Project Obsidian: Cyber Threat Hunting - Sniffing Out BloodHound in Active Directory
Project Obsidian demonstrates detecting SharpHound and BloodHound reconnaissance by hunting anomalous LDAP queries and Active Directory enumeration patterns.
Summary
In this threat hunting workshop from Project Obsidian at the DEF CON 30 Blue Team Village, instructors demonstrate how defensive analysts can detect BloodHound and SharpHound reconnaissance activity inside enterprise Active Directory environments. Entering the Splunk hunting lab at 07:00, the session examines event log sources necessary to spot internal domain enumeration.
At 14:00, the instructor investigates host-level telemetry, specifically querying Sysmon Event ID 11 (File Create) to identify telltale SharpHound output files and JSON archive creation artifacts. The workshop shifts to building high-fidelity detection logic at 21:00, writing Splunk search queries that trigger automated SOC alerts whenever suspicious Active Directory data dumping occurs.
Turning to network-based anomalies at 28:00, the presenter identifies unusual spikes in SMB traffic (port 445) and rapid LDAP session queries originating from administrative jump boxes and RDP hosts. The session concludes at 35:00 by showing how to compile forensic findings into a comprehensive threat hunting report, establishing actionable indicators of compromise (IOCs) to thwart adversary privilege escalation paths. (AI summary — Gemini Flash)
Related talks
Main Stage·47 min
Daniel Bohannon · Sabajete Elezaj
Deep exploration into LDAP query obfuscation techniques and detection strategies across Active Directory environments.
Blue Team Village·17 min
Saurabh Chaudhary
Saurabh Chaudhary demonstrates crafting high-performance, modular YARA rules to detect complex malware variants and streamline threat hunting.
Blue Team Village·29 min
Anton Ovrutsky
Anton Ovrutsky demonstrates behavioral detection patterns, static parsing tools, and deobfuscation methods to hunt malicious Office VBA macros.