https://cybertoolchain.io/tools/sharphound New releases and features in sharphound, tracked by The Cyber Toolchain. en Fri, 16 Oct 2026 19:16:30 GMT https://github.com/SpecterOps/SharpHound/releases/tag/v2.17.1 https://github.com/SpecterOps/SharpHound/releases/tag/v2.17.1 Fri, 16 Oct 2026 19:16:30 GMT SharpHound v2.17.1 now collects Azure VM IDs from Windows computers during AD enumeration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Collects Azure VM IDs from Windows computers during enumeration, enabling BloodHound to correlate on-premises AD objects with Azure infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://github.com/SpecterOps/SharpHound/releases/tag/v2.17.0 https://github.com/SpecterOps/SharpHound/releases/tag/v2.17.0 Thu, 01 Oct 2026 23:10:38 GMT SharpHound v2.17.0 adds collection of Active Directory Sites ACLs and site data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds collection of Active Directory Sites ACLs and site data, accessible via the `Site` collection method (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ `-c Site` or combined with `Default`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://bloodhound.specterops.io/resources/release-notes/summary#2026-06-17 https://bloodhound.specterops.io/resources/release-notes/summary#2026-06-17 Wed, 17 Jun 2026 00:00:00 GMT OpenHound v2.12.2 adds Jamf API client auth; BloodHoon v9.3.0 adds role-based access, expanded audit logging, and OpenGraph namespace visibility. • `API` endpoint for OpenGraph extension information now includes `namespace` field to view each extension's namespace • OpenHound Jamf collector authentication uses a Jamf Pro API client instead of previous methods • OpenHound supports GitHub Enterprise SSO for connecting to enterprise-level single sign-on environments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://bloodhound.specterops.io/resources/release-notes/summary#2026-05-28 https://bloodhound.specterops.io/resources/release-notes/summary#2026-05-28 Thu, 28 May 2026 00:00:00 GMT SharpHound 9.2.0 adds Eligible Roles to Entity Panel, new Cypher functions (UNWIND, head, tail), and reserved tag_ prefix for custom kinds • Adds 'Eligible Roles' section in the Entity Panel for supported Azure principals • Enables automatic node selection from search results via the Explore interface • Adds nodes(), relationships(), startNode(), and `endNode` clauses to Cypher queries on PostgreSQL backends • Adds `UNWIND` clause to expand list values into rows in Cypher queries • Adds head() and tail() functions for list navigation in Cypher expressions • Enables result sorting in `RETURN` and `WITH` clauses in ascending or descending order • Supports chaining query parts in Cypher for multi-step queries on PostgreSQL backends • Implements near-instantaneous evaluation of `LIMIT` clauses on PostgreSQL backends Breaking changes: • Custom OpenGraph kinds using the `tag_` prefix will now fail validation and must be renamed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://bloodhound.specterops.io/resources/release-notes/summary#2026-05-06 https://bloodhound.specterops.io/resources/release-notes/summary#2026-05-06 Wed, 06 May 2026 00:00:00 GMT SharpHound v2.12.1 adds OpenGraph extension API permissions and is_display_kind icon support • Adds granular API permissions for managing OpenGraph extensions and schema data access • Sets default node icons and colors in OpenGraph based on the `is_display_kind` field in extension schemas Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://bloodhound.specterops.io/resources/release-notes/summary#2026-04-13 https://bloodhound.specterops.io/resources/release-notes/summary#2026-04-13 Mon, 13 Apr 2026 00:00:00 GMT SharpHound Enterprise adds IWA auth; OpenHound collects GitHub/Jamf/Okta data; new Explore filters and graph controls. • Adds `IWA` (Integrated Windows Authentication) support for SharpHound Enterprise to authenticate with ADFS • Introduces OpenHound data collector framework with initial collectors for GitHub, Jamf, and Okta • Adds OpenGraph Extension Management page in Administration for managing custom extensions • Enables analyzing custom graph findings in Attack Paths and Posture using extension-specific schemas • Adds Environment Targeted Access Control to scope User/Read-only access by environment with dynamic policy controls • Improves Explore graphs with clearer directional arrows, improved node labels, and intuitive selection behavior • Allows reordering and pinning columns via drag-and-drop in Explore Table View • Generates more useful filenames for graph exports to reduce filename collisions • Modernizes Navigation Sidebar with improved expand/collapse behavior for more predictable access • Improves Azure Hybrid Post-Processing data hygiene to reduce graph churn for large tenants • Adds OpenGraph Node Type Filtering in Explore Search to filter results by node type • Adds HasSession Edge Deletion capability to delete only `HasSession` edges without clearing the entire graph • Improves Accessibility with clearer component naming and better non-text content labeling • Updates Zone Builder Certification Selection Behavior for clearer list selection aligned with details panel • Refines Posture Metric Abbreviation for more precise counts in Posture view • Adds Custom Range Validation for more reliable custom date/time range behavior in Posture Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://github.com/SpecterOps/SharpHound/releases/tag/v2.12.0 https://github.com/SpecterOps/SharpHound/releases/tag/v2.12.0 Thu, 09 Apr 2026 16:34:52 GMT SharpHound v2.12.0 adds built-in metrics collection for enumeration runs. • Adds metrics collection to SharpHound enumeration runs for operational visibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://bloodhound.specterops.io/resources/release-notes/summary#2026-03-23 https://bloodhound.specterops.io/resources/release-notes/summary#2026-03-23 Mon, 23 Mar 2026 00:00:00 GMT SharpHound v8.9.0 adds Azure Federated Identity Credential collection; BHE allows separate OpenGraph node/edge payloads. • `AZFederatedIdentityCredential` nodes and `AZAuthenticatesTo` edges for mapped Azure Federated Identity Credentials • Separate OpenGraph node/edge upload endpoints/payloads in BloodHound Enterprise that preserve disconnected nodes Breaking changes: • OpenGraph data payloads format changed for BloodHound Enterprise; existing ingestion scripts may fail unless updated to the new payload structure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://github.com/SpecterOps/SharpHound/releases/tag/v2.11.0 https://github.com/SpecterOps/SharpHound/releases/tag/v2.11.0 Fri, 20 Mar 2026 20:18:06 GMT SharpHound v2.11.0 improves NTLM collection logging for better visibility during enumeration. • Improves NTLM collection logging to provide better visibility into NTLM-based enumeration activity. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://bloodhound.specterops.io/resources/release-notes/summary#2026-03-04 https://bloodhound.specterops.io/resources/release-notes/summary#2026-03-04 Wed, 04 Mar 2026 00:00:00 GMT SharpHound v8.7.0 adds resizable table columns, meta node details in Entity Panel, and valid_edges.json schema for edge guidance. • Adds `valid_edges.json` schema to define valid source-target node relationships and supported edge types. • Enables resizing table columns in the graph view table layout of Explore. • Displays Meta node details in the Entity Panel without errors. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://bloodhound.specterops.io/resources/release-notes/summary#2026-02-11 https://bloodhound.specterops.io/resources/release-notes/summary#2026-02-11 Wed, 11 Feb 2026 00:00:00 GMT SharpHound v8.6.0 adds AzureHound User-Agent flag and Last Sign-In data tracking; enhances Cypher query permissions and Zone Builder. • Adds `--user-agent` flag to AzureHound to customize the HTTP User-Agent header for requests • Enables tracking of user activity via last successful sign-in timestamp from Entra ID in collected data Breaking changes: • Zone Builder 'Revoke' button renamed to 'Reject' Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://bloodhound.specterops.io/resources/release-notes/summary#2026-01-22 https://bloodhound.specterops.io/resources/release-notes/summary#2026-01-22 Thu, 22 Jan 2026 00:00:00 GMT SharpHound 8.5.0 adds keyboard shortcuts, API filtering by kind/membership counts, AzureHound region update, and CA logging. • Adds keyboard shortcuts for navigating and acting across the BloodHound app UI without a mouse • Adds `GET /api/.../count-by-kind` API endpoint to retrieve member counts by primary kind for zone/tag selectors • Adds filtering options (primary kind, name, or object ID) to the 'Filter Asset Group Tag Members' API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://github.com/SpecterOps/SharpHound/releases/tag/v2.8.0 https://github.com/SpecterOps/SharpHound/releases/tag/v2.8.0 Thu, 23 Oct 2025 19:11:50 GMT SharpHound v2.8.0 adds AdminSDHolder collection, netlogon registry key enumeration, and ObjectId in computer status output. • Adds AdminSDHolder relationship collection, enabling BloodHound to surface AdminSDHolder-based privilege paths. • Collects the netlogon registry key during enumeration, expanding registry-based attack path data. • Adds ObjectId to CompStatus (computer collection status) output for more precise per-host tracking. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://github.com/SpecterOps/SharpHound/releases/tag/v2.7.0 https://github.com/SpecterOps/SharpHound/releases/tag/v2.7.0 Thu, 24 Jul 2025 20:20:50 GMT SharpHound v2.7.0 adds SIDHistory collection for groups and expanded completion-status output locations. • Supports HasSIDHistory relationship collection on Group objects, enabling BloodHound to surface SID-history-based privilege paths through groups. • Adds new CompStatus writing locations, giving operators more flexibility in where collection completion status is recorded. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://github.com/SpecterOps/SharpHound/releases/tag/v2.6.0 https://github.com/SpecterOps/SharpHound/releases/tag/v2.6.0 Tue, 04 Mar 2025 23:22:05 GMT SharpHound v2.6.0 adds NTLM authentication support, Registry collection, and reworked Owns/Owner relationship enumeration. • Adds NTLM authentication support for LDAP collection, enabling enumeration in environments where Kerberos is unavailable or restricted. • New Registry collection capability expands the data SharpHound can gather from domain-joined hosts. • Reworked Owns/Owner relationship collection improves accuracy of object ownership edges in BloodHound graphs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://github.com/SpecterOps/SharpHound/releases/tag/v2.5.1 https://github.com/SpecterOps/SharpHound/releases/tag/v2.5.1 Fri, 26 Jul 2024 21:06:20 GMT SharpHound v2.5.1 adds ECA RoleSeparation collection and a revamped LDAP connection algorithm for improved stability. • Collects ECA RoleSeparation data, expanding AD CS enumeration coverage. • Revamped LDAP connection algorithm with improved stability and automatic fallbacks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://github.com/SpecterOps/SharpHound/releases/tag/v2.4.1 https://github.com/SpecterOps/SharpHound/releases/tag/v2.4.1 Fri, 03 May 2024 14:05:39 GMT SharpHound v2.4.1 adds collection of unresolved published certificate templates • Adds collection of unresolved published certificate templates to the data gathered during an enumeration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://github.com/SpecterOps/SharpHound/releases/tag/v2.0.2 https://github.com/SpecterOps/SharpHound/releases/tag/v2.0.2 Mon, 04 Dec 2023 18:49:54 GMT SharpHound v2.0.2 adds session enumeration as local admin and edge collection from Distinguished Names • Adds `session` enumeration capability running as the local administrator account to collect local group memberships • Builds collected data to include edges derived from Distinguished Names (DN) attributes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://github.com/SpecterOps/SharpHound/releases/tag/v1.1.1 https://github.com/SpecterOps/SharpHound/releases/tag/v1.1.1 Tue, 23 May 2023 14:32:16 GMT SharpHound v1.1.1 adds sMSA password collection and fixes CollectionMethod flag • Adds `sMSA` to `CollectionMethod` for dumping sMSA passwords on computer objects. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound https://github.com/SpecterOps/SharpHound/releases/tag/v1.0.4 https://github.com/SpecterOps/SharpHound/releases/tag/v1.0.4 Fri, 24 Jun 2022 14:31:12 GMT Adds `--SkipPasswordCheck` and `--DisableCertVerification` flags plus an InvokeSharpHound() PowerShell function • Adds `--SkipPasswordCheck` flag to ignore PwdLastSet age during computer enumeration • Adds `--DisableCertVerification` flag to ignore LDAPS certificate validation • Adds an InvokeSharpHound() function for PS ingestor integration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sharphound