cyber-security-resources/windows/using_bloodhound.md

Advanced BloodHound Queries Collection

This document contains a comprehensive collection of queries for use with BloodHound, organized by category. These queries can help you analyze Active Directory environments more effectively.

User and Group Analysis

Find all edges any owned user has on a computer

MATCH p=shortestPath((m:User)-[r]->(b:Computer)) WHERE m.owned RETURN p

Find all Kerberoastable Users

MATCH (n:User) WHERE n.hasspn=true RETURN n

Find Kerberoastable Users with passwords last set > 5 years ago

MATCH (u:User) 
WHERE u.hasspn=true AND u.pwdlastset < (datetime().epochseconds - (1825 * 86400)) 
  AND NOT u.pwdlastset IN [-1.0, 0.0]
RETURN u.name, u.pwdlastset 
ORDER BY u.pwdlastset

Find users that logged in within the last 90 days

MATCH (u:User) 
WHERE u.lastlogon < (datetime().epochseconds - (90 * 86400)) 
  AND NOT u.lastlogon IN [-1.0, 0.0] 
RETURN u.name, u.lastlogon 
ORDER BY u.lastlogon

List users and their login times + password last set times in human-readable format

MATCH (n:User) 
WHERE n.enabled = TRUE 
RETURN n.name, 
  datetime({epochSeconds: toInteger(n.pwdlastset)}) as PwdLastSet, 
  datetime({epochSeconds: toInteger(n.lastlogon)}) as LastLogon 
ORDER BY n.pwdlastset

Find users that have never logged on and account is still active

MATCH (n:User) 
WHERE n.lastlogontimestamp=-1.0 AND n.enabled=TRUE 
RETURN n.name 
ORDER BY n.name

Computer and Session Analysis

Find computers with unconstrained delegation that AREN'T domain controllers

MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) 
WHERE g.objectsid ENDS WITH '-516' 
WITH COLLECT(c1.name) AS domainControllers 
MATCH (c2:Computer {unconstraineddelegation:true}) 
WHERE NOT c2.name IN domainControllers 
RETURN c2.name, c2.operatingsystem 
ORDER BY c2.name ASC

Find active Domain Admin sessions

MATCH (n:User)-[:MemberOf*1..]->(g:Group) 
WHERE g.objectid ENDS WITH '-512' 
MATCH p = (c:Computer)-[:HasSession]->(n) 
RETURN p

Find computers with descriptions

MATCH (c:Computer) 
WHERE c.description IS NOT NULL 
RETURN c.name, c.description

Domain and Forest Analysis

Find connections between different domains/forests

MATCH (n)-[r]->(m) 
WHERE NOT n.domain = m.domain 
RETURN LABELS(n)[0], n.name, TYPE(r), LABELS(m)[0], m.name

Privilege and Access Analysis

Find the percentage of computers with a path to Domain Admins

MATCH (totalComputers:Computer {domain:'DOMAIN.GR'}) 
MATCH p=shortestPath((ComputersWithPath:Computer {domain:'DOMAIN.GR'})-[r*1..]->(g:Group {name:'DOMAIN ADMINS@DOMAIN.GR'})) 
WITH COUNT(DISTINCT(totalComputers)) as totalComputers, COUNT(DISTINCT(ComputersWithPath)) as ComputersWithPath 
RETURN 100.0 * ComputersWithPath / totalComputers AS percentComputersToDA

Find the most privileged groups on the domain

MATCH (g:Group) 
OPTIONAL MATCH (g)-[:AdminTo]->(c1:Computer) 
OPTIONAL MATCH (g)-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c2:Computer) 
WITH g, COLLECT(c1) + COLLECT(c2) AS tempVar 
UNWIND tempVar AS computers 
RETURN g.name AS GroupName, COUNT(DISTINCT(computers)) AS AdminRightCount 
ORDER BY AdminRightCount DESC

Kerberos and Delegation Analysis

Find users with constrained delegation permissions

MATCH (u:User) 
WHERE u.allowedtodelegate IS NOT NULL 
RETURN u.name, u.allowedtodelegate

Find computers with constrained delegation permissions

MATCH (c:Computer) 
WHERE c.allowedtodelegate IS NOT NULL 
RETURN c.name, c.allowedtodelegate

GPO and OU Analysis

View OUs based on member count

MATCH (o:OU)-[:Contains]->(c:Computer) 
RETURN o.name, o.guid, COUNT(c) 
ORDER BY COUNT(c) DESC

Find if any domain user has interesting permissions against a GPO

MATCH p=(u:User)-[r:AllExtendedRights|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|GpLink*1..]->(g:GPO) 
RETURN p 
LIMIT 25

ACL and Permission Analysis

Find what permissions Everyone/Authenticated Users/Domain Users/Domain Computers have

MATCH p=(m:Group)-[r:AddMember|AdminTo|AllExtendedRights|AllowedToDelegate|CanRDP|Contains|ExecuteDCOM|ForceChangePassword|GenericAll|GenericWrite|GetChanges|GetChangesAll|HasSession|Owns|ReadLAPSPassword|SQLAdmin|TrustedBy|WriteDACL|WriteOwner|AddAllowedToAct|AllowedToAct]->(t) 
WHERE m.objectsid ENDS WITH '-513' OR m.objectsid ENDS WITH '-515' OR m.objectsid ENDS WITH 'S-1-5-11' OR m.objectsid ENDS WITH 'S-1-1-0' 
RETURN m.name, TYPE(r), t.name, t.enabled

Miscellaneous Queries

Adjust Query to Local Timezone (Change timezone parameter)

MATCH (u:User) 
WHERE NOT u.lastlogon IN [-1.0, 0.0] 
RETURN u.name, datetime({epochSeconds:toInteger(u.lastlogon), timezone: '+10:00'}) as LastLogon

Find users that are part of the VPN group

MATCH (u:User)-[:MemberOf]->(g:Group) 
WHERE g.name CONTAINS "VPN" 
RETURN u.name, g.name