joshtmerrill/HoundBench huggingface dataset:
Description: Tier 0 objects (any node tagged admin_tier_0)
Cypher query: MATCH p = (:Domain)-[:Contains*1..]->(n:Base) WHERE 'admin_tier_0' IN split(n.system_tags,' ') RETURN p
Description: Tier 0 users
Cypher query: MATCH p = (u:User)-[:MemberOf]->(:Base) WHERE 'admin_tier_0' IN split(u.system_tags,' ') RETURN p
Description: Tier 0 computers
Cypher query: MATCH p = (c:Computer)-[:MemberOf]->(:Base) WHERE 'admin_tier_0' IN split(c.system_tags,' ') RETURN p
Description: Users in the Protected Users group
Cypher query: MATCH p = (:Base)-[:MemberOf*1..]->(:Group {samaccountname:'Protected Users'}) RETURN p
Description: Users marked ‘Account is sensitive and cannot be delegated’
Cypher query: MATCH p = (:Base {sensitive:true})-[:MemberOf*1..]->(:Group) RETURN p
Description: Tier 0 user logons on non‑Tier 0 computers
Cypher query: MATCH p = (c:Computer)-[:HasSession*1..]->(u:User) WHERE 'admin_tier_0' IN split(u.system_tags,' ') AND (NOT 'admin_tier_0' IN split(c.system_tags,' ') OR c.system_tags IS NULL) RETURN p
Description: Non‑Tier 0 principals with local‑admin rights
Cypher query: MATCH p = (b:Base)-[:AdminTo]->(:Computer) WHERE NOT 'admin_tier_0' IN split(b.system_tags,' ') OR b.system_tags IS NULL RETURN p
Description: Non‑Tier 0 principals with DCSync capability
Cypher query: MATCH p = allShortestPaths((b:Base)-[:MemberOf|GenericAll|DCSync*1..]->(d:Domain)) WHERE b <> d AND (NOT 'admin_tier_0' IN split(b.system_tags,' ') OR b.system_tags IS NULL) RETURN p
Description: Non‑Tier 0 principals that can read LAPS passwords
Cypher query: MATCH p = (b:Base)-[:AllExtendedRights|ReadLAPSPassword]->(:Computer) WHERE NOT 'admin_tier_0' IN split(b.system_tags,' ') OR b.system_tags IS NULL RETURN p
Description: Non‑Tier 0 principals with RDP/administrative access
Cypher query: MATCH p = (b:Base)-[:AdminTo]->(:Computer) WHERE NOT 'admin_tier_0' IN split(b.system_tags,' ') OR b.system_tags IS NULL RETURN p
Description: Computers that belong to Tier 0 groups
Cypher query: MATCH p = (:Computer {isdc:false})-[:MemberOf*1..]->(g:Group) WHERE 'admin_tier_0' IN split(g.system_tags,' ') RETURN p
Description: LAPS passwords readable by non‑admin principals
Cypher query: MATCH p = (b:Base)-[:AllExtendedRights|ReadLAPSPassword|GenericAll]->(:Computer {haslaps:true}) WHERE NOT 'admin_tier_0' IN split(b.system_tags,' ') OR b.system_tags IS NULL RETURN p
Description: LAPS passwords readable via owned principals
Cypher query: MATCH p = (u)-[:MemberOf*1..]->(:Group)-[:GenericAll]->(t:Computer {haslaps:true}) WHERE 'owned' IN split(u.system_tags,' ') RETURN p
Description: Principals with ACL rights over computers (excluding Tier 0)
Cypher query: MATCH p = (b)-[{isacl:true}]->(:Computer) WHERE (b:User OR b:Computer OR b:Group) AND (NOT 'admin_tier_0' IN split(b.system_tags,' ') OR b.system_tags IS NULL) RETURN p
Description: DMSA accounts controlled by non‑Tier 0 principals (BadSuccessor)
Cypher query: MATCH p = (d:Computer)<-[:WriteDacl|Owns|GenericAll|GenericWrite|WriteOwner]-(n:Base) WHERE d.`msds-delegatedmsastate` IS NOT NULL AND (NOT 'admin_tier_0' IN split(n.system_tags,' ') OR n.system_tags IS NULL) RETURN p
Description: Interesting GPOs by keyword
Cypher query: UNWIND ['firewall','defender','vpn','laps','antivirus','cyberark','powershell','msc','edr','sentinel'] AS word MATCH p = (g:GPO)-[:GPLink*1..]->(:Base) WHERE toLower(g.name) CONTAINS toLower(word) RETURN p
Description: Non‑admin principals with dangerous GPO permissions
Cypher query: MATCH p = (u:User)-[:AddMember|AddSelf|WriteSPN|AddKeyCredentialLink|AllExtendedRights|ForceChangePassword|GenericAll|GenericWrite|WriteDacl|WriteOwner|Owns]->(:GPO) WHERE NOT 'admin_tier_0' IN split(u.system_tags,' ') OR u.system_tags IS NULL RETURN p
Description: Published certificate templates
Cypher query: MATCH p = (ct:CertTemplate)-[:PublishedTo]->(:EnterpriseCA) RETURN p
Description: ESC 1/3/4/13 certificate‑template abuse paths from non‑Tier 0 principals
Cypher query: MATCH p = (b)-[:ADCSESC1|ADCSESC3|ADCSESC4|ADCSESC13]->() WHERE NOT 'admin_tier_0' IN split(b.system_tags,' ') OR b.system_tags IS NULL RETURN p
Description: ESC15 (EKUwu) vulnerable certificate‑template chains
Cypher query: MATCH p = (:Base)-[:Enroll|AllExtendedRights]->(ct:CertTemplate)-[:PublishedTo]->(:EnterpriseCA)-[:TrustedForNTAuth]->(:NTAuthStore)-[:NTAuthStoreFor]->(:Domain) WHERE ct.enrolleesuppliessubject = true AND ct.authenticationenabled = false AND ct.requiresmanagerapproval = false AND ct.schemaversion = 1 RETURN p
Description: Principals in Server / Account / Print Operators (SIDs ‑548, ‑549, ‑550) that are **not** yet tagged Tier 0
Cypher query: MATCH (g:Group) WHERE (g.system_tags IS NULL OR NOT 'admin_tier_0' IN split(g.system_tags,' ')) AND (g.objectid =~ '(?i).*S-1-5-.*-548' OR g.objectid =~ '(?i).*S-1-5-.*-549' OR g.objectid =~ '(?i).*S-1-5-.*-550') RETURN g
Description: Principals with direct DCSync privilege on a Domain (not yet Tier 0)
Cypher query: MATCH (n)-[:DCSync|AllExtendedRights|GenericAll]->(:Domain) WHERE (n.system_tags IS NULL OR NOT 'admin_tier_0' IN split(n.system_tags,' ')) RETURN n
Description: Principals with DCSync **or** GetChanges / GetChangesAll on Domain (not yet Tier 0)
Cypher query: MATCH (n)-[:DCSync|AllExtendedRights|GenericAll|GetChanges|GetChangesAll]->(:Domain) WHERE (n.system_tags IS NULL OR NOT 'admin_tier_0' IN split(n.system_tags,' ')) RETURN n
Description: Users or computers with Unconstrained Delegation that are not Tier 0
Cypher query: MATCH (n) WHERE (n:User OR n:Computer) AND n.unconstraineddelegation = true AND (n.system_tags IS NULL OR NOT 'admin_tier_0' IN split(n.system_tags,' ')) RETURN n
Description: Principals with Local‑Admin (`AdminTo`) or `ForceChangePassword` rights (not Tier 0)
Cypher query: MATCH (n)-[:AdminTo|ForceChangePassword]->(b) WHERE (n.system_tags IS NULL OR NOT 'admin_tier_0' IN split(n.system_tags,' ')) RETURN n
Description: Principals with privileged rights on computers (GenericAll, WriteDacl, etc.) not tagged Tier 0
Cypher query: MATCH (n)-[:AllowedToDelegate|ExecuteDCOM|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner]->(:Computer) WHERE (n.system_tags IS NULL OR NOT 'admin_tier_0' IN split(n.system_tags,' ')) RETURN n
Description: Principals with rights over Cert Publishers group (SID ‑517) that are not Tier 0
Cypher query: MATCH (n)-[:GenericAll|GenericWrite|MemberOf|Owns|WriteDacl|WriteOwner]->(g:Group) WHERE g.objectid =~ '(?i).*S-1-5-21-.*-517' AND (n.system_tags IS NULL OR NOT 'admin_tier_0' IN split(n.system_tags,' ')) RETURN n
Description: Principals who belong to Tier 0 groups but lack the Tier 0 tag
Cypher query: MATCH (n)-[:MemberOf*1..]->(g:Group) WHERE (n.system_tags IS NULL OR NOT 'admin_tier_0' IN split(n.system_tags,' ')) AND g.system_tags CONTAINS 'admin_tier_0' RETURN n
Description: Tier 0‑tagged users / computers that are disabled or inactive > 180 days
Cypher query: MATCH (uc) WHERE uc.system_tags CONTAINS 'admin_tier_0' AND ((uc:User AND uc.enabled = false) OR (uc:Computer AND ((uc.enabled = false) OR (uc.lastlogon > 0 AND uc.lastlogon < (timestamp()/1000 - 15552000)) OR (uc.lastlogontimestamp > 0 AND uc.lastlogontimestamp < (timestamp()/1000 - 15552000))))) RETURN uc
Description: Groups with foreign‑domain group membership
Cypher query: MATCH p=(n:Group {domain:$result})-[:MemberOf]->(m:Group) WHERE m.domain <> n.domain AND n.name <> m.name RETURN p
Description: Kerberoastable members of high‑value groups
Cypher query: MATCH p = shortestPath((n:User)-[:MemberOf]->(g:Group)) WHERE g.highvalue = true AND n.hasspn = true RETURN p
Description: Kerberoastable users ordered by count of computers they can locally admin
Cypher query: MATCH (u:User {hasspn:true}) OPTIONAL MATCH (u)-[:AdminTo]->(c1:Computer) OPTIONAL MATCH (u)-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c2:Computer) WITH u, COLLECT(c1) + COLLECT(c2) AS allComps UNWIND allComps AS comp RETURN u, COUNT(DISTINCT comp) AS adminCount ORDER BY adminCount DESC
Description: Shortest paths to Domain Admins from Kerberoastable users
Cypher query: MATCH p = shortestPath((n:User {hasspn:true})-[:{}*1..]->(m:Group {name:$result})) RETURN p
Description: Members of high‑privileged Azure AD roles
Cypher query: MATCH p = (n)-[:AZHasRole|AZMemberOf*1..2]->(r:AZRole) WHERE r.displayname =~ '(?i)Global Administrator|User Administrator|Cloud Application Administrator|Authentication Policy Administrator|Exchange Administrator|Helpdesk Administrator|Privileged Authentication Administrator' RETURN p
Description: On‑prem‑synced users in high‑privileged Azure AD roles
Cypher query: MATCH p = (n)-[:AZHasRole|AZMemberOf*1..2]->(r:AZRole) WHERE n.onpremisesyncenabled = true AND r.displayname =~ '(?i)Global Administrator|User Administrator|Cloud Application Administrator|Authentication Policy Administrator|Exchange Administrator|Helpdesk Administrator|Privileged Authentication Administrator' RETURN p
Description: Azure users with a path to high‑value targets
Cypher query: MATCH (m:AZUser), (n {highvalue:true}), p = shortestPath((m)-[r*1..]->(n)) WHERE NONE (rel IN relationships(p) WHERE type(rel) IN ['GetChanges','GetChangesAll']) AND m <> n RETURN p
Description: On‑prem‑synced Azure users with paths to high‑value targets
Cypher query: MATCH (m:AZUser) WHERE m.onpremisesyncenabled = true WITH m MATCH (n {highvalue:true}), p = shortestPath((m)-[r*1..]->(n)) WHERE NONE (rel IN relationships(p) WHERE type(rel) IN ['GetChanges','GetChangesAll']) AND m <> n RETURN p
Description: Shortest paths to privileged Azure AD roles
Cypher query: MATCH (role:AZRole) WHERE role.displayname =~ '(?i)Global Administrator|User Administrator|Cloud Application Administrator|Authentication Policy Administrator|Exchange Administrator|Helpdesk Administrator|Privileged Authentication Administrator' WITH role MATCH (m), p = shortestPath((m)-[r*1..]->(role)) WHERE m <> role RETURN p
Description: Azure applications with paths to high‑value targets
Cypher query: MATCH (app:AZApp), (target {highvalue:true}), p = shortestPath((app)-[r*1..]->(target)) WHERE NONE (rel IN relationships(p) WHERE type(rel) IN ['GetChanges','GetChangesAll']) AND app <> target RETURN p
Description: Shortest paths to Azure subscriptions
Cypher query: MATCH (sub:AZSubscription) WITH sub MATCH (m), p = shortestPath((m)-[r*1..]->(sub)) WHERE m <> sub RETURN p
Description: Shortest paths from **owned** principals to privileged Azure AD roles
Cypher query: MATCH (role:AZRole) WHERE role.displayname =~ '(?i)Global Administrator|User Administrator|Cloud Application Administrator|Authentication Policy Administrator|Exchange Administrator|Helpdesk Administrator|Privileged Authentication Administrator' WITH role MATCH (m {owned:true}), p = shortestPath((m)-[r*1..]->(role)) WHERE m <> role RETURN p
Description: Service principals that can grant arbitrary app roles via MS Graph
Cypher query: MATCH p = (sp)-[:AZMGGrantAppRoles]->(t:AZTenant) RETURN p
Description: Service principals with MS Graph app‑role assignment permissions
Cypher query: MATCH p = (sp:AZServicePrincipal)-[:AZMGAppRoleAssignment_ReadWrite_All|AZMGApplication_ReadWrite_All|AZMGDirectory_ReadWrite_All|AZMGGroupMember_ReadWrite_All|AZMGGroup_ReadWrite_All|AZMGRoleManagement_ReadWrite_Directory|AZMGServicePrincipalEndpoint_ReadWrite_All]->(:AZServicePrincipal) RETURN p
Description: Direct controllers of Microsoft Graph service principal
Cypher query: MATCH p = (n)-[:AZAddOwner|AZAddSecret|AZAppAdmin|AZCloudAppAdmin|AZMGAddOwner|AZMGAddSecret|AZOwns]->(g:AZServicePrincipal {appdisplayname:'Microsoft Graph'}) RETURN p
Description: Shortest paths to Microsoft Graph service principal
Cypher query: MATCH p = shortestPath((n)-[r*1..]->(g:AZServicePrincipal {appdisplayname:'Microsoft Graph'})) WHERE n <> g RETURN p
Description: Every node in the BloodHound graph
Cypher query: MATCH (n) RETURN n
Description: Every User node
Cypher query: MATCH (u:User) RETURN u
Description: Nodes where the custom property `test` exists (any value)
Cypher query: MATCH (n) WHERE exists(n.test) RETURN n
Description: Nodes where the custom property `test` is **missing**
Cypher query: MATCH (n) WHERE NOT exists(n.test) RETURN n
Description: Nodes whose property `test` equals `helloWorld`
Cypher query: MATCH (n) WHERE n.test = 'helloWorld' RETURN n
Description: All sessions of all users (any domain)
Cypher query: MATCH p = (:Computer)-[:HasSession*1..]->(:User) RETURN p
Description: All logged‑in admins (user has a session on a computer they administer)
Cypher query: MATCH (c:Computer)-[:HasSession]->(u:User) WITH c,u MATCH p = shortestPath((u)-[:AdminTo|MemberOf*1..]->(c)) RETURN p
Description: Users who are **direct** members of a selected group
Cypher query: MATCH p = (u:User)-[:MemberOf*1..1]->(g:Group {name:$result}) RETURN p
Description: Users ≤ 3 hops from local‑admin rights on a selected computer
Cypher query: MATCH p = (u:User)-[:MemberOf|AdminTo*1..3]->(c:Computer {name:$result}) RETURN p