🩸 BloodHound Path Poisoning

Fake abusable AD edges harvested by SharpHound.

→ Explore in ATT&CK matrix (4 mappings) Deployment detail

What it is

Inject fake "abusable" edges into Active Directory that BloodHound's SharpHound collector will harvest. For example, create a fake user svc-backup-admin with GenericAll rights on a honey OU. BloodHound will show this as a viable attack path. When the attacker attempts to exploit this path (e.g., DCSync, password reset), they hit a tripwire.

Implementation requirements

Active Directory with permissions to create OUs, users, and ACL entries
Understanding of BloodHound's graph query patterns (specifically SharpHound's LDAP queries)
Fake admin edges: GenericAll, WriteDACL, ForceChangePassword on honey objects
Monitoring: Windows Event IDs 4662 (Directory Service Access), 5136 (Directory Service Changes) on honey objects
OPSEC: Paths must look naturally exploitable — avoid obviously fake names
Rollback: Remove the decoy permission entries first, then the decoy user and OU.
Upkeep: Run your own BloodHound collection quarterly to confirm the path still appears as intended.

Technologies

Windows

ATT&CK coverage 4

Technique	Tactic	Status	Confidence	Tier
T1069 Permission Groups Discovery	Discovery	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2429 'Honeytoken was queried via LDAP'; Microsoft maps it to T1069 and T1069.002. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1069 to its Lures activity.
T1069.002 Domain Groups	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2429 'Honeytoken was queried via LDAP'; Microsoft maps it to T1069.002 Domain Groups. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1069.002 Domain Groups as an adversary behaviour.
T1087 Account Discovery	Discovery	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2429 'Honeytoken was queried via LDAP' fires on reconnaissance against a honeytoken user; Microsoft maps it to T1087 and T1087.002. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1087 to its Lures activity.
T1087.002 Domain Account	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2429 'Honeytoken was queried via LDAP'; Microsoft maps it to T1087.002 Domain Account. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1087.002 Domain Account as an adversary behaviour.

Evidence

Deploying honeytokens in Active Directory & deceptive BloodHound paths — Freingruber, R. (APT29a), APT29a Security Blog 2019 industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: APT29a Security Blog, 2019. The technique exploits how SharpHound (BloodHound's collector) ingests ALL AD objects, including fake ones.