl@w_' -o /tmp/demo -z

# Over LDAPS on a custom port
rusthound-ce -d north.sevenkingdoms.local --ldaps -P 3636 -u 'jeor.mormont@north.sevenkingdoms.local' -p '_L0ngCl@w_' -o /tmp/demo -z

# Kerberos authentication via a cached ticket
export KRB5CCNAME="/tmp/jeor.mormont.ccache"
rusthound-ce -d sevenkingdoms.local -f kingslanding -k -z

# With FQDN resolution of machines
rusthound-ce -d essos.local -u 'daenerys.targaryen@essos.local' -p 'BurnThemAll!' -o /tmp/demo --fqdn-resolver -z

# LDAPS (636) authentication, PEM cert + key
rusthound-ce -d ESSOS.LOCAL -f MEEREEN.ESSOS.LOCAL --crt daenerys.crt --key daenerys.key -o /tmp/demo --ldaps -c All -z -v

The simplest install: cargo install rusthound-ce. Otherwise, make release from source, or the provided Dockerfile that bundles all dependencies.

Pre-compiled binaries are also available on GitHub.

Below an example with certificate authentication:

RustHound-CE example with certificate authentication

Red & Blue

BloodHound has always been a tool with two readings, and RustHound-CE does not change that.

On the Red Team side, it is the collector you drop to map the AD and find the paths to privileged accounts, even in awkward scenarios (Linux with no outbound, a Windows host where the official collector gets blocked).

On the Blue Team side, two things to keep in mind. First, run it on your own directory: seeing your AD the way an attacker sees it is the best way to prioritize fixes. Second, on the detection side, a BloodHound collection generates a large volume of LDAP queries in a short time. That is exactly the kind of pattern a good LDAP monitoring can surface. The -c DCOnly mode is quieter than the full mode, but it is still an unusual burst of directory queries for a regular account.

An honest word on AV evasion: at release, part of RustHound's value was not having the signature or the network behavior of SharpHound. But that lives in time. Never treat a collector as "undetectable" on principle, test it in your own context and on your labs. That said, as of October 2026, rusthound-ce.exe is still not flagged as malicious when dropped on a host with an up-to-date Defender.

And for the record, the original article that introduced RustHound at its release is still readable via web.archive.org.

cd ..