Earlier in the year I wrote a small tool for generating ntlmrelayx target lists from BloodHound datasets filtering for local administrators. This improves the chance of a relay being successful and useful.

You can find wolfhound on my GitLab. It’s not much, but let me know if you use it on an engagement.