What is ghosthound?

GhostHound is a security tool built for people who audit Active Directory, the system many companies use to manage user accounts and permissions across their network. It plugs into BloodHound, a well known tool that maps out who can access what inside a company's network, and adds something BloodHound normally misses: deleted accounts. When an account in Active Directory gets deleted, it does not vanish right away. It becomes a tombstone, a kind of ghost record that can sometimes be restored, along with whatever access it used to have. Most security tools skip over these tombstones entirely, which means a real risk goes unnoticed: if someone can bring a deleted account back to life, they may also inherit its old permissions, including admin level access. GhostHound finds these tombstones, works out who is allowed to restore them, and shows the result as a clear map that plugs directly into BloodHound so a security analyst can see the full attack path. This is explicitly an offensive security tool for authorized penetration testers and researchers running detection labs. It requires administrator level access to the target domain to even see the deleted objects, since Active Directory hides them from regular accounts by design. Under the hood it is organized as a set of Rust libraries: one builds the BloodHound compatible output, one parses low level Windows security permissions from scratch to avoid a licensing conflict with an existing tool, and one handles the actual scanning of deleted objects over the network. The project documents its own design choices in a dedicated folder, including why it chose Rust and how it approached licensing. It connects securely by default and includes fallback options for lab environments with self signed certificates, alongside safety limits so the tool fails quickly instead of hanging when a server is unreachable.