I'm exploring the Bloodhound Active Directory reconnaissance tool. There are few labels in this tool such as "AdminTo, MemberOf, HasSession" the first two is obvious to me. However, I didn't get the concept of "HasSession". Does it mean a user has RDP connection on that machine or executed something on that machine with psexec or totally something else?


This corresponds to the "User-Hunter" Powerview script that finds admins who are authenticated to resources. Yes, I have confirmed that only RDP sessions are logged, and not PSExec or any other sessions, which is unfortunate, because those sessions are often just as valuable.

However, you can find SMB sessions using the PSLoggedon.exe Sysinternals tool. The Nmap script "smb-enum-sessions.nse" uses the same method and may also work.

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.