SharpHound

SharpHound is an open-source Microsoft C#-based Active Directory reconnaissance and data-ingestion tool for BloodHound. The content consistently describes it being used to collect and map Active Directory information, including users, groups, computers, sessions, shares, SPNs, service accounts, and domain relationships, often via LDAP and RPC-based enumeration. It is associated with discovery and reconnaissance activity and is referenced in detection content for command-line usage, file modifications, LDAP query patterns, anomalous SPN requests, and RPC-based user/session/share enumeration.

The tool appears in multiple intrusion contexts. Sophos reported attackers in the Chinese state-directed Operation Crimson Palace campaign, specifically Cluster Charlie, using SharpHound in November 2023 for Active Directory infrastructure mapping after deploying Havoc and Cobalt Strike, including in-memory execution through a Cobalt Strike beacon, DLL-based deployment, and lateral movement via WMIC and scheduled tasks. Cisco Talos reported the China-nexus actor UAT-8837 using SharpHound to collect Active Directory information after gaining access through vulnerable servers or compromised credentials, alongside tools such as EarthWorm, DWAgent, Impacket, Rubeus, GoExec, and Certipy, while targeting critical infrastructure sectors in North America. Additional reporting ties SharpHound to UNC3944 reconnaissance behavior and to Ryuk and BlackSuit intrusion activity for Active Directory discovery.

High-confidence behaviors directly mentioned in the content include in-memory loading without writing the tool to disk, deployment as a DLL, execution through Cobalt Strike, and use for enterprise network and Active Directory topology mapping. The content does not present SharpHound as self-propagating malware or ransomware; rather, it is repeatedly characterized as a legitimate/open-source reconnaissance utility frequently abused by threat actors during post-compromise discovery.