6 Things You Didn’t Know About BlueHound

Summary

BlueHound is a free, open-source tool from Zero Networks that gives blue teams the same graph-based attack-path view red teams get from BloodHound. In this virtual meetup, Zero Networks VP of Research Sagi Dulce and security researcher Dekel Paz demo six lesser-known features: scheduled data collection, network and vulnerability data, the Ransomware Simulator, CSV export, configuration sharing, and custom icons. They then answer questions from users.

Key takeaways

• BlueHound flips BloodHound for defenders. Red teams get a clear attack map from graph data. Blue teams face every possible path at once. BlueHound, forked from NeoDash, gives defenders one place to collect, analyze, and present that data.
• Collection is automated and schedulable. SharpHound, ShotHound, and custom scripts run with one click or on a schedule, and results load straight into Neo4j.
• Network and vulnerability data show which paths are real. ShotHound drops logical paths with no actual network connection. Vulnerability scans from Qualys, Nessus, OpenVAS, or Nmap highlight vulnerable hosts that lead to crown jewels or domain admins, so teams know what to fix first.
• The Ransomware Simulator quantifies segmentation. On a flat network, 260 machines can infect all 2,000. With typical access controls, about 75% of the network is reachable. On a least-privileged network, it drops to 2%.
• Everything stays local. BlueHound uploads nothing to Zero Networks. Shared configuration files contain no Neo4j password, though any credentials in script parameters should be removed before sharing.

Speakers: Sagi Dulce, VP of Research, Zero Networks · Dekel Paz, Security Researcher, Zero Networks 

Who built BlueHound?

Sagi Dulce: Uh, welcome, everybody. Welcome to Six Things I Didn’t Know About BlueHound. Very quick and dirty, uh, meetup, virtual meetup about BlueHound for users. Uh, hopefully some of them, uh, some of you know or use BlueHound or something, maybe, or not. Um, so for those of you who maybe don’t know what is BlueHound, I just gonna dive, uh, right into it, just show you the tools, show you how it looks like, give you the gist of how to use it. Um, then I’m gonna talk just a little bit about, um, the concept that led us to create BlueHound. Um, then we’re going to dive into the different demos of all the different niches and corners in BlueHound that you, if you used it, maybe you’re not aware of it. And we want to leave enough time for Q&A, so if you are using it, you have some trouble, suggestions, or use cases that you want to ask about, then this will be the place to ask us anything.

So before we start, quick introduction. Um, the weird Batman figure on the, to your right, that’s me, Sagi Dulce. I’m VP of research in Zero Networks. I’ve been in security research for the past 15-plus years now, also on the vendor side, also on the client side, who consumes and does defensive research. I was purchasing sort of co-creating a BlueHound, and I will flip it over to Dekel, who actually did most of the code, coding in BlueHound, to also introduce himself.

Dekel Paz: Thanks again. Hi, everyone. Thank you for joining. My name is Dekel. I’m a security researcher at Zero Networks. Uh, in my career, I’ve been kind of outside of the fence, so doing, uh, offensive stuff, penetration testing, developing attack tools, research, and stuff like that, and also on the defensive side with startup companies developing network behavior analytics algorithms, and also working at the Fortune 500 enterprise on the defensive and offensive side. And these days I’m at Zero Networks. So yeah, that’s me.

What is BlueHound?

Sagi Dulce: Cool. So let’s get started with just diving right into BlueHound. What the hell is BlueHound? So BlueHound was actually forked from a project called NeoDash. That’s, uh, that’s a tool, open-source tool, that was written by Niels de Jong, who works in Neo4j, and that’s basically how it looks like. And the concept of NeoDash is that, a dashboard for your graph database. Uh, and immediately when we saw it, we thought, given the specific modification and tweaks, we can make it to really neat security tool, and that’s how we came up with the idea of creating BlueHound. So there’s a lot originally before from there, and there was a lot of work that, maybe like I said, Dekel did to make it a security tool, like making it a desktop application, added some specific charts, making it able to run its own scripts, and so on and so forth.

Uh, so if you haven’t used it before, how you get started? You have basically two options. Either you download it from our Git — uh, it’s executable, you can run on Mac, on Linux, and on Windows — or you can install it as an ISO. It’s part of what we call the ransomware ROAST, the ransomware open-source toolkit. It has a bunch of different tools in it, uh, sort of Kali, just for more defender side. Um, and once you, uh, download it — I’m showing here, for example, if you go to our GitHub and you download BlueHound — you have the option, first of all, you have README, which has a lot of interesting information. You should probably go and read it if you never used it before. Then you can go to the release page, just download from there. That’s the one option that you have. Uh, the other option that you have is to download the ISO. There’s a link also in the README, and you just install it like you would a regular Windows ISO, just like you install it from scratch. You just download it, and once you open the ISO, you’ll see something like this. You have BlueHound inside, with a bunch of data that we generated, just to, so you can play with the tool and experience it for yourself.

And there are different things here, and everything is configurable. So we have, like, a configuration where you can create your parameters for your environment. For example, what are my crown jewels that I want to defend? And I can create queries that look, like, for paths that attack those crown jewels. You can create dashboards of different metrics, like we did here in scores. You can create statistics for different environments. Uh, we also have this distinction between logical path and network-enabled path. You can think a logical path, or this classic BloodHound path, and the network-enabled path is the path that you take into consideration once you also have the network layer. So if you have a path between computer A and computer B, but there’s no network between them, that path doesn’t count.

And there’s a lot of different features here, and we want to go into all of them. This is the query runner, where you can select or run all the Cypher queries in the background. So for, behind each one of those charts, you’ll see there’s a Cypher query that’s creating this, this chart. And you also have the very useful import tools, so you can run different scripts, like SharpHound, like ShotHound, and different vulnerabilities scanner result — we’ll talk about this later. You can import it into your data, and it’s an all, all-in-one, like this Swiss knife of dashboards and data and scripts that you can just throw in there and automate your entire collection process.

Why did Zero Networks build BlueHound?

Sagi Dulce: Um, so this is it. We’ve seen, uh, just how, what, how BlueHound looks like. Uh, I do want to take a minute to explain the reasoning behind it. And the reasoning, or I think the philosophy, that led us to create BlueHound is this, uh, asymmetry between red teams and blue teams. Like, for red teams, when you’re using, um, when using graph data, you are in this quote-unquote heaven. Why? Because you compromise an account, you run a query on your database, and then it gives you a very clear, very easy to consume map: where do you need to go, like we probably all know from BloodHound. Once you’re on the other side, when you’re a blue team, you need to measure your resilience or build it up and understand, hey, an attack can come from everything. Suddenly you’re in this hell where you don’t really know where to start. So you need a very, uh, to take a very methodological approach to solving this problem. And in order to solve this problem, we need a lot of things that, uh, currently we don’t really see them in the blue ecosystem.

You need a method to collect your data in a very simple and easy way. Click a button, suck all of the data into my database. Need a method to analyze all this data, and again, click of a button, do all of the analysis that I need. A month later, I need to do it again, and I want to do it in the click of a button. I don’t want to keep doing this or keep hacking away different scripts just to analyze some data. Once I have this analysis, I want to present it. There are different consumers, the different function inside the company. Each one, some, some people like to look at graphs, other people like to get pie charts or tables or whatnot, so you want to have that flexibility, so different consumers can get their data however they want. And on top of all of this, you want this community built into the platform, meaning that whether it’s how you collect data — if someone tomorrow has a new method of collection that’s really cool and effective, or collects something that’s really important that other tools don’t collect — should be very easy to integrate it into this tool, into this platform, and it should be as easy as importing, exporting, or just updating your tool. Uh, and that should be, uh, that should go for all the process. For analysis, if there’s a new analysis out there, you want to integrate it into your, uh, cycle as quick as possible. You don’t need to go through different blogs and guides just to show you how to do this.

Um, and that’s why we basically create a BlueHound that you’ve seen before. So hopefully I covered the reasoning of why BlueHound, how it looks like if you haven’t seen it before, and now I’m going to transfer it mostly to Dekel, and he will go over, if you are using BlueHound, maybe there are some things that you have missed and you didn’t know about. So take it, Dekel.

How do you automate and schedule data collection?

Dekel Paz: Thanks. Uh, yeah, already mentioned, you know, why we wanted to create this tool and why would you want to run it, uh, and all the reasons behind it. Here are just a few more interesting things about it, so maybe, you know, things that you’ll find helpful for your environment.

Uh, so the first thing is the automation of data collection. Uh, so you really want to have the ability to run, uh, you know, all of the connect—, of our collections from one place. So we had the ability to find Python scripts or binaries. Uh, BloodHound comes, of course, with SharpHound, which is the binary. We have our own scripts to collect more information, uh, in Python. Everything is configurable from one place. You can run everything from one place. Uh, if, uh, and if you used BloodHound before, you know that you have to run SharpHound and then manually, you know, you have the JSON file or the zip file, you have to manually drag it into the UI. So we wanted to have everything with the click of a button. Just click, uh, it runs it, the results automatically get uploaded to the Neo4j database, and you have everything ready. We also added, in our latest release just a couple of days ago, scheduling. So now you can have it, uh, all of your collections run every day, every week, every month, whatever you want. So yeah, we don’t even need the click of a button to have everything ready. So maybe we can take a look at what that looks like and how to create a scheduled task.

Yeah, so on the left side we have the data input tools. We have everything, uh, already configured. So we have SharpHound here. We have ShotHound, which is one of our own scripts. Uh, we can see the arguments that we pass through it. Of course, can modify and add and remove things. We have a URL for you also, uh, just to be, uh, able to download the tool if you don’t have it. You can see the different types of tools that we support. And then you have the ability to run the tool by itself, so you will have the, just the Run button to run this tool. You can also run all of the tools, and if you don’t want some of them to run, you could just disable it. You don’t have to delete it or anything like that. You can decide if the tools will run serial or parallel, just one after the other, or all together. You can add, of course, your own tools. If you create a script to get, I don’t know, information about Linux hosts and anything like that, you can add it here. And if you click on schedule, you decide what are the parameters that you want. Let’s say every Monday. You just click save, and the new task schedule will be created, and it will run BlueHound in, like, a collection-only mode, which will only do the collection for you. And that’s, this is how you can always have the latest data in your Neo4j database.

How do network and vulnerability data change attack paths?

Dekel Paz: Number two are custom data. So we didn’t want to just have, you know, BloodHound information. We wanted to expand it. Uh, two scripts that we already created. Uh, one of them is ShotHound, which adds network information. So he mentioned it, uh, earlier, but basically, if you have, uh, host A and host B, and there’s some path between them — let’s say host A has some user, and that user can connect to host B — that doesn’t mean there’s actually network collection, connection between them that allows it. So ShotHound will give you that information, and then you can see paths that are valid only between the computers. Another script that I created is the vulnerability scanner, this input tool, which lets you get information from, uh, network scanners. It can be commercial tools like Qualys or Nessus, or open-source tools. Uh, if you have OpenVAS or even Nmap, you can create a CSV report, import it to BlueHound, and then you can get interesting think, things, like what vulnerable hosts to have in the environment that leads to crown jewels or leads to domain controllers. So now we can start looking at the risk and prioritizing the risk based on, you know, what are the relevant starting nodes do we have, what are the things that I really need to fix today and not, you know, on the next patch cycle. So we can look at what that looks like.

Yeah, so if you go to our Git, you have a bunch of different, uh, BlueHound tools, BloodHound tools that we created, and you can take a look at that. It’s a few integrity scripts here. For example, I’m showing the vulnerability data import. So basically, you can just generate the reports. In this instance, I’m using Qualys, uh, to strength scanning the environments, and I have the ability to save the report as a CSV. Usually the flow is kind of similar with all of them. You basically just go and download and, or export the report. You can choose the CSV type. I just download the report, run the, the script from BlueHound or separately, just using Python. And once you do that, you have that information. So now we can see, uh, that these hosts have the is-vulnerable flag and also a bunch of CVEs. So these are CVEs that are really critical, and those hosts lead to domain admins. So these are hosts that, again, we need to fix, uh, you know, priority one. These are the most critical things in our environment, because it com—, we can combine the vulnerability layer, the user permission layer, and the networking layer to create a more holistic view of the, of our network.

The, and maybe I’ll let, uh, Sagi talk about Ransomware Simulator next.

How does the Ransomware Simulator measure segmentation?

Sagi Dulce: Uh, sure. Uh, so Ransomware Simulator is another example of a standalone script that we integrated into BlueHound. Uh, basically what it does, it looks — it tries to infect logically. It just looks at the Neo4j database, and then it tries to propagate from each machine inside your database to other machines, and it says how much it can get to. Um, and then you can take this information and draw this graph. So, for example, if we see this graph, you can see that in red we have the logical path, which means the network is completely flat. It’s not, uh, it does — it’s not a barrier to any propagation. And in typical environment, that could mean that very quickly, from any machine, you can jump into domain and domain and infect the entire network. And that’s what’s happening here. From 260 machines, we can infect, uh, the entire 2,000 machines in the network, uh, without any barrier. If you can improve this a little bit, if you limit the access — so in orange, then we have the typical access, so on average 75% of the network is accessible. So it’s not 100, and we see we’re getting a little better. And as we move further to the green area, it’s called LPN, least privileged network , and that means only 2% on average of the network is accessible. That way you get the numbers way, way down, so now you don’t infect the entire network that quickly.

Um, and so you can either choose to run it as a separate script — so you can download it from our Git repository and just run it as is over your Neo4j data — but we thought it would be, uh, very comfortable just to have it built into BlueHound. So now we have this different simulator chart, just a different type of chart, and you can see similar results here in the logical path and in the network-enabled path. So the graph is much thinner, because the network blocks some of those propagation. Uh, and with that, I’ll, I’ll move it back to, to Dekel.

How do you share BlueHound results with other teams?

Dekel Paz: Yeah, so one more thing, uh, we wanted to have in, uh, BlueHound is the ability to share the results, um, with other teams or other colleagues. Um, usually when we deal with, like, graphs, like Neo4j, maybe it’s easy for us to do manual analysis, but it’s not very convenient to the other teams that need to deal with these results. They don’t know exactly what to look at. So, uh, from NeoDash, we actually got out of the box, you know, already all of the different charts. So we have the graph chart, but we also have tabular charts, uh, we have pie charts, we have gauge charts, we have all of the things. So without, the easiest way, you know, just to have the ability to export to CSV. If you have a query that generates, you know, finds you those, for example, critical hosts that need to be patched today, uh, it will be way easier to pass on a CS—, CSV than, you know, to tell somebody, “Hey, look, log on to the Neo4j database and do this query, and then you’ll find the host, and you need to analyze it.” So, uh, we can just see what it looks like to export a CSV. It’s pretty straightforward.

Okay, I can just show the — I know, that’s the wrong video. Do you have ROAST open, by any chance?

Sagi Dulce: Uh, yes, I do. It’s pretty simple to show. Cool. So this is the ROAST, uh, VM that we mentioned earlier. You would get exactly the same thing if you download it. So it also comes with, uh, like, sample data for you to play with, if you want. If you go to the Statistics tab, the third tab, we have a bunch of different views here. And if we look, for example, at admins with sessions to non-DC, we have the down arrow here, which is just export. Lets you save it as a CSV, then you can just share it to any colleague, and basically easy as that.

How do you export and import configurations?

Dekel Paz: There is — just so we have the right flow, because something is weird. Okay, so let’s go to share, and now I’ll get back to the other video.

So next point, uh, share again. Something that we got, uh, for free with NeoDash: the ability to export and import configuration. This can be either for backup, or if you want to share it with your colleagues, have, you know, everyone have their own, uh, BlueHound binary, but you want to share the configuration, or even if you want to share, you know, any cool dashboards or script parameters or queries you created, I want to show it with the security community, then it’s an easy way to do that. So we can see how, how we can share that information. It’s pretty easy. On the left side, you have the save icon. It just generates a JSON file with all of the configuration. It’s just saving that JSON file. Then you can go to the load — it’s the button right under that. You can select the file and load the JSON file. And it’s also in a convenient way to see all of your queries in one place, if you wanna just check out what you’ve done, what we have here. You can just go over this, instead of having to go over what each chart by itself and look at the Neo—, at the Cypher query.

How do you add custom icons?

Dekel Paz: And the last point are custom icons. We mentioned that we want to have the ability to extend, uh, Neo4j and BloodHound with more information. So let’s say you created a script that gets information about Linux hosts, or maybe you just don’t like one of the pre-existing icons that we created. We wanted to give you the ability to change those icons or add new icons. So BlueHound will actually just look, um, uh, for icons based on the name. So if you have a new node with a specific type, it will load that icon, and you can also edit the pre-, the existing icons. You know, step it back to the actual, to the right video this time, which somehow got lost in translation. Oh no, it’s not it. Or was it? Yeah. So we just actually, we’re going to the resources folder, app list, and then we have all of the icons. So we can, let’s say we don’t like this user icon, we can just remove it and take this lovely SpongeBob icon, just name it user. Um, then once we open BlueHound again, all of the users will just be, um, SpongeBob, which is great. But of course you can add new ones. You don’t have to use just existing ones. Again, if you have new entity types or new types of nodes, just put the icon in the, you know, in the correct name, and it will be shown here.

Can you add custom nodes and edges to BlueHound?

Sagi Dulce: Okay, so we’re basically done with the main, uh, part of, uh, of this presentation, or this meetup. So we went over some, or went over BlueHound, what it is, why we created it. Uh, we discussed some of the niches, niche corners of BlueHound, and now I already see some questions in the chat. So if you have some, something to ask or something to clarify, you can just write it in the questions and answer, or just write it in the chat, and, uh, and then we can answer it, and we’ll give it a, a few minutes of answering. So, um, I’ll already pick something up.

Um, yeah, somebody asked, can I create my own custom nodes and my own custom edges? Uh, so yes. Um, even now, I think the — for example, if you’re using a tool like BloodHound, it just takes data, for example, from, uh, from Neo4j, but you can create whatever information that you want on top of it, or you can create new nodes, you can create new edges. Um, the problem is that the tool won’t always display what you want. If you have more information that you want to put there — just like we’ve seen in vulnerabilities, for example — or if you have a new type of machine or any type of node, it doesn’t always play well with a BloodHound. So if you want to add something, it won’t show in your GUI, for example. Uh, but for BlueHound, you can just push whatever data you want inside, and if you query for it, uh, it’s, yeah, you will find it. So you can, so then you can, um, so then you can just put whatever nodes you have, whatever edges you have, and so forth. Um, so I hope, hopefully that answers your question. If you want to, if not, please, uh, you can write another one in the chat.

What is BlueHound built on?

Sagi Dulce: Um, somebody asked, uh, if we can give some information about the technologies used by BlueHound. So maybe Dekel is the, is the person to answer this.

Dekel Paz: Yeah, sure. So, uh, as we are a fork of NeoDash, we use kind of same technologies. So we have TypeScript, that’s the main language. It’s packaged with Electron, which just lets you take a web app and, uh, you know, create an application out of it. So that’s cross-platform, so we can create, you know, binaries for Mac, Linux, and Windows pretty easily. Uh, other than that, running, using React, uh, Node — that’s just how Electron works. Um, we have a few Python scripts that we mentioned earlier. Um, anything else? Of course, Neo4j for the database. Um, yeah, I think those are the main components.

How does BlueHound work with BloodHound?

Sagi Dulce: Okay, another question. Um, somebody else, they can create — I’m sorry, reading an old one. Uh, so they’re already running BloodHound, so how do they integrate BlueHound? So basically, it’s, it’s out of the box. You don’t have to start from scratch. If you like running BloodHound once a month or once a quarter or whatever, you have the data. Now you have the option to just integrate BlueHound, and instead of running one query at a time or running some script over the data, you can just run all of your queries just once and get all this information. So if you’re already using BloodHound, then you can just start using BlueHound out of the box.

Is BlueHound data uploaded to the cloud?

Sagi Dulce: Um, uh, oh, another interesting question: is my information uploaded to cloud or shared? Uh, maybe also, uh, let’s take — I’ll take that, or maybe also part of the sharing option of importing, exporting, like what’s inside this import, export, uh, operation.

Dekel Paz: Yeah, so simple, simple and straightforward answer: no. Everything is local. Uh, we don’t upload anything to our servers or anything like that. Um, if you choose to share the JSON file, then that’s just configuration. Your Neo4j, that password will not be saved there. Uh, the only thing maybe you might need to be mindful of is the scripts and tools parameters, because those are exported. So if you put any passwords there or credentials, then you might need to manually remove that. But I didn’t not know, everything is local.

What are BlueHound’s main use cases?

Sagi Dulce: Cool. Um, another question is, what would be the main use case? Um, so there are a couple of main use cases. Like, I could put it in, like, in one word: building resilience. But that’s include, like, sub-steps. So I guess the first thing is that automation. If you want to create a practice where you continuously, uh, collecting data, and so BlueHound gives you this automation of doing it once a week, once a month, a month, whatever, so you have this practice of collecting data first. Then BlueHound just runs all the queries all at once. So whatever you’re interested in: how many vulnerable hosts I have that are, have access to domain admins, how many paths overall to the domain admins, uh, like how many users are logged on to sensitive servers, and so on and so forth. You can just keep adding your own metrics and queries, and that is done automatically with each analysis. And that’s just the use case of continuously measuring and building your resilience, but in a very, in an automated way. So it’s not a, it’s not like a manual thing that you have to keep on doing. Uh, so hopefully I, I answered that question.

Does RPC filtering affect ShotHound?

Sagi Dulce: Um, somebody asked, my environment uses RPC filtering, which is good, good practice. Um, uh, I’ll mention in the sentence the RPC Firewall, uh, for those who maybe aren’t, are unaware of it. Uh, is that what the ShotHound tool is using to determine practical path? I will show — so yeah, that could probably be the — if you’re using RPC filtering throughout your environment — I don’t know if you are using RPC Firewall. If you are not, that’s also available in our GitHub, so maybe you can check it out. But the answer is yes. If you are using, then ShotHound is definitely using, uh, RPC under the hood, and that’s why, um, you’re missing out some of those paths. Uh, so that’s a very good point.

How can you contribute to BlueHound?

Sagi Dulce: Let me see what else. Um, how can I contribute to BlueHound? Maybe Dekel, a word on that.

Dekel Paz: Yeah. Um, well, we’re on the right slide, because you can see our handles, our Twitter handles. So we have SagiSec and DekelPaz. Uh, can also, I guess, shoot an email to support at Zero Networks, uh, if you want to have any questions or suggestions. And, uh, best option for us is, uh, you know, just via Git. You can open a ticket, or if you’re really brave, uh, you’re welcome to, you know, up—, open a pull request. You know, write the code that you want and just, uh, create a pull request, so we can integrate it. But any of those options will really help us. We’re always, uh, happy just to hear about, you know, what people are using the tool for, or their use cases, maybe, you know, help with queries or some, you know, feature that could really help them. Um, yeah, all this here.

Sagi Dulce: Cool. Uh, I think that was probably the last, um, and we were sort of out of the, of the time. So just want to take this minute to say thank you. Uh, if you are using, or haven’t used — people are using BlueHound, you can check out the new version. If you haven’t used, you can download it from our GitHub. Uh, I mentioned, like, RPC Firewall. We had a bunch of other tools, uh, like CornerShot, a bunch of scripts. Uh, if you go to the Zero Networks website, you can also download TrustMeter, which is an, um, uh, which is very easy network scanner that you can use. And just like Dekel mentioned, uh, feel free to reach out to us via DMs, via this email, for anything at all, basically. Uh, so thank you. Thank you for joining. And again, if you have more questions that you didn’t get a chance to ask here, feel free to reach out to us.