ShareHound - Mapping Network Share Rights into BloodHound OpenGraph

This webinar introduces ShareHound, a new open graph collector for SpecterOps that maps network file shares into BloodHound using the open graph technology introduced in BloodHound 8 2:05.

Key Takeaways:
• ShareHound addresses a blind spot in data collection by enabling auditors to map network shares, which often contain low-hanging fruits like passwords, scripts, and sensitive diagrams 2:10.
• The tool uses a custom Domain Specific Language called ShareQL for flexible rule-based filtering, with a VS Code extension available for syntax highlighting and autocompletion 2:22.
• Network shares are critical to audit as they remain common ransomware entry points through misconfigured permissions like Full Control or Write access 2:28.
• Once ingested into BloodHound, Cypher queries can identify users with dangerous permissions on shares, locate specific files like VMDKs, and visualize directory trees as attack paths 2:33.
• ShareHound does not read file contents to avoid bandwidth issues, so it cannot directly detect GPP passwords, though this could be added as a future feature 2:42.

ShareHound provides security teams with scalable network share mapping capabilities, transforming previously difficult-to-audit file structures into actionable attack path visualizations within BloodHound.

Sources:

• 2:05 Introduction to ShareHound and BloodHound 8 open graph integration.
• 2:10 Network shares as a blind spot and low-hanging fruit for auditors.
• 2:22 ShareQL domain specific language and VS