Tombstone Reanimation: A BloodHound Attack Path Overview
Explore tombstone reanimation as a BloodHound attack path. Learn how to enumerate deleted objects and who can restore them.
Active Directory collectors, including SharpHound, do not account for CN=Deleted Objects, leaving tombstoned accounts invisible. These accounts, which may have belonged to Tier Zero groups before deletion, remain recoverable for months in a Recycle Bin domain. I developed a tool that enumerates these tombstones via LDAP, identifies who can reanimate them, and outputs BloodHound OpenGraph data for visibility in your graph.