SharpHound (C# collector)

SharpHound.exe --CollectionMethods All --Domain <domain> --OutputDirectory C:\Users\Public

Native C# Active Directory collector for BloodHound, executable on Windows machines.

When you already have a foothold on a domain Windows machine and want to collect AD data quickly and comprehensively. SharpHound is more efficient than the Python version because it uses native Windows APIs, but it is much noisier. It is the standard tool on Windows machines.

If the system has EDR (CrowdStrike, SentinelOne) that monitors SharpHound execution, it can detect and kill the process. Also if you do not have local admin privileges (some collections require privileges).