BloodBash 1.5.0 (build 97)

SquidSec BloodBash 1.5.0 - build 97

BloodBash is an open source project created and managed by SquidSec.

Standalone binaries (no Python install required).

Platform	File
Linux x64	bloodbash-linux-x64
Windows x64	bloodbash-windows-x64.exe

Commit: a95feff
Latest downloads (always current):

• Linux: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-linux-x64
• Windows: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-windows-x64.exe

# Linux
chmod +x bloodbash-linux-x64
./bloodbash-linux-x64 /path/to/sharphound --all

# Windows
.\bloodbash-windows-x64.exe C:\path\to\sharphound --all

---

SquidSec · BloodBash on GitHub

What's Changed

• ci: make the release job survive transient API failures by @DotNetRussell in #126

Full Changelog: v1.5.0-build.92...v1.5.0-build.97

BloodBash 1.5.0 (build 92)

SquidSec BloodBash 1.5.0 - build 92

BloodBash is an open source project created and managed by SquidSec.

Standalone binaries (no Python install required).

Platform	File
Linux x64	bloodbash-linux-x64
Windows x64	bloodbash-windows-x64.exe

Commit: 48854df
Latest downloads (always current):

• Linux: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-linux-x64
• Windows: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-windows-x64.exe

# Linux
chmod +x bloodbash-linux-x64
./bloodbash-linux-x64 /path/to/sharphound --all

# Windows
.\bloodbash-windows-x64.exe C:\path\to\sharphound --all

---

SquidSec · BloodBash on GitHub

Full Changelog: v1.5.0-build.91...v1.5.0-build.92

BloodBash 1.5.0 (build 91)

SquidSec BloodBash 1.5.0 - build 91

BloodBash is an open source project created and managed by SquidSec.

Standalone binaries (no Python install required).

Platform	File
Linux x64	bloodbash-linux-x64
Windows x64	bloodbash-windows-x64.exe

Commit: 5895e77
Latest downloads (always current):

• Linux: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-linux-x64
• Windows: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-windows-x64.exe

# Linux
chmod +x bloodbash-linux-x64
./bloodbash-linux-x64 /path/to/sharphound --all

# Windows
.\bloodbash-windows-x64.exe C:\path\to\sharphound --all

---

SquidSec · BloodBash on GitHub

Full Changelog: v1.5.0-build.89...v1.5.0-build.91

BloodBash 1.5.0 (build 89)

BloodBash 1.5.0

BloodBash is SquidSec's open source offline SharpHound and AzureHound analyzer. It builds the AD and Entra graph, surfaces attack paths and misconfigurations, and prints prioritized findings. No Neo4j or BloodHound UI required.

Project: https://github.com/SquidSec/BloodBash · Org: https://squidoffense.com/

Highlights

MITRE ATT&CK on every finding. Every finding category carries a technique ID, shown in the console findings table and carried through SARIF, Markdown tickets, and JSON.

SARIF 2.1.0 export. --export sarif writes results with ATT&CK taxa for GitHub code scanning and DefectDojo.

CI gate. --fail-on-severity N exits 2 when any finding meets the threshold. Suppressed and baseline-matched findings do not count.

Baselines and suppressions. --baseline REPORT.json diffs against a previous report and reports new vs resolved. --suppress FILE takes YAML entries with an optional expiry date.

Explain and tickets. --explain CATEGORY|N shows why a finding fired, with contributing rows and graph edges. --tickets DIR writes one Markdown ticket per high finding.

More coverage. ESC10, ESC11, and ESC12 when CA registry properties are present. GPO XML parsing now reads scheduled-task triggers and local group membership changes. --azure-entra-posture adds standing privileged assignments, broad consent scopes, and unmanaged devices.

New outputs and workflows. --graphml for Gephi and yEd. --snapshot and --trend for findings history. --plugins-dir for run(G, add_finding) detectors. --watch re-runs when collector files change.

Fixes

• AD objects with "azure" or "microsoft.com" in a name or description were misclassified as Entra users and skipped by AD checks.
• Duplicate object IDs inside one collection could drop relationships from an earlier file.
• Collector output in subfolders loaded zero objects.
• Password-age and stale-account inventories reported disabled accounts as enabled.
• Numeric msPKI-Enrollment-Flag was ignored, producing false ESC1 findings on templates requiring manager approval.
• Malformed Rich markup in object data could abort a run.
• CSV exports allowed spreadsheet formula injection; DOT exports produced invalid files for names with quotes.
• GPO name resolution and scheduled-task trigger display were incorrect.
• Unknown --domain values now warn and exit 3 instead of looking like a clean result.

Upgrade notes

No breaking CLI changes. --export json gains findings_raw, which holds the pre-collapse rows the console already pointed to.

Version metadata (__version__, pyproject.toml, README) is now unified at 1.5.0, and a test fails if they drift.

Downloads

Platform	File
Linux x64	bloodbash-linux-x64
Windows x64	bloodbash-windows-x64.exe

No Python install required.

• Linux: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-linux-x64
• Windows: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-windows-x64.exe

# Linux
chmod +x bloodbash-linux-x64
./bloodbash-linux-x64 /path/to/sharphound --all

# Windows
.\bloodbash-windows-x64.exe C:\path\to\sharphound --all

Verification

• 533 tests across Python 3.9, 3.11, and 3.13
• 20-scenario engagement battery
• Released Linux binary smoke-tested: version banner, SARIF export, severity gate, domain-filter exit code

Full changelog: v1.4.2-build.88...v1.5.0-build.89

---

SquidSec · BloodBash on GitHub

BloodBash 1.4.2 (build 88)

SquidSec BloodBash 1.4.2 - build 88

BloodBash is an open source project created and managed by SquidSec.

Standalone binaries (no Python install required).

Platform	File
Linux x64	bloodbash-linux-x64
Windows x64	bloodbash-windows-x64.exe

Commit: 1e1220c
Latest downloads (always current):

• Linux: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-linux-x64
• Windows: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-windows-x64.exe

# Linux
chmod +x bloodbash-linux-x64
./bloodbash-linux-x64 /path/to/sharphound --all

# Windows
.\bloodbash-windows-x64.exe C:\path\to\sharphound --all

---

SquidSec · BloodBash on GitHub

What's Changed

• Ingest hardening, detector fixes, and CI reporting features by @DotNetRussell in #124

Full Changelog: v1.4.2-build.85...v1.4.2-build.88

BloodBash 1.4.2 (build 85)

SquidSec BloodBash 1.4.2 - build 85

BloodBash is an open source project created and managed by SquidSec.

Standalone binaries (no Python install required).

Platform	File
Linux x64	bloodbash-linux-x64
Windows x64	bloodbash-windows-x64.exe

Commit: dba63c8
Latest downloads (always current):

• Linux: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-linux-x64
• Windows: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-windows-x64.exe

# Linux
chmod +x bloodbash-linux-x64
./bloodbash-linux-x64 /path/to/sharphound --all

# Windows
.\bloodbash-windows-x64.exe C:\path\to\sharphound --all

---

SquidSec · BloodBash on GitHub

What's Changed

• security: stop tracking the DC34 WireGuard config by @DotNetRussell in #123

Full Changelog: v1.4.2-build.84...v1.4.2-build.85

BloodBash 1.4.2 (build 84)

SquidSec BloodBash 1.4.2 - build 84

BloodBash is an open source project created and managed by SquidSec.

Standalone binaries (no Python install required).

Platform	File
Linux x64	bloodbash-linux-x64
Windows x64	bloodbash-windows-x64.exe

Commit: 87e1459
Latest downloads (always current):

• Linux: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-linux-x64
• Windows: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-windows-x64.exe

# Linux
chmod +x bloodbash-linux-x64
./bloodbash-linux-x64 /path/to/sharphound --all

# Windows
.\bloodbash-windows-x64.exe C:\path\to\sharphound --all

---

SquidSec · BloodBash on GitHub

What's Changed

• fix: let --domain match a netbios prefix by @DotNetRussell in #120
• fix: link SID-only principals to named objects by @DotNetRussell in #121
• fix: stamp collection source on the compromise dossier by @DotNetRussell in #122

Full Changelog: v1.4.2-build.81...v1.4.2-build.84

BloodBash 1.4.2 (build 81)

SquidSec BloodBash 1.4.2 - build 81

BloodBash is an open source project created and managed by SquidSec.

Standalone binaries (no Python install required).

Platform	File
Linux x64	bloodbash-linux-x64
Windows x64	bloodbash-windows-x64.exe

Commit: 6881690
Latest downloads (always current):

• Linux: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-linux-x64
• Windows: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-windows-x64.exe

# Linux
chmod +x bloodbash-linux-x64
./bloodbash-linux-x64 /path/to/sharphound --all

# Windows
.\bloodbash-windows-x64.exe C:\path\to\sharphound --all

---

SquidSec · BloodBash on GitHub

What's Changed

• fix: keep writable targets in the named domain by @DotNetRussell in #119

Full Changelog: v1.4.2-build.80...v1.4.2-build.81

BloodBash 1.4.2 (build 80)

SquidSec BloodBash 1.4.2 - build 80

BloodBash is an open source project created and managed by SquidSec.

Standalone binaries (no Python install required).

Platform	File
Linux x64	bloodbash-linux-x64
Windows x64	bloodbash-windows-x64.exe

Commit: 1418c7e
Latest downloads (always current):

• Linux: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-linux-x64
• Windows: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-windows-x64.exe

# Linux
chmod +x bloodbash-linux-x64
./bloodbash-linux-x64 /path/to/sharphound --all

# Windows
.\bloodbash-windows-x64.exe C:\path\to\sharphound --all

---

SquidSec · BloodBash on GitHub

What's Changed

• fix: resolve principals by domain instead of guessing the SAM by @DotNetRussell in #118

Full Changelog: v1.4.2-build.79...v1.4.2-build.80

BloodBash 1.4.2 (build 79)

SquidSec BloodBash 1.4.2 - build 79

BloodBash is an open source project created and managed by SquidSec.

Standalone binaries (no Python install required).

Platform	File
Linux x64	bloodbash-linux-x64
Windows x64	bloodbash-windows-x64.exe

Commit: a465568
Latest downloads (always current):

• Linux: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-linux-x64
• Windows: https://github.com/SquidSec/BloodBash/releases/latest/download/bloodbash-windows-x64.exe

# Linux
chmod +x bloodbash-linux-x64
./bloodbash-linux-x64 /path/to/sharphound --all

# Windows
.\bloodbash-windows-x64.exe C:\path\to\sharphound --all

---

SquidSec · BloodBash on GitHub

What's Changed

• fix: zip extract cleanup flake on shared runners by @DotNetRussell in #117

Full Changelog: v1.4.2-build.78...v1.4.2-build.79