ProfileHound: Post-Escalation Tool Designed to Achieve Red Team Objectives
ProfileHound is a post-exploitation tool designed for security professionals to identify high-value targets in Active Directory environments. It addresses a significant gap in reconnaissance by enumerating domain user profiles on compromised machines,…
ProfileHound is a post-exploitation tool designed for security professionals to identify high-value targets in Active Directory environments. It addresses a significant gap in reconnaissance by enumerating domain user profiles on compromised machines, facilitating data-driven decisions for further exploitation.
ProfileHound introduces a new BloodHound graph edge, HasUserProfile , which maps relationships between domain users and machines hosting their profile directories. This edge identifies dormant user profiles on systems, which can be crucial during post-exploitation for locating machines with cached credentials, DPAPI-encrypted secrets, SSH keys, or cloud authentication materials.
The tool requires administrative access to the target machines’ C$ administrative share to enumerate the Users directory structure. It extracts metadata, such as user Security Identifiers (SIDs), profile creation timestamps, and last modification dates from the NTUSER.DAT file, providing insights into profile age and usage patterns.
ProfileHound integrates with BloodHound Community Edition through the OpenGraph format, allowing data import via drag-and-drop. It also generates statistical summaries to identify the most-populated machines and the highest-value users based on profile distribution.
Feature Description
HasUserProfile Edge Creates new graph edge mapping user profiles on domain machines
BloodHound Integration Compatible with BloodHound OpenGraph format for direct import
ProfileHound is a post-exploitation tool designed for security professionals to identify high-value targets in Active Directory environments.
Administrative Access Requires admin credentials to enumerate C$ share on targets
Timestamp Analysis Tracks profile creation and modification dates for activity assessment
DPAPI Integration Extracts user SIDs from DPAPI directory structures
Advanced Queries Pre-built Cypher queries for targeting active profiles and groups
Multiple Deployment Supports pipx, source installation, and Docker containers
Target Selection Automatic LDAP discovery or manual target specification
Profile Statistics Generates detailed distribution and machine hub reports
SID Extraction Retrieves security identifiers from NTUSER.DAT metadata
ProfileHound is currently in early development stages, and its deployment should be approached with caution until additional collection modes are implemented. Future enhancements include SCCMHunter integration, Azure AD device ownership correlation, and more extensive NTUSER.DAT file analysis.
For red teams focusing on cloud-adjacent SaaS applications or machines with extensive profile artifacts, ProfileHound is a valuable tool for post-exploitation workflows.
Based on reporting by GBHackers.