MSSQLHound

A collector for adding MSSQL attack paths to BloodHound with OpenGraph by Chris Thompson at SpecterOps. Available as both a PowerShell script and a cross-platform Go binary (with concurrent collection, SOCKS5 proxy support, and streaming output).

Introductory blog posts: - https://specterops.io/blog/2025/08/04/adding-mssql-to-bloodhound-with-opengraph/ - https://specterops.io/blog/2026/01/20/updates-to-the-mssqlhound-opengraph-collector-for-bloodhound/ - https://specterops.io/blog/2026/04/23/mssqlhound-now-available-in-go/

Please hit me up on the BloodHound Slack (@Mayyhem), Twitter (@_Mayyhem), or open an issue if you have any questions I can help with!

Quick Start

# 1) Download the source
git clone https://github.com/SpecterOps/MSSQLHound.git
cd MSSQLHound

# 2) Build the binary (Go 1.25+)
go build -o mssqlhound ./cmd/mssqlhound

On Windows, use .\mssqlhound.exe instead of ./mssqlhound.

Run MSSQLHound with a few common collection patterns:

# Use Windows integrated authentication to query Active Directory for MSSQLSvc SPNs and collect from all discovered MSSQL server instances, ten at a time
./mssqlhound -w 10

# Collect from a specific MSSQL server instance using SQL login credentials
./mssqlhound -t sql.contoso.com -u sa -p password

# Collect through a SOCKS proxy using specified domain controller IP for DNS and LDAP resolution and collect from all discovered MSSQL server instances, 20 at a time
./mssqlhound -u "CONTOSO\sqlaudit" -p "password" -d contoso.com --dc 10.2.10.100 -w 20 --verbose --proxy 127.0.0.1:9050

# Collect from all domain computers using Windows MSSQL login credentials, 25 at a time, then upload schema and results to BloodHound
./mssqlhound -u "CONTOSO\sqlaudit" -p "password" -d contoso.com -w 25 --scan-all-computers -B '<token-id>:<token-key>@https://contoso.bloodhoundenterprise.io'

Table of Contents

• Quick Start
• Overview
• System Requirements
• Minimum Permissions
• Recommended Permissions
• OPSEC
• Network Connections
• Authentication Events
• Subprocesses Executed
• SQL Queries Executed on Targets
• Files Created
• Go Version
• Why a Go Port?
• Building
• Go Usage
  • Basic Usage
  • Multiple Servers
  • Full Domain Enumeration
  • DNS and Domain Controller Configuration
  • SOCKS5 Proxy Support
  • Credential Fallback
  • Kerberos Authentication
  • Pass-the-Hash
  • Domain Enum Only (Reconnaissance)
  • Collection
  • Output and Storage Options
  • BloodHound Upload
  • Possible Edge Options
  • Linked Server Options
  • test-epa-matrix Subcommand
  • Shell Completion
• Go Command Line Options
• Key Differences from PowerShell Version
• CVE Detection
• Known Limitations and Issues (Go)
• Troubleshooting (Go)
• PowerShell Usage
• PowerShell Command Line Options
• Limitations
• Future Development
• Credits
• MSSQL Graph Model
• MSSQL Nodes Reference
• Server Level
  • MSSQL_Server
  • MSSQL_Login
  • MSSQL_ServerRole
• Database Level
  • MSSQL_Database
  • MSSQL_DatabaseUser
  • MSSQL_DatabaseRole
  • MSSQL_ApplicationRole
• MSSQL Edges Reference
• Edge Classes and Properties
  • MSSQL_CoerceAndRelayToMSSQL
  • MSSQL_AddMember
  • MSSQL_Alter
  • MSSQL_AlterAnyAppRole
  • MSSQL_AlterAnyDBRole
  • MSSQL_AlterAnyLogin
  • MSSQL_AlterAnyServerRole
  • MSSQL_ChangeOwner
  • MSSQL_ChangePassword
  • MSSQL_Connect
  • MSSQL_ConnectAnyDatabase
  • MSSQL_Contains
  • MSSQL_Control
  • MSSQL_ControlDB
  • MSSQL_ControlServer
  • MSSQL_ExecuteAs
  • MSSQL_ExecuteAsOwner
  • MSSQL_ExecuteOnHost
  • MSSQL_GetAdminTGS
  • MSSQL_GetTGS
  • MSSQL_GrantAnyDBPermission
  • MSSQL_GrantAnyPermission
  • MSSQL_HasDBScopedCred
  • MSSQL_HasLogin
  • MSSQL_HasMappedCred
  • MSSQL_HasProxyCred
  • MSSQL_HostFor
  • MSSQL_Impersonate
  • MSSQL_ImpersonateAnyLogin
  • MSSQL_IsMappedTo
  • MSSQL_IsTrustedBy
  • MSSQL_LinkedAsAdmin
  • MSSQL_LinkedTo
  • MSSQL_MemberOf
  • MSSQL_Owns
  • MSSQL_ServiceAccountFor
  • MSSQL_TakeOwnership

Overview

Collects BloodHound OpenGraph compatible data from one or more MSSQL servers into individual temporary files, then zips them in the current directory - Example: mssql-bloodhound-20250724-115610.zip

System Requirements:

• PowerShell 4.0 or higher
• Target is running SQL Server 2005 or higher
• BloodHound v8.0.0+ with Postgres backend (to use prebuilt Cypher queries): https://bloodhound.specterops.io/get-started/custom-installation#postgresql
• BloodHound v9.0.0+ with OpenGraph Extension Management enabled to use pathfinding
• For Kerberos authentication (-k): krb5-user package on Linux (sudo apt install krb5-user)

Minimum Permissions:

Windows Level:

• Active Directory domain context with line of sight to a domain controller

MSSQL Server Level:

• CONNECT SQL (default for new logins)
• VIEW ANY DATABASE (default for new logins)

Recommended Permissions:

MSSQL Server Level:

• VIEW ANY DEFINITION permission or ##MS_DefinitionReader## role membership (available in versions 2022+)
  • Needed to read server principals and their permissions
  • Without one of these permissions, there will be false negatives (invisible server principals)
• VIEW SERVER PERFORMANCE STATE permission or ##MSS_ServerPerformanceStateReader## role membership (available in versions 2022+) or local Administrators group privileges on the target (fallback for WMI collection)
  • Only used for service account collection

MSSQL Database Level:

• CONNECT ANY DATABASE server permission (available in versions 2014+) or ##MS_DatabaseConnector## role membership (available in versions 2022+) or login maps to a database user with CONNECT on individual databases
  • Needed to read database principals and their permissions
• Login maps to msdb database user with db_datareader role or with SELECT permission on:
  • msdb.dbo.sysproxies
  • msdb.dbo.sysproxylogin
  • msdb.dbo.sysproxysubsystem
  • msdb.dbo.syssubsystems
  • Only used for proxy account collection

OPSEC

This section documents every network connection, authentication event, subprocess, query, and file artifact produced by MSSQLHound so operators can make informed decisions about detection risk.

Network Connections

All TCP connections support SOCKS5 proxy tunneling (--proxy). TLS connections use InsecureSkipVerify=true and cap at TLS 1.2.

TDS Encryption Modes

LDAP Queries Issued

All LDAP searches use subtree scope with 1000-result paging.

Authentication Events

Each authentication below generates log entries on the target system.

Subprocesses Executed

MSSQLHound does not spawn local powershell.exe processes as collection fallbacks. The only PowerShell command constructed by the Go binary is sent through WinRM for the EPA matrix workflow.

SQL Queries Executed on Targets

All queries are read-only. No data is written to any target server.

Server Metadata