This repo contains a customqueries.json file with several examples you can use and/or modify.
Further down in the Cypher section I have several queries that can be used in the neo4j interface.
I didnt write most of these, this is a culmination of items gathered from various gists, githubs, and threads in the #cypher-queries bloodhound channel.
Custom Queries (Bloodhound UI)
Bloodhound's UI allows you to create 'custom queries' to make repeating often used queries easy.
These are stored in a customqueries.json file.
- Generally these are queries that return paths
Some queries that were removed from the default list, as well as other useful queries, can be found in the customqueries.json file.
Copy/paste the entire thing into your own customqueries file and hit refresh next to "Custom Queries" to see them show up in the bloodhound UI.
The customqueries file locations by OS (in default setup):
Windows : %USERPROFILE%\AppData\Roaming\bloodhound\customqueries.json
OSX: ~/Library/Application Support/bloodhound/customqueries.json
NIX: ~/.config/bloodhound/customqueries.json
Cypher Queries (Neo4j Web Interface)
The CYPHER section are queries you would put into the neo4j interface and get results in tables.
- Generally these queries are used when you want to return lists or get percentages for report things
###### ## ## ######## ## ## ######## ########
## ## ## ## ## ## ## ## ## ## ##
## #### ## ## ## ## ## ## ##
## ## ######## ######### ###### ########
## ## ## ## ## ## ## ##
## ## ## ## ## ## ## ## ##
###### ## ## ## ## ######## ## ##
These are mostly for running in the web interface of neo4j. ~ http://localhost:7474
Some need to be modified based on the domain/user/group you are looking for
i.e change "EXAMPLE.COM" or "g.name contains "DOMAIN ADMINS""
T.o.C
- Get a count of computers that do not have admins
- Get the names of computers without admins, sorted in alphabetical order
- Return a list of users who have admin rights on at least one system either explicitly or through group membership
- Return username and number of computers that username is admin for, for top N users
- Show all users that are administrator on more than one machine
- Show all users that are administrative on at least one machine, ranked by the number of machines they are admin on.
- This will return cross domain 'HasSession' relationships
- Find all other Rights Domain Users shouldn't have
- Show Kerberoastable high value targets
- Show computers where Domain Admins are logged in
- Show groups with most localAdmin
- List of unique users with a path (no "GetChanges" path) to a Group tagged as "highvalue"
- Return all users which can rdp to any system, if they belong to adm or svr accounts
- Show the number of users that have admin rights on each computer, in descending order
- Stats percentage of enabled users that have a path to a high value group
- Shows machines that allow delegation that arent DCs
- Groups with most local admin
- Find principles with DCSync rights
- Find all Windows 7 computers
- Find every user object where the "userpassword" attribute is populated. Neo4j web console only.
- Find every user that doesn't require kerberos pre-authentication. Neo4j web console only.
- Return any group where the name of the group contains the string "SQL" followed by the string "ADMIN". This will match "SQL ADMINS" and will also match "SQL 2017 ADMINS".
- Find every OU that contains the string "CITRIX".
- Find all computers with sessions from users of a different domain (Looking for cross-domain compromise opportunities). Neo4j web console only.
- Find all users trusted to perform constrained delegation, return in order of the number of target computers. Neo4j web console only.
- Return each OU in the database in order of the number of computers in that OU. Neo4j web console only.
- Return the name of every computer in the database where at least one SPN for the computer contains the string "MSSQL". Neo4j web console only.
- Find groups with both users and computers that belong to the group. Neo4j web console only.
- Return each OU in the database that contains a Windows Server computer. Return rows where the columns are the name of the OU, the name of the computer, and the operating system
- Find any computer that is NOT a domain controller that is trusted to perform unconstrained delegation. Neo4j web console only.
- Find every instance of a computer account having local admin rights on other computers. Return in descending order of the number of computers the computer account has local
- Find users who are not marked as "Sensitive and Cannot Be Delegated" that have Administrative access to a computer, and where those users have sessions on servers with unconstrained delegation
- Gather the computers where the user is AdminTo and the computers with unconstrained delegation in lists (for better presentation and structure)
- DOMAIN USERS is Admin of Computer
- Find Shortest Path from DOMAIN USERS to High Value Targets
- Find ALL Path from DOMAIN USERS to High Value Targets
- Find all other right Domain Users shouldn’t have
- Kerberoastable Accounts
- Kerberoastable Accounts member of High Value Group
- Find WORKSTATIONS where Domain Users can RDP To
- Find SERVERS where Domain Users can RDP To
- Top 10 Computers with Most Admins
- How many High Value Target a Node can reach
- All DA Account Sessions
- DA Sessions to NON DC
- Count on how many non DC machines DA have sessions
- EXCLUDE PATH (Edge) on the fly
- Set SPN to a User
- Add DOMAIN USERS as Admin to COMPxxxx
- Test our New Relationship
- Delete a Relationship
- Shortest Path from Domain Users to Domain Admins
- Shortest Path from Domain Users to Domain Admins (No AdminTo)
- Find Admin Group not tagged highvalue
- Set Admin Group as highvalue
- Remore Admin User highvalue
- If you want to enumerate all available properties
- List all computers with unconstraineddelegation
- Computer where the most users can RDP to
- Average Length of Path
- Count how many Users have a path to DA
- Percent of Users that have a path to DA
- Return users with shortest paths to high value targets by name
- Return labels i.e. group/name for a given SID
- Return top 10 users with most Derivative local admin rights
- Find all users WITHOUT a path to DA
- Find users that have never logged on AND their account is still active
- Find users with DCSync rights who are not members of DA
- Show attack paths from X domain to Specific Domain
- Find all computers that are NOT dc's
1. Get a count of computers that do not have admins
MATCH (n)-[r:AdminTo]->(c:Computer)
WITH COLLECT(c.name) as compsWithAdmins
MATCH (c2:Computer) WHERE NOT c2.name in compsWithAdmins
RETURN COUNT(c2)
2. Get the names of computers without admins, sorted in alphabetical order
MATCH (n)-[r:AdminTo]->(c:Computer)
WITH COLLECT(c.name) as compsWithAdmins
MATCH (c2:Computer) WHERE NOT c2.name in compsWithAdmins
RETURN c2.name
ORDER BY c2.name ASC
3. Return a list of users who have admin rights on at least one system either explicitly or through group membership
MATCH (u:User)-[r:AdminTo|MemberOf*1..]->(c:Computer
RETURN u.name
4. Return username and number of computers that username is admin for, for top N users
MATCH (U:User)-[r:MemberOf|:AdminTo*1..]->(C:Computer)
WITH U.name as n, COUNT(DISTINCT(C)) as c
RETURN n,c
ORDER BY c DESC LIMIT 5
5. Show all users that are administrator on more than one machine
MATCH (U:User)-[r:MemberOf|:AdminTo*1..]->(C:Computer)
WITH U.name as n, COUNT(DISTINCT(C)) as c
WHERE c>1
RETURN n
ORDER BY c DESC
6. Show all users that are administrative on at least one machine, ranked by the number of machines they are admin on.
MATCH (u:User)
OPTIONAL MATCH (u)-[:AdminTo]->(c1:Computer)
OPTIONAL MATCH (u)-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c2:Computer)
WITH u, COLLECT(c1) + COLLECT(c2) AS tempVar
UNWIND tempVar AS computers
RETURN u.name AS UserName,COUNT(DISTINCT(computers)) AS AdminRightCount
ORDER BY AdminRightCount DESC
7. This will return cross domain 'HasSession' relationships
MATCH p=((S:Computer)-[r:HasSession*1]->(T:User))
WHERE NOT S.domain = T.domain
RETURN p
8. Find all other Rights Domain Users shouldn't have
MATCH p=(m:Group)->[r:Owns|:WriteDacl|:GenericAll|:WriteOwner|:ExecuteDCOM|:GenericWrite|:AllowedToDelegate|:ForceChangePassword]->(n:Computer)
WHERE m.name STARTS WITH ‘DOMAIN USERS’
RETURN p
9. Show Kerberoastable high value targets
MATCH (n:User)-[r:MemberOf]->(g:Group) WHERE g.highvalue=true AND n.hasspn=true RETURN n, g, r
10. Show computers where Domain Admins are logged in
MATCH (n:User)-[:MemberOf]->(g:Group {name:"DOMAIN [email protected]"})
WITH n as DAaccount
MATCH (c:Computer)-[b:MemberOf]->(t:Group) WHERE NOT t.name = "DOMAIN [email protected]"
WITH c as NonDC
MATCH p = (NonDC)-[:HasSession]->(DAaccount)
11. Show groups with most localAdmin
MATCH (g:Group)
WITH g
OPTIONAL MATCH (g)-[r:AdminTo]->(c:Computer)
WITH g,COUNT(c) as expAdmin
OPTIONAL MATCH (g)-[r:MemberOf*1..]->(a:Group)-[r2:AdminTo]->(c:Computer)
WITH g,expAdmin,COUNT(DISTINCT(c)) as unrolledAdmin
RETURN g.name,expAdmin,unrolledAdmin, expAdmin + unrolledAdmin as totalAdmin
ORDER BY totalAdmin DESC
or
MATCH (g:Group)
OPTIONAL MATCH (g)-[:AdminTo]->(c1:Computer)
OPTIONAL MATCH (g)-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c2:Computer)
WITH g,COLLECT(c1) + COLLECT(c2) AS tempVar
UNWIND tempVar AS comps
RETURN g.name,COUNT(DISTINCT(comps)) AS compcount
ORDER BY compcount DESC
or
MATCH (g:Group)
MATCH (g)-[:AdminTo]->(c:Computer)
RETURN g.name,COUNT(c)
ORDER BY COUNT(c) DESC
or
MATCH (g:group)-[:AdminTo]->(c:Computer)
RETURN g.name,COUNT(c)
ORDER BY COUNT(c) DESC
or
MATCH (g:Group)
MATCH (g)-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c:Computer)
RETURN g.name,COUNT(c)
ORDER BY COUNT(c) DESC
12. List of unique users with a path (no "GetChanges" path) to a Group tagged as "highvalue"
MATCH (u:User)
MATCH (g:Group {highvalue: True})
MATCH p = shortestPath((u:User)-[r:AddMember|AdminTo|AllExtendedRights|AllowedToDelegate|CanRDP|Contains|ExecuteDCOM|ForceChangePassword|GenericAll|GenericWrite|GetChangesAll|GpLink|HasSession|MemberOf|Owns|ReadLAPSPassword|TrustedBy|WriteDacl|WriteOwner*1..]->(g))
RETURN DISTINCT(u.name),u.enabled
order by u.name
13. Return all users which can rdp to any system, if they belong to adm or svr accounts
MATCH (c:Computer) where c.name contains 'xxxxxx'
MATCH (n:User)-[r:MemberOf]->(g:Group) WHERE g.name = 'DOMAIN [email protected]'
optional match (g:Group)-[:CanRDP]->(c)
OPTIONAL MATCH (u1:User)-[:CanRDP]->(c) where u1.enabled = true and u1.name contains 'ADM' OR u1.name contains 'SVR'
OPTIONAL MATCH (u2:User)-[:MemberOf*1..]->(:Group)-[:CanRDP]->(c) where u2.enabled = true and u2.name contains 'ADM' OR u2.name contains 'SVR'
WITH COLLECT(u1) + COLLECT(u2) + collect(n) as tempVar,c
UNWIND tempVar as users
RETURN c.name,COLLECT(users.name) as usernames
ORDER BY usernames desc
14. Show the number of users that have admin rights on each computer, in descending order
MATCH (c:Computer)
OPTIONAL MATCH (u1:User)-[:AdminTo]->(c)
OPTIONAL MATCH (u2:User)-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c)
WITH COLLECT(u1) + COLLECT(u2) AS tempVar,c
UNWIND tempVar AS admins
RETURN c.name AS computerName,COUNT(DISTINCT(admins)) AS adminCount
ORDER BY adminCount DESC
15. Stats percentage of enabled users that have a path to a high value group
MATCH (u:User {domain:'EXAMPLE.COM',enabled:True})
MATCH (g:Group {domain:'EXAMPLE.COM'})
WHERE g.highvalue = True
WITH g, COUNT(u) as userCount
MATCH p = shortestPath((u:User {domain:'EXAMPLE.COM',enabled:True})-[*1..]->(g))
RETURN toint(100.0 * COUNT(distinct u) / userCount)
16. Shows machines that allow delegation that arent DCs
OPTIONAL MATCH (c:Computer)-[:MemberOf]->(t:Group)
WHERE NOT t.name =~ "(?i)DOMAIN CONTROLLERS*."
WITH c as NonDC
MATCH (NonDC {unconstraineddelegation:true}) RETURN NonDC.name
17. Groups with most local admin
MATCH (g:Group)
WITH g
OPTIONAL MATCH (g)-[r:AdminTo]->(c:Computer)
WITH g,COUNT(c) as expAdmin
RETURN g.name,expAdmin,expAdmin as totalAdmin
ORDER BY totalAdmin DESC
18. Find principles with DCSync rights
MATCH p=(n1)-[:MemberOf|GetChanges*1..]->(u:Domain {name: {result}}) WITH p,n1
MATCH p2=(n1)-[:MemberOf|GetChangesAll*1..]->(u:Domain {name: {result}}) WITH p,p2
MATCH p3=(n2)-[:MemberOf|GenericAll|AllExtendedRights*1..]->(u:Domain {name: {result}})
RETURN p,p2,p3
19. Find all Windows 7 computers
MATCH (c:Computer)
WHERE toUpper(c.operatingsystem) CONTAINS "Windows 7"
RETURN c
20. Find every user object where the "userpassword" attribute is populated. Neo4j web console only.
MATCH (u:User)
WHERE NOT u.userpassword IS null
RETURN u.name,u.userpassword
21. Find every user that doesn't require kerberos pre-authentication. Neo4j web console only.
MATCH (u:User {dontreqpreauth: true})
RETURN u.name
22. Return any group where the name of the group contains the string "SQL" followed by the string "ADMIN". This will match "SQL ADMINS" and will also match "SQL 2017 ADMINS". Neo4j web console only.
MATCH (g:Group)
WHERE g.name =~ '(?i).*SQL.*ADMIN.*'
RETURN g.name
23. Find every OU that contains the string "CITRIX".
MATCH (o:OU)
WHERE o.name =~ "(?i).*CITRIX.*"
RETURN o
24. Find all computers with sessions from users of a different domain (Looking for cross-domain compromise opportunities). Neo4j web console only.
MATCH (c:Computer)-[:HasSession]->(u:User {domain:'FOO.BAR.COM'})
WHERE NOT c.domain = u.domain
RETURN u.name,COUNT(c)
25. Find all users trusted to perform constrained delegation, return in order of the number of target computers. Neo4j web console only.
MATCH (u:User)-[:AllowedToDelegate]->(c:Computer)
RETURN u.name,COUNT(c)
ORDER BY COUNT(c) DESC
26. Return each OU in the database in order of the number of computers in that OU. Neo4j web console only.
MATCH (o:OU)-[:Contains]->(c:Computer)
RETURN o.name,o.guid,COUNT(c)
ORDER BY COUNT(c) DESC
27. Return the name of every computer in the database where at least one SPN for the computer contains the string "MSSQL". Neo4j web console only.
MATCH (c:Computer)
WHERE ANY (x IN c.serviceprincipalnames WHERE toUpper(x) CONTAINS "MSSQL")
RETURN c.name,c.serviceprincipalnames
ORDER BY c.name ASC
28. Find groups with both users and computers that belong to the group. Neo4j web console only.
MATCH (c:Computer)-[r:MemberOf*1..]->(groupsWithComps:Group)
WITH groupsWithComps
MATCH (u:User)-[r:MemberOf*1..]->(groupsWithComps)
RETURN DISTINCT(groupsWithComps) as groupsWithCompsAndUsers
29. Return each OU in the database that contains a Windows Server computer. Return rows where the columns are the name of the OU, the name of the computer, and the operating system of the computer. Neo4j web console only.
MATCH (o:OU)-[:Contains]->(c:Computer)
WHERE toUpper(o.name) STARTS WITH "WINDOWS SERVER"
RETURN o.name,c.name,c.operatingsystem
30. Find any computer that is NOT a domain controller that is trusted to perform unconstrained delegation. Neo4j web console only.
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group)
WHERE g.objectsid ENDS WITH "-516"
WITH COLLECT(c1.name) AS domainControllers
MATCH (c2:Computer {unconstraineddelegation:true})
WHERE NOT c2.name IN domainControllers
RETURN c2.name,c2.operatingsystem
ORDER BY c2.name ASC
31. Find every instance of a computer account having local admin rights on other computers. Return in descending order of the number of computers the computer account has local admin rights on.
MATCH (c1:Computer)
OPTIONAL MATCH (c1)-[:AdminTo]->(c2:Computer)
OPTIONAL MATCH (c1)-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c3:Computer)
WITH COLLECT(c2) + COLLECT(c3) AS tempVar,c1
UNWIND tempVar AS computers
RETURN c1.name,COUNT(DISTINCT(computers))
ORDER BY COUNT(DISTINCT(computers)) DESC
32. Find users who are not marked as "Sensitive and Cannot Be Delegated" that have Administrative access to a computer, and where those users have sessions on servers with Unconstrained Delegation enabled
MATCH (n {sensitive:FALSE})-[:MemberOf*0..5]->(g:Group)-[:AdminTo]->(c:Computer)
WITH n,c MATCH (d:Computer {unconstraineddelegation:TRUE})-[:HasSession]->(n:User)
RETURN n.name AS user,
c.name as AdminTo ,
d.name as TicketLocation
----or this one does sort of the same thing?-----
MATCH (u:User {sensitive:false})-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c1:Computer)
WITH u,c1
MATCH (c2:Computer {unconstraineddelegation:true})-[:HasSession]->(u)
RETURN u.name AS user,c1.name AS AdminTo,c2.name AS TicketLocation
ORDER BY user ASC
33. Gather the computers where the user is AdminTo and the computers with unconstrained delegation in lists (for better presentation and structure)
MATCH (u:User {sensitive:false})-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c1:Computer)
WITH u,c1
MATCH (c2:Computer {unconstraineddelegation:true})-[:HasSession]->(u)
RETURN u.name AS user,COLLECT(DISTINCT(c1.name)) AS AdminTo,COLLECT(DISTINCT(c2.name)) AS TicketLocation
ORDER BY user ASC
34. DOMAIN USERS is Admin of Computer
MATCH p=(m:Group)-[r:AdminTo]->(n:Computer) WHERE m.name STARTS WITH 'DOMAIN USERS' RETURN p
35. Find Shortest Path from DOMAIN USERS to High Value Targets
MATCH (g:Group),(n {highvalue:true}),p=shortestPath((g)-[*1..]->(n))
WHERE g.name STARTS WITH 'DOMAIN USERS'
RETURN p
36. Find ALL Path from DOMAIN USERS to High Value Targets
MATCH (g:Group) WHERE g.name STARTS WITH 'DOMAIN USERS' MATCH (n {highvalue:true}),p=shortestPath((g)-[r*1..]->(n)) return p
37. Find all other right Domain Users shouldn’t have
MATCH p=(m:Group)-[r:Owns|:WriteDacl|:GenericAll|:WriteOwner|:ExecuteDCOM|:GenericWrite|:AllowedToDelegate|:ForceChangePassword]->(n:Computer) WHERE m.name STARTS WITH 'DOMAIN USERS' RETURN p
38. Kerberoastable Accounts
MATCH (n:User)WHERE n.hasspn=true RETURN n
39. Kerberoastable Accounts member of High Value Group
MATCH (n:User)-[r:MemberOf]->(g:Group) WHERE g.highvalue=true AND n.hasspn=true RETURN n, g, r
40. Find WORKSTATIONS where Domain Users can RDP To
match p=(g:Group)-[:CanRDP]->(c:Computer)
where g.name STARTS WITH 'DOMAIN USERS' AND NOT c.operatingsystem CONTAINS 'Server'
return p
41. Find SERVERS where Domain Users can RDP To
match p=(g:Group)-[:CanRDP]->(c:Computer)
where g.name STARTS WITH 'DOMAIN USERS'
AND c.operatingsystem CONTAINS 'Server'
return p
42. Top 10 Computers with Most Admins
MATCH (n:User),(m:Computer), (n)-[r:AdminTo]->(m) WHERE NOT n.name STARTS WITH 'ANONYMOUS LOGON' AND NOT n.name='' WITH m, count(r) as rel_count order by rel_count desc LIMIT 10 MATCH p=(m)<-[r:AdminTo]-(n) RETURN p
43. How many High Value Target a Node can reach
MATCH p = shortestPath((n)-[*1..]->(m {highvalue:true}))
WHERE NOT n = m
RETURN DISTINCT(m.name),LABELS(m)[0],COUNT(DISTINCT(n))
ORDER BY COUNT(DISTINCT(n)) DESC
44. All DA Account Sessions
MATCH (n:User)-[:MemberOf]->(g:Group {name:"DOMAIN [email protected]"})
MATCH p = (c:Computer)-[:HasSession]->(n)
return p
45. DA Sessions to NON DC
OPTIONAL MATCH (c:Computer)-[:MemberOf]->(t:Group)
WHERE NOT t.name = "DOMAIN [email protected]"
WITH c as NonDC
MATCH p=(NonDC)-[:HasSession]->(n:User)-[:MemberOf]->
(g:Group {name:"DOMAIN [email protected]"})
RETURN DISTINCT (n.name) as Username, COUNT(DISTINCT(NonDC)) as Connexions
ORDER BY COUNT(DISTINCT(NonDC)) DESC
46. Count on how many non DC machines DA have sessions
MATCH (c:Computer)-[:MemberOf*1..]->(g:Group)
WHERE g.objectsid ENDS WITH "-516"
WITH c.name as DomainControllers
MATCH p = (c2:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group)
WHERE g.objectsid ENDS WITH "-512" AND NOT c2.name in DomainControllers
RETURN DISTINCT(u.name),COUNT(DISTINCT(c2))
ORDER BY COUNT(DISTINCT(c2)) DESC
47. EXCLUDE PATH (Edge) on the fly
MATCH (n:User),(m:Group {name:"DOMAIN [email protected]"}),
p=shortestPath((n)-[r*1..]->(m))
WHERE ALL(x in relationships(p) WHERE type(x) <> "AdminTo")
RETURN p
48. Set SPN to a User
MATCH (n:User {name:"[email protected]"}) SET n.hasspn=true
49. Add DOMAIN USERS as Admin to COMPxxxx
MERGE (n:Group {name:"DOMAIN [email protected]"}) WITH n MERGE (m:Computer {name:"COMP00673.TESTLAB.LOCAL"}) WITH n,m MERGE (n)-[:AdminTo]->(m)
50. Test our New Relationship
MATCH p=(n:Group {name:"DOMAIN [email protected]"})-[r:AdminTo]->(m:Computer {name:"COMP00673.TESTLAB.LOCAL"})
RETURN p
Might try to replace AdminTo by 1**
51. Delete a Relationship
MATCH p=(n:Group {name:"DOMAIN [email protected]"})-[r:AdminTo]->
(m:Computer {name:"COMP00673.TESTLAB.LOCAL"})
DELETE r
52. Shortest Path from Domain Users to Domain Admins
MATCH (g:Group {name:"DOMAIN [email protected]"}),
(n {name:"DOMAIN [email protected]"}),
p=shortestPath((g)-[r*1..]->(n))
return p
53. Shortest Path from Domain Users to Domain Admins (No AdminTo)
MATCH (g:Group {name:"DOMAIN [email protected]"}),
(n {name:"DOMAIN [email protected]"}),
p=shortestPath((g)-[r*1..]->(n))
WHERE ALL(x in relationships(p) WHERE type(x) <> "AdminTo")
return p
54. Find Admin Group not tagged highvalue
MATCH (g:Group)
WHERE g.name CONTAINS "ADMIN"
AND g.highvalue IS null
RETURN g.name
55. Set Admin Group as highvalue
MATCH (g:Group)
WHERE g.name CONTAINS "ADMIN"
AND g.highvalue IS null
SET g.highvalue=true
56. Remore Admin User highvalue
MATCH p=(g:Group {highvalue: true})<-[:MemberOf]-(u:User)
WHERE g.name CONTAINS "ADMIN"
SET g.highvalue = NULL
57. If you want to enumerate all available properties
Match (n:Computer) return properties(n)
58. List all computers with unconstraineddelegation
MATCH (c:Computer {unconstraineddelegation:true})
return c.name
59. Computer where the most users can RDP to
MATCH (c:Computer)
OPTIONAL MATCH (u1:User)-[:CanRDP]->(c)
OPTIONAL MATCH (u2:User)-[:MemberOf*1..]->(:Group)-[:CanRDP]->(c)
WITH COLLECT(u1) + COLLECT(u2) as tempVar,c
UNWIND tempVar as users
RETURN c.name,COUNT(DISTINCT(users))
ORDER BY COUNT(DISTINCT(users)) DESC
60. Average Length of Path
MATCH (g:Group {name:'DOMAIN [email protected]'})
MATCH p = shortestPath((u:User)-[r:AdminTo|MemberOf|HasSession*1..]->(g))
WITH EXTRACT(n in NODES(p) | LABELS(n)[0]) as pathNodes
WITH FILTER(x IN pathNodes WHERE x = "Computer") as filteredPathNodes
RETURN AVG(LENGTH(filteredPathNodes))
61. Count how many Users have a path to DA
MATCH p=shortestPath((u:User)-[*1..]->
(m:Group {name: "DOMAIN [email protected]"}))
RETURN COUNT (DISTINCT(u))
62. Percent of Users that have a path to DA
OPTIONAL MATCH p=shortestPath((u:User)-[*1..]->
(m:Group {name: "DOMAIN [email protected]"}))
OPTIONAL MATCH (uT:User)
WITH COUNT (DISTINCT(uT)) as uTotal, COUNT (DISTINCT(u)) as uHasPath
RETURN uHasPath / uTotal * 100 as Percent
63. Return users with shortest paths to high value targets by name
MATCH (u:User)
MATCH (g:Group {highvalue: True})
MATCH p = shortestPath((u:User)-[r:AddMember|AdminTo|AllExtendedRights|AllowedToDelegate|CanRDP|Contains|ExecuteDCOM|ForceChangePassword|GenericAll|GenericWrite|GetChangesAll|GpLink|HasSession|MemberOf|Owns|ReadLAPSPassword|TrustedBy|WriteDacl|WriteOwner*1..]->(g))
RETURN DISTINCT(u.name),u.enabled
order by u.name
64. Return labels i.e. group,username for a given SID
MATCH (n {objectsid:"S-1-5-21-971234526-3761234589-3049876599-500"}) RETURN labels(n)
65. Return top 10 users with most Derivative local admin rights
MATCH (u:User)
OPTIONAL MATCH (u)-[:AdminTo]->(c1:Computer)
OPTIONAL MATCH (u)-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c2:Computer)
WITH COLLECT(c1) + COLLECT(c2) as tempVar,u
UNWIND tempVar AS computers
RETURN u.name,COUNT(DISTINCT(computers)) AS is_admin_on_this_many_boxes
ORDER BY is_admin_on_this_many_boxes DESC
66. Find all users WITHOUT a path to da
MATCH (n:User),(m:Group {name:"DOMAIN [email protected]"}) WHERE NOT EXISTS ((n)-[*]->(m)) RETURN n.name
67. Find users that have never logged on AND their account is still active
MATCH (n:User) WHERE n.lastlogontimestamp=-1.0 AND n.enabled=TRUE RETURN n.name ORDER BY n.name
68. Find users with DCSync rights who are not members of DA
MATCH (n1)-[:MemberOf|GetChanges*1..]->(u:Domain {name: "TESTLAB.LOCAL"}) WITH n1,u
MATCH (n1)-[:MemberOf|GetChangesAll*1..]->(u) WITH n1,u
MATCH p = (n1)-[:MemberOf|GetChanges|GetChangesAll*1..]->(u) WHERE NOT (n1)-[:MemberOf*1..]->(:Group {name:"DOMAIN [email protected]"})
RETURN p
69. Show attack paths from X domain to Specific Domain
MATCH p=(n)-[r]->(m) WHERE NOT n.domain = m.domain RETURN p
or specific domains
MATCH p=(n {domain:"lab.local")-[r]->(m {domain:"test.local"}) RETURN p
70. Find all computers that are NOT dc's
MATCH (dc:Computer)-[:MemberOf*1..]->(g:Group)
WHERE g.name STARTS WITH('DOMAIN CONTROLLERS')
WITH COLLECT(dc) as dcs
MATCH (c:Computer) WHERE NOT c in dcs
RETURN COUNT(c)
or using objectID
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group)
WHERE g.objectid ENDS WITH "-516"
WITH COLLECT(c1) as dcs
MATCH (c:Computer) WHERE NOT c in dcs
RETURN COUNT(c)
References
Reading materials / References::
https://github.com/BloodHoundAD/BloodHound/wiki
https://github.com/Scoubi/BloodhoundAD-Queries
https://github.com/porterhau5/BloodHound-Owned
https://porterhau5.com/blog/extending-bloodhound-track-and-visualize-your-compromise/
https://blog.cptjesus.com/posts/introtocypher#building-on-top