specterops/scomhound

SCOMHound is a security tool that helps red team operators and penetration testers map out SCOM (System Center Operations Manager) infrastructure within an organization's network. It extends BloodHound, a popular tool for visualizing attack paths in Active Directory environments, by adding visibility into SCOM-specific relationships that attackers could exploit. SCOM is Microsoft's monitoring platform used to track the health and performance of servers and applications across an enterprise. From an attacker's perspective, it's a valuable target because SCOM administrators can execute code on monitored systems, deploy agents, and access credentials. This tool queries Active Directory for SCOM-related objects and feeds that data into BloodHound's graph, creating visual maps showing who administers what, which servers manage which groups, and which client systems are being monitored. The tool maps out several node types: management groups (the central administrative unit), management servers, SCOM administrators, monitored clients, and SDK service accounts. It then draws relationships between them, showing administrative control, group membership, and monitoring connections. The key attack path it reveals is straightforward: if you compromise a SCOM administrator, you gain the ability to run code on every system that management group monitors. The included Cypher queries let users quickly find all admins, trace paths from admin accounts down to monitored clients, or view the entire SCOM infrastructure at once. This is a proof-of-concept from SpecterOps, the company behind BloodHound, built on their OpenGraph framework. It's designed for security professionals who already use BloodHound and want to close a visibility gap around SCOM environments. The project is still maturing, the README notes ongoing work to fix parsing of Data Access accounts, add web console enumeration, and build high-privilege collection capabilities. Installation uses uv, a Python package manager, and authentication supports standard credentials, Kerberos, and hash-based methods common in offensive security workflows.