# nh-red-team/rusthound architecture

> Architecture diagram of the GitHub repository nh-red-team/rusthound, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nh-red-team/rusthound
- Repository: https://github.com/nh-red-team/rusthound

## Overview

RustHound is a cross-platform Active Directory collector that produces BloodHound Legacy 4.x JSON (optionally zipped). The principal workflow is CLI configuration, LDAP collection, object parsing, relationship/default-value checks, optional enrichment modules, and output generation. The graph also preserves the documented FQDN resolver and ADCS collection capabilities. The source excerpts show the main orchestration and output logic, but not the LDAP implementation, parser dispatch internals, or resolver and ADCS internals; those components are represented at their existing module paths, with only documented or visible wiring shown.

Main entry points: [`src/main.rs`](https://github.com/nh-red-team/rusthound/blob/main/src/main.rs) (Runtime orchestration), [`src/ldap.rs`](https://github.com/nh-red-team/rusthound/blob/main/src/ldap.rs) (LDAP collection), [`src/json/parser/mod.rs`](https://github.com/nh-red-team/rusthound/blob/main/src/json/parser/mod.rs) (Result dispatch), [`src/json/parser/bh_41.rs`](https://github.com/nh-red-team/rusthound/blob/main/src/json/parser/bh_41.rs) (Object parsing)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_collection["Collection"]
  node_cli["CLI options<br/>[args.rs]"]
  node_orchestrator["Runtime orchestration<br/>[main.rs]"]
  node_ldap["LDAP collection<br/>[ldap.rs]"]
end

subgraph group_processing["Parsing and checks"]
  node_parser_dispatch["Result dispatch<br/>[mod.rs]"]
  node_object_parser["Object parsing<br/>[bh_41.rs]"]
  node_enums["LDAP value decoding<br/>[mod.rs]"]
  node_checker["Relationship checks<br/>[mod.rs]"]
  node_checker_rules["BloodHound checks<br/>[bh_41.rs]"]
end

subgraph group_enrichment["Optional enrichment"]
  node_adcs_parser["ADCS parsing<br/>[parser.rs]"]
  node_module_runner["Module dispatch<br/>[mod.rs]"]
  node_resolver["FQDN resolver<br/>[resolv.rs]"]
  node_adcs_checker["ADCS enrichment<br/>[checker.rs]"]
end

subgraph group_output["BloodHound output"]
  node_templates["JSON templates<br/>[bh_41.rs]"]
  node_maker["JSON and ZIP maker<br/>[mod.rs]"]
end

node_operator(("Operator"))
node_directory[("Active Directory")]
node_dns["DNS service"]
node_artifacts["JSON or ZIP files"]

node_operator -->|"sets options"| node_cli
node_cli -->|"provides options"| node_orchestrator
node_orchestrator -->|"requests collection"| node_ldap
node_ldap -->|"queries"| node_directory
node_ldap -->|"returns entries"| node_orchestrator
node_orchestrator -->|"dispatches results"| node_parser_dispatch
node_parser_dispatch -->|"parses objects"| node_object_parser
node_object_parser -->|"decodes values"| node_enums
node_parser_dispatch -.->|"parses ADCS"| node_adcs_parser
node_orchestrator -->|"checks results"| node_checker
node_checker -->|"applies rules"| node_checker_rules
node_orchestrator -->|"runs modules"| node_module_runner
node_module_runner -.->|"resolves names"| node_resolver
node_resolver -.->|"queries names"| node_dns
node_module_runner -.->|"checks ADCS"| node_adcs_checker
node_adcs_checker -.->|"uses parsed data"| node_adcs_parser
node_object_parser -->|"builds from"| node_templates
node_adcs_parser -.->|"builds from"| node_templates
node_orchestrator -->|"creates output"| node_maker
node_maker -->|"formats files"| node_templates
node_maker -->|"writes files"| node_artifacts

click node_cli "https://github.com/nh-red-team/rusthound/blob/main/src/args.rs"
click node_orchestrator "https://github.com/nh-red-team/rusthound/blob/main/src/main.rs"
click node_ldap "https://github.com/nh-red-team/rusthound/blob/main/src/ldap.rs"
click node_parser_dispatch "https://github.com/nh-red-team/rusthound/blob/main/src/json/parser/mod.rs"
click node_object_parser "https://github.com/nh-red-team/rusthound/blob/main/src/json/parser/bh_41.rs"
click node_adcs_parser "https://github.com/nh-red-team/rusthound/blob/main/src/modules/adcs/parser.rs"
click node_enums "https://github.com/nh-red-team/rusthound/blob/main/src/enums/mod.rs"
click node_checker "https://github.com/nh-red-team/rusthound/blob/main/src/json/checker/mod.rs"
click node_checker_rules "https://github.com/nh-red-team/rusthound/blob/main/src/json/checker/bh_41.rs"
click node_module_runner "https://github.com/nh-red-team/rusthound/blob/main/src/modules/mod.rs"
click node_resolver "https://github.com/nh-red-team/rusthound/blob/main/src/modules/resolver/resolv.rs"
click node_adcs_checker "https://github.com/nh-red-team/rusthound/blob/main/src/modules/adcs/checker.rs"
click node_templates "https://github.com/nh-red-team/rusthound/blob/main/src/json/templates/bh_41.rs"
click node_maker "https://github.com/nh-red-team/rusthound/blob/main/src/json/maker/mod.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_orchestrator,node_ldap toneBlue
class node_parser_dispatch,node_object_parser,node_enums,node_checker,node_checker_rules,node_directory toneAmber
class node_adcs_parser,node_module_runner,node_resolver,node_adcs_checker toneMint
class node_templates,node_maker toneRose
class node_operator,node_dns,node_artifacts toneIndigo
```

## Components

### Collection

- [CLI options](https://github.com/nh-red-team/rusthound/blob/main/src/args.rs): `src/args.rs`
- [Runtime orchestration](https://github.com/nh-red-team/rusthound/blob/main/src/main.rs): `src/main.rs`
- [LDAP collection](https://github.com/nh-red-team/rusthound/blob/main/src/ldap.rs): `src/ldap.rs`

### Parsing and checks

- [Result dispatch](https://github.com/nh-red-team/rusthound/blob/main/src/json/parser/mod.rs): `src/json/parser/mod.rs`
- [Object parsing](https://github.com/nh-red-team/rusthound/blob/main/src/json/parser/bh_41.rs): `src/json/parser/bh_41.rs`
- [LDAP value decoding](https://github.com/nh-red-team/rusthound/blob/main/src/enums/mod.rs): `src/enums/mod.rs`
- [Relationship checks](https://github.com/nh-red-team/rusthound/blob/main/src/json/checker/mod.rs): `src/json/checker/mod.rs`
- [BloodHound checks](https://github.com/nh-red-team/rusthound/blob/main/src/json/checker/bh_41.rs): `src/json/checker/bh_41.rs`

### Optional enrichment

- [ADCS parsing](https://github.com/nh-red-team/rusthound/blob/main/src/modules/adcs/parser.rs): `src/modules/adcs/parser.rs`
- [Module dispatch](https://github.com/nh-red-team/rusthound/blob/main/src/modules/mod.rs): `src/modules/mod.rs`
- [FQDN resolver](https://github.com/nh-red-team/rusthound/blob/main/src/modules/resolver/resolv.rs): `src/modules/resolver/resolv.rs`
- [ADCS enrichment](https://github.com/nh-red-team/rusthound/blob/main/src/modules/adcs/checker.rs): `src/modules/adcs/checker.rs`

### BloodHound output

- [JSON templates](https://github.com/nh-red-team/rusthound/blob/main/src/json/templates/bh_41.rs): `src/json/templates/bh_41.rs`
- [JSON and ZIP maker](https://github.com/nh-red-team/rusthound/blob/main/src/json/maker/mod.rs): `src/json/maker/mod.rs`

### Other components

- **Operator**
- **Active Directory**
- **DNS service**
- **JSON or ZIP files**

## Connections

- Operator → CLI options: sets options
- CLI options → Runtime orchestration: provides options
- Runtime orchestration → LDAP collection: requests collection
- LDAP collection → Active Directory: queries
- LDAP collection → Runtime orchestration: returns entries
- Runtime orchestration → Result dispatch: dispatches results
- Result dispatch → Object parsing: parses objects
- Object parsing → LDAP value decoding: decodes values
- Result dispatch → ADCS parsing: parses ADCS
- Runtime orchestration → Relationship checks: checks results
- Relationship checks → BloodHound checks: applies rules
- Runtime orchestration → Module dispatch: runs modules
- Module dispatch → FQDN resolver: resolves names
- FQDN resolver → DNS service: queries names
- Module dispatch → ADCS enrichment: checks ADCS
- ADCS enrichment → ADCS parsing: uses parsed data
- Object parsing → JSON templates: builds from
- ADCS parsing → JSON templates: builds from
- Runtime orchestration → JSON and ZIP maker: creates output
- JSON and ZIP maker → JSON templates: formats files
- JSON and ZIP maker → JSON or ZIP files: writes files