Alternatives and similar repositories for ShadowHound:

Users that are interested in ShadowHound are comparing it to the libraries listed below

• CrowdStrike / sccmhound
  A BloodHound collector for Microsoft Configuration Manager
  ☆261Updated this week
• Mayyhem / Maestro
  Abusing Intune for Lateral Movement over C2
  ☆302Updated 2 weeks ago
• ajm4n / DLLHound
  Find potential DLL Sideloads on your windows computer
  ☆152Updated 2 weeks ago
• MzHmO / PowershellKerberos
  Some scripts to abuse kerberos using Powershell
  ☆320Updated last year
• trustedsec / specula
  ☆185Updated 3 months ago
• coffeegist / bofhound
  Generate BloodHound compatible JSON from logs written by ldapsearch BOF, pyldapsearch and Brute Ratel's LDAP Sentinel
  ☆181Updated 3 weeks ago
• logangoins / Cable
  .NET post-exploitation toolkit for Active Directory reconnaissance and exploitation
  ☆257Updated 2 months ago
• garrettfoster13 / pre2k
  ☆298Updated 2 months ago
• CobblePot59 / ADcheck
  Assess the security of your Active Directory with few or all privileges.
  ☆249Updated last week
• synacktiv / GPOddity
  The GPOddity project, aiming at automating GPO attack vectors through NTLM relaying (and more).
  ☆268Updated 2 months ago
• synacktiv / SCCMSecrets
  SCCMSecrets.py aims at exploiting SCCM policies distribution for credentials harvesting, initial access and lateral movement.
  ☆181Updated 3 weeks ago
• Leo4j / Invoke-SessionHunter
  Retrieve and display information about active user sessions on remote computers. No admin privileges required.
  ☆170Updated 4 months ago
• Malcrove / SeamlessPass
  A tool leveraging Kerberos tickets to get Microsoft 365 access tokens using Seamless SSO
  ☆150Updated 4 months ago
• Yaxxine7 / ASRepCatcher
  Make everyone in your VLAN ASRep roastable
  ☆152Updated 3 weeks ago
• MaLDAPtive / Invoke-Maldaptive
  MaLDAPtive is a framework for LDAP SearchFilter parsing, obfuscation, deobfuscation and detection.
  ☆235Updated 5 months ago
• CCob / DRSAT
  Disconnected RSAT - A method of running Group Policy Manager, Certificate Authority and Certificate Templates MMC snap-ins from non-domai…
  ☆203Updated last week
• 0xthirteen / Carseat
  Python implementation of GhostPack's Seatbelt situational awareness tool
  ☆234Updated last month
• LuemmelSec / Client-Checker
  ☆171Updated last month
• decoder-it / KrbRelay-SMBServer
  ☆197Updated 3 months ago
• deepinstinct / NoFilter
  ☆296Updated 2 months ago
• RedSiege / jargon
  ☆125Updated 6 months ago
• dazzyddos / HSC24RedTeamInfra
  Slides and Codes used for the workshop Red Team Infrastructure Automation
  ☆176Updated 8 months ago
• secureworks / pytune
  ☆170Updated last month
• decoder-it / KrbRelayEx
  ☆279Updated last month
• ZephrFish / Bloodhound-CustomQueries
  Custom Queries - Brought Up to BH4.1 syntax
  ☆235Updated 2 months ago
• badsectorlabs / sccm-http-looter
  Find interesting files stored on (System Center) Configuration Manager (SCCM/CM) shares via HTTP(s)
  ☆173Updated 3 months ago
• LuemmelSec / Custom-BloodHound-Queries
  ☆174Updated last month
• Offensive-Panda / LsassReflectDumping
  This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone…
  ☆175Updated 2 months ago
• safedv / RustSoliloquy
  A Rust implementation of Internal-Monologue — retrieving NetNTLM hashes without touching LSASS, leveraging SSPI for NTLM negotiation and …
  ☆149Updated 3 weeks ago
• SecuraBV / Timeroast
  Timeroasting scripts by Tom Tervoort
  ☆250Updated last year