BloodHound Usage via CommandLine

Daniel Koifman@Koifsec

•updated Mar 1, 2026•9•0•113

The rule detects execution of BloodHound or its ingestors by matching on process creation events where the new process name is bloodhound.exe or the command line contains characteristic BloodHound arguments.