MexicanMafia BloodHound AD Enumeration and Dataset Exfiltration

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

Detects execution of SharpHound (BloodHound) for Active Directory enumeration and subsequent exfiltration of collected datasets, specifically tracking activity attributed to the MexicanMafia (Operation Escaneo).