BloodHound Narrator#

Turn BloodHound attack paths into boardroom-ready security reports — entirely offline.

Built for pentesters, blue teams, and AD security consultants who need to translate BloodHound graph output into actionable deliverables without spending hours writing prose.

BloodHound Narrator ingests Cypher export JSON, scores each attack path on a weighted severity model, and produces a dual-layer Markdown report:

1. CISO / Executive Layer — severity summary table, per-path business risk narrative, impact statements written in non-technical language that management and board members can act on.
2. Technical Remediation Appendix — step-by-step hardening playbook with PowerShell commands, Event IDs to monitor, and remediation guidance per finding.

Detected attack patterns: DCSync and directory replication rights, Kerberoasting, unconstrained delegation, resource-based constrained delegation (RBCD), shadow credentials (AddKeyCredentialLink), LAPS and gMSA password reads, AD CS escalation (ESC1, ESC3, ESC4, ESC6a/b, ESC7, ESC9a/b, ESC10a/b, ESC13, Golden Certificate, CA management rights, PKI template flag writes), GenericAll / WriteDacl / WriteOwner / GenericWrite / AllExtendedRights ACL abuse, GPO takeover, lateral movement chains (AdminTo + HasSession + CanPSRemote / ExecuteDCOM / SQLAdmin), Tier 0 boundary violations, stale service account passwords, and sensitive data exposure paths.

No API keys. No network calls. No data exfiltration risk. Air-gap compatible. Works in regulated, classified, and OT environments.

Setup#

Install PowerShell (if not already present):

bash

# macOS
brew install powershell/tap/powershell

# Linux (Ubuntu/Debian)
sudo apt-get install -y powershell

# Windows — already included

No environment variables or credentials required.

Usage#

bash

# Generate a full report (all severities)
bash {baseDir}/scripts/bh-narrator.sh -InputFile "path/to/bloodhound-export.json"

# Only include Critical and High findings
bash {baseDir}/scripts/bh-narrator.sh -InputFile "path/to/export.json" -MinSeverity High

# Specify output path
bash {baseDir}/scripts/bh-narrator.sh -InputFile "path/to/export.json" -OutputFile "report.md"

# Pipe classified objects for further processing
bash {baseDir}/scripts/bh-narrator.sh -InputFile "path/to/export.json" -PassThru

Run the test suite#

bash

bash {baseDir}/tests/run-tests.sh

Two synthetic exports are included for validation:

• {baseDir}/tests/synthetic-bloodhound.json — 5 classic paths (3 Critical, 2 High)
• {baseDir}/tests/synthetic-adcs.json — AD CS, RBCD, shadow credential, and schema-drift cases

Both contain fabricated data only. Neither reflects a real environment.

Severity Scoring Model#

Scoring is additive: every factor a path matches contributes points, so a Kerberoastable account that also reaches Tier 0 with a stale password stacks all three signals rather than collapsing to one category. The total is capped at 100.

Path-level factors#

FactorPointsTerminates at Tier 0 core (DA, EA, Administrators, DCs, Schema/Key Admins)+40Terminates at a privileged operator group (Account/Backup/Server/Print Operators, DnsAdmins)+30Unconstrained delegation anywhere in path+20Sensitive data keyword in a node description+15Kerberoastable source account+10Kerberoastable account mid-path+6Short path (1-2 hops)+10Medium path (3 hops)+5Lateral movement chain (AdminTo + HasSession)+5Stale source password (>365 days)+5

Edge weights#

Edge scoring is table-driven; the full table lives in scripts/lib/SeverityClassifier.txt under $Script:EdgeWeights. The Tier 0 column is an additional bonus applied when the edge target is a Tier 0 object.

EdgeBase+Tier 0DCSync / GetChangesAll / GetChanges30 / 25 / 20—GenericAll, WriteDacl, Owns15+15AllExtendedRights, WriteOwner12+18GenericWrite, AddMember, ForceChangePassword, WriteAccountRestrictions10+10 to +15AddKeyCredentialLink (shadow credentials)20+10AllowedToAct / AddAllowedToAct (RBCD)20+10AllowedToDelegate (constrained delegation)10+10ReadLAPSPassword / SyncLAPSPassword / ReadGMSAPassword15—GoldenCert40—ADCSESC1 / ESC3 / ESC4 / ESC6a / ESC6b / ESC735—ADCSESC9a/b, ESC10a/b, ESC1330—ManageCA / ManageCertificates25 / 20—WritePKIEnrollmentFlag, WritePKINameFlag, DelegatedEnrollmentAgent20—SQLAdmin, WriteSPN8—CanPSRemote, ExecuteDCOM, AddSelf, GpLink, Enroll5+5 (GpLink)AdminTo, HasSession, CanRDP3—MemberOf, Contains, and AD CS structural edges0 (ignored)—

Thresholds: Critical >= 50 | High >= 30 | Medium >= 15 | Low < 15

Unknown edges#

Edge labels that are neither weighted nor explicitly ignored are collected and reported through a warning at the end of the run, and are retrievable via Get-UnknownEdgeLabels. This matters because BloodHound adds edge types between releases: without it, a newer export would score unrecognised edges as zero and silently understate severity.

Scope note on AD CS#

ESC1, ESC3, ESC4, ESC6, ESC7, ESC9, ESC10 and ESC13 are detected from the composite ADCSESC* edges emitted by BloodHound CE. Techniques that BloodHound does not model as a composite edge — notably ESC2, ESC5, ESC8 (NTLM relay to web enrollment) and ESC11 — are not detected here. Use Certipy or a dedicated AD CS audit for those; this skill reports what is present in the graph it is given.

Report Output#

The generated Markdown report includes:

• Header with domain name, collection date, BloodHound version
• Executive summary with severity distribution table
• Per-path findings with attack chain, business risk bullets, and impact statement
• Technical remediation appendix with numbered steps per finding (DCSync removal, gMSA migration, delegation hardening, tier isolation, GPO lockdown, etc.)

Who Is This For#

• Pentesters delivering AD audit reports to clients — skip the manual write-up, generate the narrative from your BloodHound data
• Blue team / SOC analysts triaging BloodHound findings after a security assessment
• Security consultants who need client-ready deliverables fast
• CISOs and security managers who want attack path reports they can actually read without a graph database
• Purple teams documenting offensive findings for defensive remediation

Use Cases#

• Post-pentest AD audit reporting
• Quarterly Active Directory security health checks
• Incident response — rapid attack path analysis after a compromise
• Compliance reporting (ISO 27001, NIS2, LPM, SOC2) requiring documented AD risk assessments
• Training and awareness — show management what "3 hops to Domain Admin" actually means