BloodHound

Local Administrator privileges are required to run BloodHound on a compromised host (Windows)

Running BloodHound with the all collection method is extremely noisy because it goes to every endpoint to collect information.

Invoke-BloodHound -CollectionMethod All

SharpHound.exe

OPSEC Friendly

Invoke-BloodHound –Steatlh

SharpHound.exe –-steatlh

Avoid detections like MDI

Invoke-BloodHound -ExcludeDCs