# Collector (no BloodHound GUI needed just to gather data)pipx install bloodhound# GUI + graph database, for viewing the collected datasudo apt install bloodhound
Collect AD data remotely, without needing to run anything on a domain-joined host.
SharpHound.exe -c All
Collect AD data from a session on a domain-joined Windows host.
. .\SharpHound.ps1; Invoke-BloodHound -CollectionMethod All
Same collection, run from a PowerShell one-liner/import.
Tips & Tricks
Re-run collection after every new credential gained during an engagement — the same environment can look like a dead end from one account and show a direct path to Domain Admin from another, purely based on that principal’s own group memberships and ACEs.
Common edges worth specifically searching for: GenericAll/GenericWrite/WriteDacl/WriteOwner on a user, group, computer, or GPO; ForceChangePassword; AddMember; GetChanges+GetChangesAll on the domain object (DCSync rights); and AdminTo edges pointing at unexpected computers.
The Cypher query search bar can answer questions the pre-built queries don’t cover, e.g. finding every principal with DCSync rights: MATCH (n)-[:MemberOf|GetChanges|GetChangesAll*1..]->(d:Domain) RETURN n.