How nh-red-team/rusthound works
RustHound is a cross-platform Active Directory collector that produces BloodHound Legacy 4.x JSON (optionally zipped). The principal workflow is CLI configuration, LDAP collection, object parsing, relationship/default-value checks, optional enrichment modules, and output generation. The graph also preserves the documented FQDN resolver and ADCS collection capabilities. The source excerpts show the main orchestration and output logic, but not the LDAP implementation, parser dispatch internals, or resolver and ADCS internals; those components are represented at their existing module paths, with only documented or visible wiring shown.
Main entry points: main.rs Runtime orchestration · ldap.rs LDAP collection · mod.rs Result dispatch · bh_41.rs Object parsing
Components 18
Collection
- CLI options
src/args.rs - Runtime orchestration
src/main.rs - LDAP collection
src/ldap.rs
Parsing and checks
- Result dispatch
src/json/parser/mod.rs - Object parsing
src/json/parser/bh_41.rs - LDAP value decoding
src/enums/mod.rs - Relationship checks
src/json/checker/mod.rs - BloodHound checks
src/json/checker/bh_41.rs
Optional enrichment
- ADCS parsing
src/modules/adcs/parser.rs - Module dispatch
src/modules/mod.rs - FQDN resolver
src/modules/resolver/resolv.rs - ADCS enrichment
src/modules/adcs/checker.rs
BloodHound output
- JSON templates
src/json/templates/bh_41.rs - JSON and ZIP maker
src/json/maker/mod.rs
Other components
- Operator
- Active Directory
- DNS service
- JSON or ZIP files
Connections 21
- Operator → CLI options: sets options
- CLI options → Runtime orchestration: provides options
- Runtime orchestration → LDAP collection: requests collection
- LDAP collection → Active Directory: queries
- LDAP collection → Runtime orchestration: returns entries
- Runtime orchestration → Result dispatch: dispatches results
- Result dispatch → Object parsing: parses objects
- Object parsing → LDAP value decoding: decodes values
- Result dispatch → ADCS parsing: parses ADCS
- Runtime orchestration → Relationship checks: checks results
- Relationship checks → BloodHound checks: applies rules
- Runtime orchestration → Module dispatch: runs modules
- Module dispatch → FQDN resolver: resolves names
- FQDN resolver → DNS service: queries names
- Module dispatch → ADCS enrichment: checks ADCS
- ADCS enrichment → ADCS parsing: uses parsed data
- Object parsing → JSON templates: builds from
- ADCS parsing → JSON templates: builds from
- Runtime orchestration → JSON and ZIP maker: creates output
- JSON and ZIP maker → JSON templates: formats files
- JSON and ZIP maker → JSON or ZIP files: writes files