joshtmerrill/HoundBench huggingface dataset:
Description: The name of every computer in the database where at least one SPN for the computer contains the string 'MSSQL'
Cypher query: MATCH (c:Computer) WHERE ANY (x IN c.serviceprincipalnames WHERE toUpper(x) CONTAINS 'MSSQL') RETURN c
Description: All (shortest) paths from Domain Users to High‑Value targets
Cypher query: MATCH (g:Group) WHERE g.name STARTS WITH 'DOMAIN USERS' MATCH (n {highvalue:true}), p = shortestPath((g)-[r*1..]->(n)) RETURN p
Description: All Computers without LAPS - with session
Cypher query: MATCH p = (d:Domain)-[r:Contains*1..]->(c:Computer)-[:HasSession]->(y) WHERE c.haslaps = false RETURN p
Description: All computers without LAPS and the computer is enabled
Cypher query: MATCH p = (d:Domain)-[r:Contains*1..]->(c:Computer) WHERE c.haslaps = false AND c.enabled = true RETURN p
Description: All enabled computers with a description
Cypher query: MATCH p = (d:Domain)-[r:Contains*1..]->(c:Computer) WHERE c.description =~ '(?i).*.*' RETURN p
Description: All enabled computers with a description containing the word file
Cypher query: MATCH p = (d:Domain)-[r:Contains*1..]->(c:Computer) WHERE c.description =~ '(?i).*file.*' RETURN p
Description: All Kerberoastable Users
Cypher query: MATCH (n {hasspn: true}) RETURN n
Description: All Owned Nodes
Cypher query: MATCH (n {owned: true}) RETURN n
Description: All Users with a homedirectory
Cypher query: MATCH p = (d:Domain)-[r:Contains*1..]->(u:User) WHERE u.homedirectory =~ '(?i).*.*' RETURN p
Description: Can a user from one domain affect *any* computer in another domain (VERY heavy)
Cypher query: MATCH (n:User {domain: {result}}) MATCH (m:Computer {domain: {}}) MATCH p=allShortestPaths((n)-[r:MemberOf|HasSession|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|CanRDP|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GpLink|AddAllowedToAct|AllowedToAct|SQLAdmin*1..]->(m)) RETURN p
Description: Computers with administrative Domain Users
Cypher query: MATCH p=(m:Group)-[r:AddMember|AdminTo|AllExtendedRights|AllowedToDelegate|CanRDP|Contains|ExecuteDCOM|ForceChangePassword|GenericAll|GenericWrite|GetChanges|GetChangesAll|HasSession|Owns|ReadLAPSPassword|SQLAdmin|TrustedBy|WriteDacl|WriteOwner|AddAllowedToAct|AllowedToAct]->(t) WHERE m.objectid ENDS WITH '-513' OR m.objectid ENDS WITH '-515' OR m.objectid ENDS WITH 'S-1-5-11' OR m.objectid ENDS WITH 'S-1-1-0' RETURN p
Description: Constrained Delegation systems
Cypher query: MATCH p=(u)-[:AllowedToDelegate]->(c) RETURN p
Description: Count the LAPS status of all computers
Cypher query: MATCH (c:Computer) RETURN c.haslaps, COUNT(*)
Description: Custom privileged groups that are **not** built‑in and not marked high‑value
Cypher query: MATCH (g:Group {admincount:true, highvalue:false, domain: $result}) WHERE NOT (g.objectid =~ $domain_admins OR g.objectid =~ $enterprise_admins OR g.objectid =~ $administrators OR g.objectid =~ $account_operators OR g.objectid CONTAINS $replicators OR g.objectid =~ $key_admins OR g.objectid =~ $read_only_domain_controllers OR g.objectid =~ $enterprise_key_admins OR g.objectid =~ $schema_admins) RETURN g
Description: All active Domain Admin sessions
Cypher query: MATCH (n:User)-[:MemberOf]->(g:Group) WHERE g.objectid ENDS WITH '-512' MATCH p = (c:Computer)-[:HasSession]->(n) return p
Description: All AS-REP-roastable users
Cypher query: MATCH (u:User {dontreqpreauth: true}) RETURN u.name
Description: All Certificate Templates
Cypher query: MATCH (n:GPO) WHERE n.type = 'Certificate Template' RETURN n
Description: All computers domain users can RDP to
Cypher query: MATCH p=(g:Group)-[:CanRDP]->(c:Computer) WHERE g.objectid ENDS WITH '-513' RETURN p
Description: All computers with unsupported operating systems
Cypher query: MATCH (H:Computer) WHERE H.operatingsystem =~ \'.*(2000|2003|2008|xp|vista|7|me).*\'AND H.enabled = true RETURN H
Description: All domain admins
Cypher query: MATCH (n:User)-[:MemberOf*1..]->(g:Group {name: "DOMAIN ADMINS@"}) RETURN n
Description: All Domain Admins (nested SID S-1-5-21-.*-512) having a session opened on a domain computer
Cypher query: MATCH (m:User)-[r:MemberOf*1..]->(n:Group) WHERE n.objectid =~ '(?i)S-1-5-.*-512' WITH m MATCH q=((m)<-[:HasSession]-(o:Computer)) RETURN q
Description: All edges any owned user has on a computer
Cypher query: MATCH p=shortestPath((m:User)-[r]->(b:Computer)) WHERE m.owned RETURN p
Description: All edges any owned user has on a computer
Cypher query: MATCH p=shortestPath((m:User)-[r*]->(b:Computer)) WHERE m.owned RETURN p
Description: All local admins
Cypher query: MATCH (n:User)-[:AdminTo]->(m:Computer) RETURN n, m
Description: All other Rights Domain Users shouldn't have
Cypher query: MATCH p=(m:Group)-[r:Owns|WriteDacl|GenericAll|WriteOwner|ExecuteDCOM|GenericWrite|AllowedToDelegate|ForceChangePassword]->(n:Computer) WHERE m.objectid ENDS WITH '-513' OR m.objectid ENDS WITH '-515' OR m.objectid ENDS WITH 'S-1-5-11' OR m.objectid ENDS WITH 'S-1-1-0' RETURN p
Description: All Owners of Azure Applications
Cypher query: MATCH p = (n)-[r:AZOwns]->(g:AZApp) RETURN p
Description: All paths from users to Domain Admins group
Cypher query: MATCH p=shortestPath((n:User)-[*1..]->(m:Group)) WHERE m.name = "DOMAIN ADMINS@INTERNAL.LOCAL" RETURN p
Description: All paths to an Azure KeyVault
Cypher query: MATCH p = (n)-[r]->(g:AZKeyVault) RETURN p
Description: All paths to an Azure VM
Cypher query: MATCH p = (n)-[r]->(g:AZVM) RETURN p
Description: All principals with certificate enrollment rights (Enroll, AllExtendedRights, or GenericAll) on certificate templates
Cypher query: MATCH p = ()-[:Enroll|AllExtendedRights|GenericAll]->(ct:CertTemplate) RETURN p
Description: All Privileged Service Principals
Cypher query: MATCH p = (g:AZServicePrincipal)-[r]->(n) RETURN p
Description: All sessions
Cypher query: MATCH (n:User)-[:HasSession]->(m:Computer) RETURN n, m
Description: All sessions any user in a specific domain has
Cypher query: MATCH p=(m:Computer)-[r:HasSession]->(n:User) WHERE n.domain IS NOT NULL RETURN p
Description: All users a part of the VPN group
Cypher query: MATCH p=(u:User)-[:MemberOf]->(g:Group) WHERE toUPPER (g.name) CONTAINS 'VPN' return p
Description: All users with 'AddMember' rights on groups
Cypher query: MATCH p=(g:Group)-[:AddMember]->(m:Group) RETURN p
Description: All users with 'AdminTo' rights on computers
Cypher query: MATCH p=(g:Group)-[:AdminTo]->(c:Computer) RETURN p
Description: All users with 'AllExtendedRights' on computers
Cypher query: MATCH p=(g:Group)-[:AllExtendedRights]->(c:Computer) RETURN p
Description: All users with 'CanPSRemote' rights on computers
Cypher query: MATCH p=(g:Group)-[:CanPSRemote]->(c:Computer) RETURN p
Description: All users with 'CanRDP' rights on computers
Cypher query: MATCH p=(g:Group)-[:CanRDP]->(c:Computer) RETURN p
Description: All users with 'ExecuteDCOM' rights on computers
Cypher query: MATCH p=(g:Group)-[:ExecuteDCOM]->(c:Computer) RETURN p
Description: All users with 'ForceChangePassword' rights on users
Cypher query: MATCH p=(g:Group)-[:ForceChangePassword]->(u:User) RETURN p
Description: All users with 'GenericAll' rights on computers
Cypher query: MATCH p=(g:Group)-[:GenericAll]->(c:Computer) RETURN p
Description: All users with 'GenericWrite' rights on computers
Cypher query: MATCH p=(g:Group)-[:GenericWrite]->(c:Computer) RETURN p
Description: All users with 'HasSession' on computers
Cypher query: MATCH p=(g:Group)-[:HasSession]->(c:Computer) RETURN p
Description: All users with 'MemberOf' relationships
Cypher query: MATCH p=(g:Group)-[:MemberOf]->(m:Group) RETURN p
Description: All users with 'Owns' rights on computers
Cypher query: MATCH p=(g:Group)-[:Owns]->(c:Computer) RETURN p
Description: All users with 'WriteDacl' rights on computers
Cypher query: MATCH p=(g:Group)-[:WriteDacl]->(c:Computer) RETURN p
Description: All users with 'WriteOwner' rights on computers
Cypher query: MATCH p=(g:Group)-[:WriteOwner]->(c:Computer) RETURN p
Description: All users with an SPN (Kerberoastable users)
Cypher query: MATCH (n:User) WHERE n.hasspn=true RETURN n
Description: All users with passwords set over 1440 days ago (47 months)
Cypher query: MATCH (u:User) WHERE u.enabled=true AND u.pwdlastset < (datetime().epochseconds - (1440 * 86400)) and NOT u.pwdlastset IN [-1.0, 0.0] RETURN u
Description: All users with passwords set over 720 days ago (23 months)
Cypher query: MATCH (u:User) WHERE u.enabled=true AND u.pwdlastset < (datetime().epochseconds - (720 * 86400)) and NOT u.pwdlastset IN [-1.0, 0.0] RETURN u
Description: All‑shortest paths where non‑privileged users have dangerous rights to the AdminSDHolder object
Cypher query: MATCH p=allshortestpaths((u:User {enabled:true, admincount:false, domain: $result})-[*]->(c:Container)) WHERE c.distinguishedname CONTAINS 'ADMINSDHOLDER' RETURN p
Description: All‑shortest paths where non‑privileged users have DCSync rights to a Domain object
Cypher query: MATCH p=allshortestpaths((u:User {enabled:true, admincount:false, domain: $result})-[r:MemberOf|DCSync*1..]->(:Domain)) RETURN p
Description: All‑shortest paths where principals can add Shadow Credentials to other principals
Cypher query: MATCH p=allshortestpaths((a {domain: $result})-[:MemberOf|AddKeyCredentialLink*1..]->(b)) WHERE NOT a=b RETURN p
Description: An object from domain 'A' that can do anything to a foreign object
Cypher query: MATCH p=(n)-[r]->(d) WHERE NOT d.domain=n.domain AND n.domain IS NOT NULL AND d.domain IS NOT NULL RETURN p
Description: An object in one domain that can do something to a foreign object
Cypher query: MATCH p=(n)-[r]->(m) WHERE NOT n.domain = m.domain RETURN p
Description: Certificate Authorities
Cypher query: MATCH (n:GPO) WHERE n.type = 'Enrollment Service' RETURN n
Description: Certificate Authorities with HTTP Web Enrollment (ESC8)
Cypher query: MATCH (n:GPO) WHERE n.type = 'Enrollment Service' and n.`Web Enrollment` = 'Enabled' RETURN n
Description: Certificate Authorities with User Specified SAN (ESC6)
Cypher query: MATCH (n:GPO) WHERE n.type = 'Enrollment Service' and n.`User Specified SAN` = 'Enabled' RETURN n
Description: Computers that allow unconstrained delegation that AREN'T domain controllers.
Cypher query: MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH COLLECT(c1.name) AS domainControllers MATCH (c2:Computer {unconstraineddelegation:true}) WHERE NOT c2.name IN domainControllers RETURN c2
Description: Computers with constrained delegation permissions and the corresponding targets where they allowed to delegate
Cypher query: MATCH (c:Computer) WHERE c.allowedtodelegate IS NOT NULL RETURN c
Description: Computers with owned Admins
Cypher query: MATCH p=shortestPath((n:User {owned:true})-[r:AdminTo|MemberOf*1..]->(c:Computer)) return p
Description: Constrained delegation
Cypher query: MATCH p=(u:User)-[:AllowedToDelegate]->(c:Computer) RETURN p
Description: Domain Admin sessions not on domain controllers
Cypher query: OPTIONAL MATCH (c:Computer)-[:MemberOf]->(t:Group) WHERE NOT t.name = 'DOMAIN CONTROLLERS@TESTLAB.LOCAL' WITH c AS NonDC MATCH p=(NonDC)-[:HasSession]->(n:User)-[:MemberOf]->(g:Group {name:'DOMAIN ADMINS@TESTLAB.LOCAL'}) RETURN DISTINCT n.name AS Username, COUNT(DISTINCT NonDC) AS Connexions ORDER BY COUNT(DISTINCT NonDC) DESC
Description: Enabled Certificate Templates
Cypher query: MATCH (n:GPO) WHERE n.type = 'Certificate Template' and n.Enabled = true RETURN n
Description: Enabled Certificate Templates
Cypher query: MATCH (n:GPO {enabled:true, type:'Certificate Template', domain: $result}) RETURN n
Description: Enrollment Agent Templates (ESC3)
Cypher query: MATCH (n:GPO) WHERE n.type = 'Certificate Template' and n.`Enabled` = true and (n.`Extended Key Usage` = [] or 'Any Purpose' IN n.`Extended Key Usage` or 'Certificate Request Agent' IN n.`Extended Key Usage`) RETURN n
Description: If unprivileged users have rights to add members into groups
Cypher query: MATCH (n:User {admincount:False}) MATCH p=allShortestPaths((n)-[r:AddMember*1..]->(m:Group)) RETURN p
Description: Instances where a User has GenericAll privileges on a Container
Cypher query: MATCH p=(n:User)-[:GenericAll]->(c:Container) RETURN p
Description: Misconfigured Certificate Templates (ESC1)
Cypher query: MATCH (n:GPO) WHERE n.type = 'Certificate Template' and n.`Enrollee Supplies Subject` = true and n.`Client Authentication` = true and n.`Enabled` = true RETURN n
Description: Misconfigured Certificate Templates (ESC2)
Cypher query: MATCH (n:GPO) WHERE n.type = 'Certificate Template' and n.`Enabled` = true and (n.`Extended Key Usage` = [] or 'Any Purpose' IN n.`Extended Key Usage`) RETURN n
Description: Multi hop low privilege group rights (up to 6 hops)
Cypher query: MATCH (g:Group) WHERE g.objectid ENDS WITH '-S-1-1-0' OR g.objectid ENDS WITH '-S-1-5-11' OR g.objectid ENDS WITH '-513' OR g.objectid ENDS WITH '-515' OR g.objectid ENDS WITH '-S-1-5-32-545' OR g.objectid ENDS WITH '-S-1-5-32-554' MATCH p=(g)-[r1:MemberOf*1..6]->(g2:Group)-[r2]->(n) WHERE n<>g AND g<>g2 AND NOT type(r2)='MemberOf' AND NOT (g2.objectid ENDS WITH '-S-1-1-0' OR g2.objectid ENDS WITH '-S-1-5-11' OR g2.objectid ENDS WITH '-513' OR g2.objectid ENDS WITH '-515' OR g2.objectid ENDS WITH '-S-1-5-32-545' OR g2.objectid ENDS WITH '-S-1-5-32-554') RETURN DISTINCT p
Description: Non-Tier Zero principals with ADCSESCx edges to Tier Zero ADCS templates
Cypher query: MATCH p = (n)-[:ADCSESC1|ADCSESC3|ADCSESC4|ADCSESC6a|ADCSESC6b|ADCSESC9a|ADCSESC9b|ADCSESC10a|ADCSESC10b|ADCSESC13]->(m) WHERE "admin_tier_0" IN split(m.system_tags, ' ') AND (n.system_tags IS NULL OR NOT "admin_tier_0" IN split(n.system_tags, ' ')) RETURN p
Description: OU issues related to the new dMSA attack (may need updates)
Cypher query: MATCH (u:User)-[r:GenericAll|GenericWrite|WriteOwner|WriteDacl|WriteProperty|CreateChild]->(o:OU) RETURN u, r, o
Description: Owned Domain Admins
Cypher query: MATCH (n:Group) WHERE n.name CONTAINS 'DOMAIN ADMINS' AND n.owned=true WITH n MATCH p=(n)<-[r:MemberOf*1..]-(m) RETURN p
Description: Owned Groups
Cypher query: MATCH (n:User {owned: true})-[r:MemberOf]->(g:Group) RETURN g
Description: Principals with privileged access to an Azure tenancy
Cypher query: MATCH (a) WHERE (a:User OR a:AZUser) WITH a MATCH p=(a)-[r:MemberOf|AZGlobalAdmin|AZPrivilegedRoleAdmin*1..]->(azt:AZTenant) RETURN p
Description: Server 2000 and Enabled
Cypher query: MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2000).*' AND H.enabled = true RETURN H
Description: Server 2000 with session
Cypher query: MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2000).*' RETURN H
Description: Server 2003 and Enabled
Cypher query: MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2003).*' AND H.enabled = true RETURN H
Description: Server 2003 with session
Cypher query: MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2003).*' RETURN H
Description: Server 2008 and Enabled
Cypher query: MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2008).*' AND H.enabled = true RETURN H
Description: Server 2008 with session
Cypher query: MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2008).*' RETURN H
Description: Server 2012 and Enabled
Cypher query: MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2012).*' AND H.enabled = true RETURN H
Description: Server 2012 with session
Cypher query: MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2012).*' RETURN H
Description: Server 2016 and Enabled
Cypher query: MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2016).*' AND H.enabled = true RETURN H
Description: Server 2016 with session
Cypher query: MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2016).*' RETURN H
Description: Server 2019 and Enabled
Cypher query: MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2019).*' AND H.enabled = true RETURN H
Description: Server 2019 with session
Cypher query: MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2019).*' RETURN H
Description: Server 2022 and Enabled
Cypher query: MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2022).*' AND H.enabled = true RETURN H
Description: Server 2022 with session
Cypher query: MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2022).*' RETURN H
Description: Servers a user can RDP into
Cypher query: MATCH p=(g:Group)-[:CanRDP]->(c:Computer) WHERE g.objectid ENDS WITH '-513' AND c.operatingsystem CONTAINS 'Server' RETURN p
Description: Servers Domain Users can RDP to
Cypher query: MATCH p=(g:Group)-[:CanRDP]->(c:Computer) WHERE g.name STARTS WITH 'DOMAIN USERS' AND c.operatingsystem CONTAINS 'Server' RETURN p
Description: Shortest Path from owned Node to Domain Admin
Cypher query: MATCH (n:User {owned:true}), (m:Group) WHERE m.name CONTAINS 'DOMAIN ADMINS' WITH n, m MATCH p=shortestPath((n)-[r:MemberOf|AdminTo|HasSession|Contains|GpLink|Owns|DCSync|AllExtendedRights|ForceChangePassword|GenericAll|GenericWrite|WriteDacl|WriteOwner*1..]->(m)) RETURN p
Description: Shortest path to domain admin
Cypher query: MATCH p=shortestPath((n:User {name:""})-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@"})) RETURN p
Description: Single hop low privilege group rights
Cypher query: MATCH (g:Group) WHERE g.objectid ENDS WITH '-S-1-1-0' OR g.objectid ENDS WITH '-S-1-5-11' OR g.objectid ENDS WITH '-513' OR g.objectid ENDS WITH '-515' OR g.objectid ENDS WITH '-S-1-5-32-545' OR g.objectid ENDS WITH '-S-1-5-32-554' MATCH p=(g)-[r]->(n) WHERE n<>g AND NOT type(r)='MemberOf' RETURN DISTINCT p
Description: SPNs with keywords (e.g., 'SQL')
Cypher query: MATCH (u:User) WHERE ANY (x IN u.serviceprincipalnames WHERE toUpper(x) CONTAINS 'SQL') RETURN u
Description: The Shortest path to a high value target from an owned object
Cypher query: MATCH p=shortestPath((g {owned:true})-[*1..]->(n {highvalue:true})) WHERE g<>n return p
Description: The Shortest path to a unconstrained delegation system from an owned object
Cypher query: MATCH (n) MATCH p=shortestPath((n)-[*1..]->(m:Computer {unconstraineddelegation: true})) WHERE NOT n=m AND n.owned = true RETURN p
Description: Un-Supported OS and Enabled
Cypher query: MATCH (n:Computer) WHERE n.operatingsystem =~ '(?i).*(2000|2003|2008|xp|vista|7|me).*' AND n.enabled = true RETURN n
Description: Unsupported operating systems
Cypher query: MATCH (H:Computer) WHERE H.operatingsystem =~ '.*(2000|2003|2008|xp|vista|7|me).*' RETURN H
Description: Users created in the last 30 days
Cypher query: MATCH (u:User) where u.enabled=true and u.whencreated > (datetime().epochseconds - (30 * 86400)) RETURN u
Description: Users that belong to high value groups
Cypher query: match (u1:User) WHERE u1.plaintext=True MATCH p=(u1:User)-[r:MemberOf*1..]->(m:Group {highvalue:true}) RETURN u1
Description: Users that can RDP into something
Cypher query: match (u1:User) WHERE u1.plaintext=True MATCH p1=(u1)-[:CanRDP*1..]->(c:Computer) RETURN u1
Description: Users that don't require Kerberos pre-authentication (AS-REP Roasting)
Cypher query: MATCH (u:User {dontreqpreauth: true}) RETURN u
Description: Users that haven't logged on in 720 days and account is still active
Cypher query: MATCH (n:User) WHERE n.lastlogon < (datetime().epochseconds - (720 * 86400)) AND n.enabled=true RETURN n
Description: Users that logged in within the last 90 days
Cypher query: MATCH (u:User) WHERE u.lastlogon > (datetime().epochseconds - (90 * 86400)) AND NOT u.lastlogon IN [-1.0, 0.0] RETURN u
Description: Users with blank passwords that are enabled
Cypher query: MATCH (u:User) WHERE NOT u.userpassword IS null AND u.enabled = true RETURN u.name,u.userpassword
Description: Users with passwords last set within the last 90 days
Cypher query: MATCH (u:User) WHERE u.pwdlastset > (datetime().epochseconds - (90 * 86400)) AND NOT u.pwdlastset IN [-1.0, 0.0] RETURN u
Description: Users with Temp in user title and created in the last 30 days
Cypher query: MATCH (u:User) where u.enabled=true and u.whencreated > (datetime().epochseconds - (30 * 86400)) AND u.title CONTAINS 'Temp' RETURN u
Description: Users' credentials in description fields
Cypher query: MATCH (m:User) WHERE m.description CONTAINS 'password' RETURN m.name, m.description
Description: Users/Groups with direct access to GPOs
Cypher query: MATCH p = (n)-[r:AddMember|AddSelf|WriteSPN|AddKeyCredentialLink|AllExtendedRights|ForceChangePassword|GenericAll|GenericWrite|WriteDacl|WriteOwner|Owns]->(g:GPO) RETURN p
Description: What groups can RDP
Cypher query: MATCH p=(m:Group)-[r:CanRDP]->(n:Computer) RETURN p
Description: Windows 7 and Enabled
Cypher query: MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(7).*' AND H.enabled = true RETURN H
Description: Windows 7 session
Cypher query: MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(7).*' RETURN H
Description: Windows XP and Enabled
Cypher query: MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(xp).*' AND H.enabled = true RETURN H
Description: Windows XP with session
Cypher query: MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(xp).*' RETURN H
Description: Workstations a user can RDP into
Cypher query: MATCH p=(g:Group)-[:CanRDP]->(c:Computer) WHERE g.objectid ENDS WITH '-513' AND NOT c.operatingsystem CONTAINS 'Server' RETURN p
Description: A list of all OS versions containing 'Server'
Cypher query: MATCH (c:Computer) WHERE c.operatingsystem CONTAINS 'Server' RETURN DISTINCT c.operatingsystem
Description: A list of all OS versions with a count
Cypher query: MATCH (c:Computer) RETURN DISTINCT c.operatingsystem, COUNT(c.operatingsystem)
Description: Active sessions of Domain Admins
Cypher query: MATCH (u:User)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-512' MATCH p = (c:Computer)-[:HasSession]->(u) RETURN c.name, u.name
Description: All Domain Admins
Cypher query: MATCH (g:Group) WHERE g.name =~ '(?i).*DOMAIN ADMINS.*' WITH g MATCH (g)<-[r:MemberOf*1..]-(a) RETURN a.name
Description: All Windows 2008 computers and sort by last logon timestamp descending and human-readable
Cypher query: MATCH (c:Computer) WHERE c.operatingsystem CONTAINS '2008' RETURN c.name, c.operatingsystem, datetime({ epochSeconds: toInteger(c.lastlogon) }) AS rdate ORDER BY rdate DESC
Description: The local admins to all computers
Cypher query: MATCH p=(u:User)-[r:AdminTo]->(c:Computer) RETURN u.name, c.name ORDER BY u.name
Description: Groups of High Value Targets
Cypher query: MATCH p=(n:User)-[r:MemberOf*1..]->(m:Group {highvalue:true}) RETURN p
Description: Groups with Computer and User Objects
Cypher query: MATCH (c:Computer)-[r:MemberOf*1..]->(groupsWithComps:Group) WITH groupsWithComps MATCH (u:User)-[r:MemberOf*1..]->(groupsWithComps) RETURN DISTINCT groupsWithComps as groupsWithCompsAndUsers
Description: Identify principals used for AD ↔ AAD directory sync
Cypher query: MATCH (u) WHERE (u:User OR u:AZUser) AND (u.name =~ '(?i)^MSOL_|.*AADConnect.*' OR u.userprincipalname =~ '(?i)^sync_.*') OPTIONAL MATCH (u)-[:HasSession]->(s:Session) RETURN u, s
Description: Kerberoastable Admins
Cypher query: MATCH (n:Group) WHERE n.objectid ENDS WITH '-512' WITH n MATCH p=(n)<-[:MemberOf*1..]-(m {hasspn: true}) RETURN p
Description: All Certificate Templates (Certipy data required)
Cypher query: MATCH (n:GPO {type:'Certificate Template', domain: $result}) RETURN n
Description: All domains
Cypher query: MATCH (d:Domain) RETURN d
Description: All enabled Azure users
Cypher query: MATCH (u:AZUser {enabled:true}) RETURN u
Description: All GPOs in a domain
Cypher query: MATCH (g:GPO {domain: $result}) RETURN g
Description: All groups in a domain
Cypher query: MATCH (g:Group {domain: $result}) RETURN g
Description: All High Valued Targets
Cypher query: MATCH (m) WHERE m.highvalue=true RETURN m
Description: All owned & enabled users
Cypher query: MATCH (u:User {owned:true, enabled:true, domain: $result}) RETURN u
Description: All owned computers
Cypher query: MATCH (m:Computer) WHERE m.owned=true RETURN m
Description: All owned computers in a selected domain
Cypher query: MATCH (c:Computer {owned:true, domain: $result}) RETURN c ORDER BY c.name
Description: All owned groups
Cypher query: MATCH (m:Group) WHERE m.owned=true RETURN m
Description: All owned users
Cypher query: MATCH (m:User) WHERE m.owned=true RETURN m