sharphound

No entries match these filters. Clear filters

1. v2.17.1 Oct 16, 2026 · issue 111

   SharpHound v2.17.1 now collects Azure VM IDs from Windows computers during AD enumeration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.17.1 https://github.com/SpecterOps/SharpHound.git
   # already have the repo? check out this version:
   $ git checkout v2.17.1

2. v2.17.0 Oct 1, 2026 · issue 092

   SharpHound v2.17.0 adds a new Site collection method for enumerating Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Sites ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. and site data.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.17.0 https://github.com/SpecterOps/SharpHound.git
   # already have the repo? check out this version:
   $ git checkout v2.17.0

   • New detection Active Directory Sites ACL collection
3. 2026-09-17 Sep 17, 2026 · release notes

   SharpHound v9.7.1 expands OpenHound GitHub/Okta collection with performance telemetry and improved identity correlation

   • Adds optional Okta collection performance telemetry for diagnosing and tuning collections while preserving tenant isolation.

   1 detail in Everything

4. 2026-09-08 Sep 8, 2026 · release notes

   SharpHound/Enterprise adds multi-destination pathfinding (up to 3 nodes), GitHub Enterprise Server support, and collector support bundle management UI/API.

   • Adds Multi-Destination Pathfinding to build routes through up to three destination nodes in a single query
   • Adds GitHub Enterprise Server Endpoint Support to configure separate REST and GraphQL endpoints for GitHub Enterprise collection
   • Adds Collector Support Bundles management (request, download, delete) on the Manage Clients page
   • Adds signed Collector Offline webhook alerts for monitoring collector availability
   • Adds OpenHound configuration keys in config.toml to keep destination URLs and in secrets.toml for sensitive credentials for extension asset uploads

   +1 more show less

   • Adds identification of collector name, version, OpenHound version, and job ID in collector lifecycle logs

   6 details in Everything

5. 2026-08-18 Aug 18, 2026 · release notes

   SharpHound v2.15.0 supports case-sensitive OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. Object IDs and new API endpoints; BloodHound gains a beta Findings Table.

   • Adds FindingsTable (beta) to the Attack Paths page for triaging attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. findings at scale
   • Enables OpenGraph Extension Management by default, removing manual feature enablement
   • Adds node and relationship kind metadata via API endpoints for OpenGraph automation
   • Implements storage optimization in PostgreSQL that runs after ingest and analysis
   • Speeds up graph data deletion from PostgreSQL-backed environments via Database Management

   +2 more show less

   • Adds collector compatibility with case-sensitive OpenGraph Object IDs
   • Adds GitHub Self-Hosted Runner modeling capabilities in OpenHound for membership, delegation, and access paths

   7 details in Everything

6. 2026-08-04 Aug 4, 2026 · release notes

   OpenHound GitHub collector adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave., and Environment data; Okta collector gains role and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. modeling parity.

   • OpenHound GitHub Collector expands to identify identity, deployment, secret-access, and privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. paths across GitHub enterprises and organizations.
   • OpenHound Okta Collector improves analysis of Okta environments with reworked role assignments, resource sets, hybrid auth, and normalized SAML modeling.

   2 details in Everything

7. 2026-07-29 Jul 29, 2026 · release notes

   SharpHound v2.14.0 and BloodHound v9.5.1 add ESC14 path analysis, OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. entity panels, unified paginated API for attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., and case-sensitive object ID handling.

   • Replaces unified API endpoint /api/v1/attack-paths/findings with paginated GET /api/v1/attack-path-findings (and associated schema) returning unified attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. results
   • Adds OpenGraph Entity Info panel supporting custom extension-defined Entity Panel accordions and markdown content directly in the UI for OpenGraph nodes
   • Enables case-sensitive distinct OpenGraph object ID handling while keeping AD and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. ingest behavior case-insensitive
   • Supports audit SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration review by auditors without granting provider management permissions

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !/api/v1/attack-paths/findings endpoint replaced; clients must now use GET /api/v1/attack-path-findings with pagination parameters
   • !OpenGraph object ID handling changed: identical IDs differing only by case are now preserved as distinct objects (may affect existing pathing results)
8. 2026-07-07 Jul 7, 2026 · release notes

   SharpHound v9.4.0 adds Graph ID Lookup APIs, OpenHound resilience improvements, and auditor access to File Ingest and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Config.

   • Adds GET and POST Graph ID Lookup APIs to retrieve nodes and relationships by graph-assigned integer IDs for targeted automation and investigation
   • Enhances OpenHound data collection with longer job lifespans, version surface in BloodHound, and improved failure logging
   • Expands Auditor role access in BloodHound Enterprise to include File Ingest activity and SSO Configuration details
   • Increases memory limits for Cypher queries in BloodHound Enterprise
   • Improves Zone Builder rule authoring by preserving rule state across types and warning when Cypher-based rules return no results

   +1 more show less

   • Adds Variable Analysis Mode in Zone Builder to skip post-processing after Privilege Zone changes for faster graph updates

   6 details in Everything

9. 2026-06-17 Jun 17, 2026 · release notes

   OpenHound v2.12.2 adds Jamf API client auth; BloodHoon v9.3.0 adds role-based access, expanded audit logging, and OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. namespace visibility.

   • API endpoint for OpenGraph extension information now includes namespace field to view each extension's namespace
   • OpenHound Jamf collector authentication uses a Jamf Pro API client instead of previous methods
   • OpenHound supports GitHub Enterprise SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for connecting to enterprise-level single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. environments

   3 details in Everything

10. 2026-05-28 May 28, 2026 · release notes

    SharpHound 9.2.0 adds Eligible Roles to Entity Panel, new Cypher functions (UNWIND, head, tail), and reserved tag_ prefix for custom kinds

    └──▷ TRY IT
    Chain Cypher queries to find eligible roles for an Azure principal.
    copy

    $ MATCH (n:User) WHERE n.name = '<upn>' UNWIND n.eligibleRoles AS r WITH n, head(r) AS eligibleRole RETURN n.name, eligibleRole.displayName

    Sort Cypher query results by exposure score in descending order.
    copy

    $ MATCH (n:Group) RETURN n.name, n.exposureScore ORDER BY n.exposureScore DESC

    • Adds Eligible Roles section in the Entity Panel for supported Azure principals
    • Enables automatic node selection from search results via the Explore interface
    • Adds nodes(), relationships(), startNode(), and endNode clauses to Cypher queries on PostgreSQL backends
    • Adds UNWIND clause to expand list values into rows in Cypher queries
    • Adds head() and tail() functions for list navigation in Cypher expressions

    +3 more show less

    • Enables result sorting in RETURN and WITH clauses in ascending or descending order
    • Supports chaining query parts in Cypher for multi-step queries on PostgreSQL backends
    • Implements near-instantaneous evaluation of LIMIT clauses on PostgreSQL backends

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Custom OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. kinds using the tag_ prefix will now fail validation and must be renamed.
11. 2026-05-06 May 6, 2026 · release notes

    SharpHound v2.12.1 adds OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. extension API permissions and is_display_kind icon support

    • Adds granular API permissions for managing OpenGraph extensions and schema data access
    • Sets default node icons and colors in OpenGraph based on the is_display_kind field in extension schemas

    2 details in Everything

12. 2026-04-13 Apr 13, 2026 · release notes

    SharpHound Enterprise adds IWA auth; OpenHound collects GitHub/Jamf/Okta data; new Explore filters and graph controls.

    • Adds IWA (Integrated Windows Authentication) support for SharpHound Enterprise to authenticate with ADFS
    • Introduces OpenHound data collector framework with initial collectors for GitHub, Jamf, and Okta
    • Adds OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. Extension Management page in Administration for managing custom extensions
    • Enables analyzing custom graph findings in Attack Paths and Posture using extension-specific schemas
    • Adds Environment Targeted Access Control to scope User/Read-only access by environment with dynamic policy controls

    +11 more show less

    • Improves Explore graphs with clearer directional arrows, improved node labels, and intuitive selection behavior
    • Allows reordering and pinning columns via drag-and-drop in Explore Table View
    • Generates more useful filenames for graph exports to reduce filename collisions
    • Modernizes Navigation Sidebar with improved expand/collapse behavior for more predictable access
    • Improves Azure Hybrid Post-Processing data hygiene to reduce graph churn for large tenants
    • Adds OpenGraph Node Type Filtering in Explore Search to filter results by node type
    • Adds HasSession Edge Deletion capability to delete only HasSession edges without clearing the entire graph
    • Improves Accessibility with clearer component naming and better non-text content labeling
    • Updates Zone Builder Certification Selection Behavior for clearer list selection aligned with details panel
    • Refines Posture Metric Abbreviation for more precise counts in Posture view
    • Adds Custom Range Validation for more reliable custom date/time range behavior in Posture

    16 details in Everything

13. v2.12.0 Apr 9, 2026 · release notes

    SharpHound v2.12.0 adds built-in metrics collection for enumeration runs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.12.0 https://github.com/SpecterOps/SharpHound.git
    # already have the repo? check out this version:
    $ git checkout v2.12.0

14. 2026-03-23 Mar 23, 2026 · release notes

    SharpHound v8.9.0 adds Azure Federated Identity Credential collection; BHE allows separate OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. node/edge payloads.

    └──▷ USE IT
    Ingest nodes and edges separately in BHE without losing disconnected nodes
    api copy

    curl -X POST https://bhe.example.com/api/v1/ingest/nodes -H 'Authorization: Bearer <token>' -d @nodes.json; curl -X POST https://bhe.example.com/api/v1/ingest/edges -H 'Authorization: Bearer <token>' -d @edges.json

    • AZFederatedIdentityCredential nodes and AZAuthenticatesTo edges for mapped Azure Federated Identity Credentials
    • Separate OpenGraph node/edge upload endpoints/payloads in BloodHound Enterprise that preserve disconnected nodes

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !OpenGraph data payloads format changed for BloodHound Enterprise; existing ingestion scripts may fail unless updated to the new payload structure.
15. v2.11.0 Mar 20, 2026 · release notes

    SharpHound v2.11.0 improves NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. collection logging for better visibility during enumeration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.11.0 https://github.com/SpecterOps/SharpHound.git
    # already have the repo? check out this version:
    $ git checkout v2.11.0

16. 2026-03-04 Mar 4, 2026 · release notes

    SharpHound v8.7.0 adds resizable table columns, meta node details in Entity Panel, and valid_edges.json schema for edge guidance.

    • Adds valid_edges.json schema to define valid source-target node relationships and supported edge types.
    • Enables resizing table columns in the graph view table layout of Explore.
    • Displays Meta node details in the Entity Panel without errors.

    3 details in Everything

17. 2026-02-11 Feb 11, 2026 · release notes

    SharpHound v8.6.0 adds AzureHound User-Agent flag and Last Sign-In data tracking; enhances Cypher query permissions and Zone Builder.

    └──▷ TRY IT
    Customize the HTTP user agent string used by AzureHound when collecting data from Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.
    copy

    $ AzureHound --user-agent "MyCyberTool/1.0"

    • Adds --user-agent flag to AzureHound to customize the HTTP User-Agent header for requests
    • Enables tracking of user activity via last successful sign-in timestamp from Entra ID in collected data

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Zone Builder Revoke button renamed to Reject
18. 2026-01-22 Jan 22, 2026 · release notes

    SharpHound 8.5.0 adds keyboard shortcuts, API filtering by kind/membership counts, AzureHound region update, and CA logging.

    • Adds keyboard shortcuts for navigating and acting across the BloodHound app UI without a mouse
    • Adds GET /api/.../count-by-kind API endpoint to retrieve member counts by primary kind for zone/tag selectors
    • Adds filtering options (primary kind, name, or object ID) to the Filter Asset Group Tag Members API

    3 details in Everything

19. v2.9.0 Jan 16, 2026 · release notes

    SharpHound v2.9.0 adds CompStatus event collection to the Certificate Abuse processor.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.0 https://github.com/SpecterOps/SharpHound.git
    # already have the repo? check out this version:
    $ git checkout v2.9.0

20. v2.8.0 Oct 23, 2025 · release notes

    SharpHound v2.8.0 adds AdminSDHolder collection, netlogon registry key enumeration, and ObjectId in computer status output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8.0 https://github.com/SpecterOps/SharpHound.git
    # already have the repo? check out this version:
    $ git checkout v2.8.0

    • Adds AdminSDHolder relationship collection, enabling BloodHound to surface AdminSDHolder-based privilege paths.
    • Collects the netlogon registry key during enumeration, expanding registry-based attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. data.
    • Adds ObjectId to CompStatus (computer collection status) output for more precise per-host tracking.

    3 details in Everything

21. v2.7.0 Jul 24, 2025 · release notes

    SharpHound v2.7.0 adds SIDHistory collection for groups and expanded completion-status output locations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.0 https://github.com/SpecterOps/SharpHound.git
    # already have the repo? check out this version:
    $ git checkout v2.7.0

    • Supports HasSIDHistory relationship collection on Group objects, enabling BloodHound to surface SID-history-based privilege paths through groups.
    • Adds new CompStatus writing locations, giving operators more flexibility in where collection completion status is recorded.

    2 details in Everything

22. v2.6.0 Mar 4, 2025 · release notes

    SharpHound v2.6.0 adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. authentication support, Registry collection, and reworked Owns/Owner relationship enumeration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.0 https://github.com/SpecterOps/SharpHound.git
    # already have the repo? check out this version:
    $ git checkout v2.6.0

    • Adds NTLM authentication support for LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. collection, enabling enumeration in environments where KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. is unavailable or restricted.
    • New Registry collection capability expands the data SharpHound can gather from domain-joined hosts.
    • Reworked Owns/Owner relationship collection improves accuracy of object ownership edges in BloodHound graphs.

    3 details in Everything

23. v2.5.1 Jul 26, 2024 · release notes

    SharpHound v2.5.1 adds ECA RoleSeparation collection and a revamped LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. connection algorithm for improved stability.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.1 https://github.com/SpecterOps/SharpHound.git
    # already have the repo? check out this version:
    $ git checkout v2.5.1

    • Collects ECA RoleSeparation data, expanding AD CS enumeration coverage.
    • Revamped LDAP connection algorithm with improved stability and automatic fallbacks.

    2 details in Everything

24. v2.4.1 May 3, 2024 · release notes

    SharpHound v2.4.1 adds collection of unresolved published certificate templates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.1 https://github.com/SpecterOps/SharpHound.git
    # already have the repo? check out this version:
    $ git checkout v2.4.1

25. v2.3.0 Dec 11, 2023 · release notes

    SharpHound v2.3.0 adds ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC1 early access support and configuration class collection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.0 https://github.com/SpecterOps/SharpHound.git
    # already have the repo? check out this version:
    $ git checkout v2.3.0

    • Adds ADCSESC1 early access support for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Certificate Services enumeration
    • Adds configuration class collection to gather configuration object properties
    • Adds IsACLProtected property to property bags for ingest

    3 details in Everything

26. v2.0.2 Dec 4, 2023 · release notes

    SharpHound v2.0.2 adds session enumeration as local admin and edge collection from Distinguished Names

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.2 https://github.com/SpecterOps/SharpHound.git
    # already have the repo? check out this version:
    $ git checkout v2.0.2

    • Adds session enumeration capability running as the local administrator account to collect local group memberships
    • Builds collected data to include edges derived from Distinguished Names (DN) attributes

    2 details in Everything

27. v1.1.1 May 23, 2023 · release notes

    SharpHound v1.1.1 adds sMSA password collection and fixes CollectionMethod flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.1 https://github.com/SpecterOps/SharpHound.git
    # already have the repo? check out this version:
    $ git checkout v1.1.1

    └──▷ USE IT
    Collect sMSA passwords during a standard domain enumeration run.
    shell copy

    .\SharpHound.exe -c Container,Group,LocalAdmin,RDP -m 'sMSA'

    • Adds sMSA to CollectionMethod for dumping sMSA passwords on computer objects.

    1 detail in Everything

28. v1.0.4 Jun 24, 2022 · release notes

    Adds --SkipPasswordCheck and --DisableCertVerification flags plus an InvokeSharpHound() PowerShell function

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.4 https://github.com/SpecterOps/SharpHound.git
    # already have the repo? check out this version:
    $ git checkout v1.0.4

    └──▷ USE IT
    Skip password age checks when enumerating computers to speed up collection in time-sensitive engagements.
    shell copy

    SharpHound.exe --Loop --CollectionMethods All --ZipFileName result.zip --SkipPasswordCheck

    Disable LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. certificate validation to connect to servers with self-signed or untrusted certificates.
    shell copy

    SharpHound.exe --Loop --CollectionMethods All --ZipFileName result.zip --DisableCertVerification

    • Adds --SkipPasswordCheck flag to ignore PwdLastSet age during computer enumeration
    • Adds --DisableCertVerification flag to ignore LDAPS certificate validation
    • Adds an InvokeSharpHound() function for PS ingestor integration

    3 details in Everything