MexicanMafia BloodHound AD Enumeration and bloodhound.zip Dataset Dump

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects the execution of BloodHound or SharpHound Active Directory enumeration tools followed by the creation of a 'bloodhound.zip' archive, which is commonly used to exfiltrate collected Active Directory mapping data.