Security & Threat Intelligence · 25.07.2026, 15:29 UTC
MSSQLHound Now Available in Go
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR: Javier Azofra and I vibe-ported MSSQLHound to Go to drastically improve run duration, enable cross-platform execution, support SOCKS proxying for stealth and NT hashes/Kerberos tickets for authentication, enhance logging, detect the latest encryption and extended protection for authentication (EPA) settings, and enable pathfinding in BloodHound.
MSSQLHound adds 7 new nodes and 37 new MSSQL attack path edges to BloodHound, an open-source tool with Maps-style navigation and an interactive graph that helps users visualize and remediate attack paths in various technologies.
For an introduction to what MSSQLHound is all about, please check out this blog post: https://specterops.io/blog/2025/08/04/adding-mssql-to-bloodhound-with-opengraph/
A few months ago, Javier Azofra from Siemens Healthineers reached out to me and told me he’d been porting BloodHound OpenGraph collectors to Go to optimize them for enterprise use, focusing on scalability and speed. He made a massive PR to MSSQLHound with a Go port and I got to work validating it and helping bring it to feature parity. I was so impressed with the improvements that I’ve decided to focus on developing the Go version of MSSQLHound moving forward.
The initial PowerShell version of MSSQLHound was a decent proof-of-concept, but didn’t work well for many use cases for one reason or another.
For red teamers, any EDR worth using detects and blocks PowerShell tradecraft, including MSSQLHound, and proxying traffic from PowerShell tools into an environment via SOCKS is a real pain, especially if you operate from a Linux …