Where BloodHound's shortest path isn't the shortest path.

BloodHound is the best open-source attack-path mapper in the world, and it belongs in every Active Directory review. But it is worth being precise about what its default collector and path-finder actually graph, because the shortest path the UI draws is not always the shortest path that exists. Several well-understood escalation routes fall outside the default edge set, so they never appear as a path at all, however you sort by hops.

This is an analysis of three of those blind spots, where the default behavior can miss a genuine route to Tier-0, and the Cypher queries that surface each one directly against a SharpHound collection.

1. Blind spot 01, cross-forest trust edges that aren't fully graphed

BloodHound's default collector enumerates trusts, but it does not always graph the transitive escalation that a two-way trust enables. A route that walks from forest A → trust → forest B and then abuses an ADCS ESC1 template in forest B can be entirely real while the UI renders the target as unreachable, because the intermediate trust hop was never expressed as a traversable edge. When the escalation depends on chaining a trust relationship into a per-forest abuse primitive, the default path-finder can leave it invisible.

A query to surface transitive trust reachability: MATCH (u:User)-[:TrustedBy*1..3]->(d:Domain) RETURN ...

2. Blind spot 02, GMSA password reads weighted inconsistently

Group Managed Service Accounts can be read by any principal listed in the PrincipalsAllowedToRetrieveManagedPassword attribute. BloodHound does graph this relationship, but the default Cypher path-finder can weight it inconsistently against other edge types, so a chain of successive GMSA reads may not be surfaced as the shortest path even when it is the most direct route to a high-value account. The individual edges are present; the ranking is what hides the chain.

3. Blind spot 03, write-owner via certificate template enrollment

If a principal can enroll in a certificate template that has the SAN-from-supplied flag, they can effectively impersonate any account in scope, functionally equivalent to write-owner over those principals. BloodHound 5.x added a partial edge for this ADCS abuse, but it does not chain the enrollment right through the certificate template's ACL graph, so the full escalation path from an enrollable low-privilege principal to a Tier-0 account is not drawn end to end by default.

4. Surfacing them in practice

Each of these blind spots can be surfaced with a targeted Cypher query run against the existing SharpHound collection, no new collector required. Treating the three patterns above as first-class paths, rather than trusting the default path-finder's ranking alone, gives a more complete picture of the routes to Tier-0 that an environment actually exposes.