Download
BadBlood is a PowerShell toolkit that programmatically populates a Microsoft Active Directory domain with a realistic, large-scale structure of OUs, users, groups, computers, and permissions so defenders and testers can practice discovery, hardening, and incident response on a lifelike environment. It intentionally randomizes its output on every run so the created domain, objects, and ACL relationships are different each time, which helps teams exercise tooling and detection logic against varied scenarios. The project is driven by a single entry script (Invoke-BadBlood.ps1) and a collection of modular components that create OUs, seed users and groups, set ACLs, configure LAPS scenarios, and generate other attack/defense artifacts for lab use. Because it modifies a real AD forest, BadBlood requires high privileges (Domain Admin and Schema Admin) to run and the README warns strongly that it is not responsible for cleanup if used in production.
Features
- Randomized, repeatable domain generator with configurable scale and seeding options
- BloodHound export / sample data generation to visualize attack paths and privilege chains
- Cleanup and rollback helper to remove generated objects safely from a test domain
- Scenario templates (Kerberoastable service accounts, exposed ACLs, LAPS misconfigurations) for focused exercises
- Automated report of IAM findings and recommended hardening actions after each run
- Integration hooks for lab automation (Vagrant/Ansible/VM orchestration) to provision ephemeral AD environments
Project Samples
