joshtmerrill/HoundBench huggingface dataset:
Description: All owned users in a selected domain
Cypher query: MATCH (u:User {owned:true, domain: $result}) RETURN u
Description: All principals with "SQLAdmin" permission on computers
Cypher query: MATCH p=(a {domain: $result})-[:MemberOf|SQLAdmin*1..]->(c:Computer) RETURN p
Description: All principals with Local-Admin permission
Cypher query: MATCH p=(a {domain: $result})-[:MemberOf|AdminTo*1..]->(c:Computer) RETURN p
Description: All principals with RDP permission
Cypher query: MATCH p=(a {domain: $result})-[:MemberOf|CanRDP*1..]->(c:Computer) RETURN p
Description: All Tenancy objects (AzureHound required)
Cypher query: MATCH (t:AZTenant) RETURN t
Description: All user sessions (sessions data required)
Cypher query: MATCH p=(u:User {domain: $result})<-[r:HasSession]-(c:Computer) RETURN p
Description: Certificate Authority servers (Certipy data required)
Cypher query: MATCH (n:GPO {type:'Enrollment Service', domain: $result}) RETURN n
Description: Computers WITHOUT LAPS
Cypher query: MATCH (c:Computer {haslaps:false, domain: $result}) RETURN c ORDER BY c.name
Description: Domain computers
Cypher query: MATCH (c:Computer {domain: $result}) RETURN c
Description: Domain controllers
Cypher query: MATCH (c:Computer {domain: $result})-[:MemberOf]->(g:Group) WHERE g.samaccountname CONTAINS 'Domain Controllers' RETURN c
Description: Domain trusts
Cypher query: MATCH p=(n:Domain)-->(m:Domain) RETURN p
Description: Enabled principals with Constrained Delegation
Cypher query: MATCH (a {enabled: true, domain: $result}) WHERE exists(a.`allowedtodelegate`) RETURN a
Description: Enabled principals with Unconstrained Delegation
Cypher query: MATCH (a {unconstraineddelegation: true, enabled: true, domain: $result}) RETURN a
Description: Enabled users in a domain
Cypher query: MATCH (u:User {enabled:true, domain: $result}) RETURN u
Description: Enabled users that don't require passwords
Cypher query: MATCH (u:User {passwordnotreqd:true, enabled:true, domain: $result}) RETURN u
Description: Enabled users that have never logged in
Cypher query: MATCH (u:User {enabled:true, domain: $result}) WHERE u.lastlogontimestamp=-1.0 RETURN u
Description: Enabled users that logged in within the last 90 days
Cypher query: MATCH (u:User {enabled:true, domain: $result}) WHERE u.lastlogon > (datetime().epochseconds - (90 * 86400)) AND NOT u.lastlogon IN [-1.0, 0.0] RETURN u
Description: Enabled users that set a password within the last 90 days
Cypher query: MATCH (u:User {enabled:true, domain: $result}) WHERE u.pwdlastset > (datetime().epochseconds - (90 * 86400)) AND NOT u.pwdlastset IN [-1.0, 0.0] RETURN u
Description: Enabled users who are members of foreign domains' groups
Cypher query: MATCH p=(u:User {enabled:true, domain: $result})-[:MemberOf*1..]->(g:Group) WHERE NOT u.domain = g.domain RETURN p
Description: Enabled users whose password never expires
Cypher query: MATCH (u:User {pwdneverexpires:true, enabled:true, domain: $result}) RETURN u
Description: Enabled users whose password never expires and hasn't changed in a year
Cypher query: MATCH (u:User {enabled:true, domain: $result}) WHERE u.pwdneverexpires=true AND u.pwdlastset < (datetime().epochseconds - (365 * 86400)) AND NOT u.pwdlastset IN [-1.0, 0.0] RETURN u
Description: Enabled users with a non-null userPassword attribute
Cypher query: MATCH (u:User {enabled:true, domain: $result}) WHERE u.userpassword IS NOT null RETURN u
Description: Enabled users with an e-mail address
Cypher query: MATCH (u:User {enabled:true, domain: $result}) WHERE exists(u.email) RETURN u
Description: High-value targets in a domain
Cypher query: MATCH (a {highvalue: true, domain: $result}) RETURN a
Description: Network shares (excluding SYSVOL)
Cypher query: MATCH (a {domain: $result}) WHERE (any(prop IN keys(a) WHERE a[prop] CONTAINS '\\' AND NOT a[prop] CONTAINS 'SYSVOL')) RETURN a
Description: Non-managed service accounts (Kerberoastable SVC accounts)
Cypher query: MATCH (u:User {hasspn:true, domain: $result}) WHERE NOT u.name CONTAINS '$' AND NOT u.name CONTAINS 'KRBTGT' RETURN u
Description: Non-privileged users with most dangerous permissions
Cypher query: MATCH (u:User {enabled: true, admincount: false, domain: $result})-[r]->(a) RETURN u, COUNT(DISTINCT type(r)) AS permissions ORDER BY permissions DESC LIMIT 10
Description: The groups of all owned users
Cypher query: MATCH (m:User) WHERE m.owned=true WITH m MATCH p=(m)-[:MemberOf*1..]->(n:Group) RETURN p
Description: Users whose description field is populated
Cypher query: MATCH (u:User {domain: $result}) WHERE u.description IS NOT null RETURN u
Description: Locate enabled accounts with display name of admin - put anyname in you like
Cypher query: MATCH p = (d:Domain)-[r:Contains*1..]->(u:User) WHERE u.displayname =~ '(?i).*admin*' AND u.enabled = true RETURN p
Description: Most exploitable paths from owned objects to High Value Targets (5 hops)
Cypher query: MATCH p=allShortestPaths((n {owned:true})-[:MemberOf|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GpLink|AddAllowedToAct|AllowedToAct|SQLAdmin|ReadGMSAPassword|HasSIDHistory*1..5]->(m {highvalue:true})) WHERE NOT n=m RETURN p
Description: Most exploitable shortest‑paths to Domain Admins
Cypher query: MATCH (n:User),(m:Group {name:{result}}), p = shortestPath((n)-[r:MemberOf|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GpLink|AddAllowedToAct|AllowedToAct|SQLAdmin*1..]->(m)) RETURN p
Description: Next steps (3 hops) from owned objects
Cypher query: MATCH p=shortestPath((c {owned: true})-[*1..3]->(s)) WHERE NOT c = s RETURN p
Description: Next steps (5 hops) from owned objects
Cypher query: MATCH p=shortestPath((c {owned: true})-[*1..5]->(s)) WHERE NOT c = s RETURN p
Description: Non Admin Groups with High Value Privileges
Cypher query: MATCH p=(g:Group)-[r:Owns|WriteDacl|GenericAll|WriteOwner|ExecuteDCOM|GenericWrite|AllowedToDelegate|ForceChangePassword]->(n:Computer) WHERE NOT g.name CONTAINS 'ADMIN' RETURN p
Description: Owned groups that grant access to network shares
Cypher query: MATCH p=(u:User {owned:true, domain: $result})-[:MemberOf*1..]->(g:Group) WHERE any(prop IN keys(g) WHERE g[prop] CONTAINS '\\') RETURN p
Description: Owned principals → Azure Apps → Service Principals with dangerous rights
Cypher query: MATCH p=(n {enabled:true, owned:true, domain: $result})-[:AZOwns]->(azapp:AZApp)-[r1]->(azsp:AZServicePrincipal)-[r:AZGlobalAdmin|AZPrivilegedRoleAdmin*1..]->(azt:AZTenant) RETURN p
Description: Owned users whose group memberships grant privileged Azure‑tenant access
Cypher query: MATCH p=(n {owned:true, enabled:true, domain: $result})-[:MemberOf*1..]->(g:Group)-[r:AZGlobalAdmin|AZPrivilegedRoleAdmin*1..]->(:AZTenant) RETURN p
Description: Owned users with direct privileged access to an Azure tenancy
Cypher query: MATCH p=(n {owned:true, enabled:true, domain: $result})-[r:MemberOf|AZGlobalAdmin|AZPrivilegedRoleAdmin*1..]->(:AZTenant) RETURN p
Description: Owned users with permissions against GPOs
Cypher query: MATCH p=(u:User {owned:true})-[r:AllExtendedRights|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|GpLink*1..]->(g:GPO) RETURN p
Description: Owned + enabled users that have an e‑mail address
Cypher query: MATCH (u:User {owned:true, enabled:true, domain: $result}) WHERE exists(u.email) RETURN u
Description: Owned + enabled users with Local‑Admin rights, active sessions and their groups
Cypher query: MATCH p=(u:User {owned:true, enabled:true, domain: $result})-[:MemberOf|AdminTo*1..]->(c:Computer) OPTIONAL MATCH p2=(c)-[:HasSession]->(u2:User) OPTIONAL MATCH p3=(u2:User)-[:MemberOf*1..]->(:Group) RETURN p, p2, p3
Description: Owned + enabled users with RDP rights, active sessions and their groups
Cypher query: MATCH p=(u:User {owned:true, enabled:true, domain: $result})-[:MemberOf|CanRDP*1..]->(c:Computer) OPTIONAL MATCH p2=(c)-[:HasSession]->(u2:User) OPTIONAL MATCH p3=(u2:User)-[:MemberOf*1..]->(:Group) RETURN p, p2, p3
Description: Owned + enabled users with SQLAdmin rights
Cypher query: MATCH p=(u:User {owned:true, enabled:true, domain: $result})-[:MemberOf|SQLAdmin*1..]->(c:Computer) RETURN p
Description: Paths from Domain Users to Domain Admins **excluding RDP**
Cypher query: MATCH (n:User),(m:Group {name:{result}}), p = shortestPath((n)-[r:MemberOf|HasSession|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GpLink|AddAllowedToAct|AllowedToAct|SQLAdmin*1..]->(m)) RETURN p
Description: Privileged users who are **not** members of the “Protected Users” group (selected domain)
Cypher query: MATCH (u:User {admincount:true, domain: $result}), (u)-[:MemberOf*1..]->(g) WHERE g.name CONTAINS 'Protected Users' WITH COLLECT(u) AS protectedUsers MATCH (u2:User {admincount:true, domain: $result}) WHERE NOT u2 IN protectedUsers RETURN u2
Description: All Azure AD Groups that are synchronized with On-Premise AD
Cypher query: MATCH (n:Group) WHERE n.objectid CONTAINS 'S-1-5' AND n.azsyncid IS NOT NULL RETURN n
Description: All Azure Admins and their owned Devices
Cypher query: MATCH p=(d:AZDevice)<-[r1:AZOwns]->(m:AZUser)<-[r2:AZHasRole]->(n) RETURN p
Description: All Azure Users and their Admin Roles
Cypher query: MATCH p=(n)-[:AZHasRole|AZMemberOf*1..]->(:AZRole) RETURN p
Description: All Azure Users that are part of the 'Global Administrator' Role
Cypher query: MATCH p =(n)-[r:AZGlobalAdmin*1..]->(m) RETURN p
Description: All On-Prem users with edges to Azure
Cypher query: MATCH p=(m:User)-[r:AZResetPassword|AZOwns|AZUserAccessAdministrator|AZContributor|AZAddMembers|AZGlobalAdmin|AZVMContributor|AZOwnsAZAvereContributor]->(n) WHERE m.objectid CONTAINS 'S-1-5-21' RETURN p
Description: GUEST Azure Users and their Groups
Cypher query: MATCH p=(m:AZUser)-[r:AZMemberOf*1..]->(n) WHERE NOT m.objectid CONTAINS 'S-1-5' AND m.userprincipalname=~ '(?i).*#EXT#.*' RETURN p
Description: Users with a variant of "password" in their password and a path to high value targets (limit to 25 results)
Cypher query: match (u1:User) WHERE u1.plaintextpassword =~ "(.*[pP][aA@][sS$][sS$][wW][oO0][rR][dD].*)" MATCH p=shortestPath((u1:User)-[*1..]->(n {highvalue:true})) WHERE u1<>n return u1 LIMIT 25
Description: Users with a variant of "password" in their password and are high value targets
Cypher query: MATCH (u1:User) WHERE u1.plaintextpassword =~ "(.*[pP][aA@][sS$][sS$][wW][oO0][rR][dD].*)" MATCH p=(u1:User)-[r:MemberOf*1..]->(m:Group {highvalue:true}) RETURN u1
Description: Users with a variant of "password" in their password and have local admin on at least one computer
Cypher query: match (u1:User) WHERE u1.plaintextpassword =~ "(.*[pP][aA@][sS$][sS$][wW][oO0][rR][dD].*)" match p=(u1:User)-[r:AdminTo]->(n:Computer) RETURN p
Description: Users with seasons in their password and a path to high value targets (limit to 25 results)
Cypher query: match (u1:User) WHERE u1.plaintextpassword =~ "([Ww]inter.*|[sS]pring.*|[sS]ummer.*|[fF]all.*)" MATCH p=shortestPath((u1:User)-[*1..]->(n {highvalue:true})) WHERE u1<>n return u1 LIMIT 25
Description: Users with seasons in their password and are high value targets
Cypher query: MATCH (u1:User) WHERE u1.plaintextpassword =~ "([Ww]inter.*|[sS]pring.*|[sS]ummer.*|[fF]all.*)" MATCH p=(u1:User)-[r:MemberOf*1..]->(m:Group {highvalue:true}) RETURN u1
Description: Users with seasons in their password and have local admin on at least one computer
Cypher query: match (u1:User) WHERE u1.plaintextpassword =~ "([Ww]inter.*|[sS]pring.*|[sS]ummer.*|[fF]all.*)" match p=(u1:User)-[r:AdminTo]->(n:Computer) RETURN p
Description: Route all group memberships of owned + enabled users
Cypher query: MATCH p=(u:User {owned:true, enabled:true, domain: $result})-[:MemberOf*1..]->(g:Group) RETURN p
Description: Route all sessions of owned users to computers
Cypher query: MATCH p=(u:User {owned:true, domain: $result})<-[r:HasSession]-(c:Computer) RETURN p ORDER BY c.name
Description: Route owned‑user sessions to computers without LAPS
Cypher query: MATCH p=(u:User {owned:true, domain: $result})<-[r:HasSession]-(c:Computer {haslaps:false}) RETURN p ORDER BY c.name
Description: Route owned + enabled users to non‑privileged groups
Cypher query: MATCH p=(u:User {owned:true, enabled:true, domain: $result})-[:MemberOf*1..]->(g:Group {admincount:false}) RETURN p
Description: Route owned + enabled users to privileged groups
Cypher query: MATCH p=(u:User {owned:true, enabled:true, domain: $result})-[:MemberOf*1..]->(g:Group {admincount:true}) RETURN p
Description: Route principals that control Azure Apps (AzApp → AzSP → tenancy)
Cypher query: MATCH (a) WHERE (a:User OR a:AZUser) WITH a MATCH p=(a)-[:MemberOf|AZOwns|AZAppAdmin*1..]->(azapp:AZApp) OPTIONAL MATCH p2=(azapp)-[:AZRunsAs]->(azsp:AZServicePrincipal) OPTIONAL MATCH p3=(azsp)-[:MemberOf|AZGlobalAdmin|AZPrivilegedRoleAdmin*1..]->(azt:AZTenant) RETURN p, p2, p3
Description: Route top non-privileged users with dangerous permissions to their targets
Cypher query: MATCH (u:User {enabled: true, admincount: false, domain: $result})-[r]->(a) WITH u, COUNT(DISTINCT type(r)) AS permissions ORDER BY permissions DESC LIMIT 10 MATCH p=allshortestpaths((u)-[r]->(a)) WHERE NOT u = a RETURN p
Description: Routes from owned principals to high‑value targets
Cypher query: MATCH p=allShortestPaths((o {owned:true, enabled:true, domain: $result})-[*]->(a {highvalue: true})) WHERE NOT o = a RETURN p
Description: Routes from owned + enabled users to principals with Unconstrained Delegation
Cypher query: MATCH p=allshortestpaths((o:User {owned:true, enabled:true, domain: $result})-[*]->(a {unconstraineddelegation: true, enabled: true})) WHERE NOT o = a RETURN p
Description: Search for key words in users title such as scientist or Executive - tweak as required
Cypher query: MATCH p = (d:Domain)-[r:Contains*1..]->(u:User) WHERE u.title =~ '(?i).*scientist*' AND u.enabled = true RETURN p
Description: Shortest path from Domain Users to High‑Value targets
Cypher query: MATCH (g:Group),(n {highvalue:true}), p = shortestPath((g)-[r*1..]->(n)) WHERE g.name STARTS WITH 'DOMAIN USERS' RETURN p
Description: Shortest paths from Azure users with dangerous rights to other principals
Cypher query: MATCH (a) WHERE (a:User OR a:AZUser) WITH a MATCH p=allShortestPaths((u:AZUser)-[*]->(a)) WHERE NOT a=u RETURN p
Description: Shortest paths from owned objects to High Value Targets (5 hops)
Cypher query: MATCH p=shortestPath((n {owned:true})-[:MemberOf|HasSession|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|CanRDP|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GpLink|AddAllowedToAct|AllowedToAct|SQLAdmin|ReadGMSAPassword|HasSIDHistory|CanPSRemote*1..5]->(m {highvalue:true})) WHERE NOT n=m RETURN p
Description: Shortest paths from owned principals to unconstrained delegation systems
Cypher query: MATCH (n {owned:true}) MATCH p=shortestPath((n)-[:MemberOf|HasSession|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GpLink|AddAllowedToAct|AllowedToAct|SQLAdmin|ReadGMSAPassword|HasSIDHistory|CanPSRemote*1..]->(m:Computer {unconstraineddelegation: true})) WHERE NOT n=m RETURN p
Description: Shortest paths from owned + enabled users with dangerous rights to any node
Cypher query: MATCH p=allshortestpaths((u:User {owned:true, enabled:true, domain: $result})-[:MemberOf|Owns|WriteDacl|GenericAll|WriteOwner|ExecuteDCOM|AllowedToDelegate|ForceChangePassword|AdminTo*1..]->(a)) WHERE NOT a = u RETURN p
Description: Shortest paths from users to Azure service principals and on to other principals
Cypher query: MATCH (a) WHERE (a:User OR a:AZUser) WITH a MATCH p=allShortestPaths((a)-[*]->(azsp:AZServicePrincipal)-[*]->(b)) WHERE NOT a=b RETURN p
Description: Shortest paths to Azure VMs
Cypher query: MATCH p=allshortestpaths((a)-[*]->(vm:AZVM)) WHERE NOT a=vm RETURN p
Description: Shortest Paths to Enrollment Agent Templates from Owned Principals (ESC3)
Cypher query: MATCH p=allShortestPaths((g {owned:true})-[*1..]->(n:GPO)) WHERE g<>n and n.type = 'Certificate Template' and n.`Enabled` = true and (n.`Extended Key Usage` = [] or 'Any Purpose' IN n.`Extended Key Usage` or 'Certificate Request Agent' IN n.`Extended Key Usage`) return p
Description: Shortest Paths to Misconfigured Certificate Templates from Owned Principals (ESC1)
Cypher query: MATCH p=allShortestPaths((g {owned:true})-[*1..]->(n:GPO)) WHERE g<>n and n.type = 'Certificate Template' and n.`Enrollee Supplies Subject` = true and n.`Client Authentication` = true and n.`Enabled` = true return p
Description: Shortest Paths to Misconfigured Certificate Templates from Owned Principals (ESC2)
Cypher query: MATCH p=allShortestPaths((g {owned:true})-[*1..]->(n:GPO)) WHERE g<>n and n.type = 'Certificate Template' and n.`Enabled` = true and (n.`Extended Key Usage` = [] or 'Any Purpose' IN n.`Extended Key Usage`) return p
Description: Shortest paths to principals with Global Administrator rights
Cypher query: MATCH p=(ga)-[:AZGlobalAdmin|AZPrivilegedAdminRole*1..]->(:AZTenant) WHERE (ga:User OR ga:AZUser) WITH ga MATCH p=allshortestpaths((a)-[*]->(ga)) WHERE NOT a=ga RETURN p
Description: Shortest Paths to Vulnerable Certificate Authority Access Control (ESC7)
Cypher query: MATCH p=shortestPath((g)-[r:GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ManageCa|ManageCertificates*1..]->(n:GPO)) WHERE g<>n and n.type = 'Enrollment Service' RETURN p
Description: Shortest Paths to Vulnerable Certificate Authority Access Control from Owned Principals (ESC7)
Cypher query: MATCH p=allShortestPaths((g {owned:true})-[*1..]->(n:GPO)) WHERE g<>n and n.type = 'Enrollment Service' and NONE(x in relationships(p) WHERE type(x) = 'Enroll' or type(x) = 'AutoEnroll') RETURN p
Description: Shortest Paths to Vulnerable Certificate Template Access Control (ESC4)
Cypher query: MATCH p=shortestPath((g)-[:GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner*1..]->(n:GPO)) WHERE g<>n and n.type = 'Certificate Template' and n.`Enabled` = true RETURN p
Description: Shortest Paths to Vulnerable Certificate Template Access Control from Owned Principals (ESC4)
Cypher query: MATCH p=allShortestPaths((g {owned:true})-[r*1..]->(n:GPO)) WHERE g<>n and n.type = 'Certificate Template' and n.Enabled = true and NONE(x in relationships(p) WHERE type(x) = 'Enroll' or type(x) = 'AutoEnroll') return p
Description: Shortest paths: owned + enabled users with dangerous rights → groups
Cypher query: MATCH p=allshortestpaths((u:User {owned:true, enabled:true, domain: $result})-[:MemberOf|Owns|WriteDacl|GenericAll|WriteOwner|ExecuteDCOM|AllowedToDelegate|ForceChangePassword|AdminTo*1..]->(:Group)) RETURN p
Description: Shortest paths: owned + enabled users with dangerous rights → other users
Cypher query: MATCH p=allshortestpaths((o:User {owned:true, enabled:true, domain: $result})-[:MemberOf|Owns|WriteDacl|GenericAll|WriteOwner|ExecuteDCOM|AllowedToDelegate|ForceChangePassword|AdminTo*1..]->(u:User)) WHERE NOT o = u RETURN p
Description: Enabled Azure users and their Azure-group memberships
Cypher query: MATCH p=(azu:AZUser {enabled:true})-[:MemberOf*1..]->(azg:AZGroup) RETURN p
Description: Enrollment rights for a selected Certificate Template
Cypher query: MATCH p=(g)-[:Enroll|AutoEnroll]->(n:GPO {name:$result, type:'Certificate Template'}) RETURN p
Description: Privileges for a selected Certificate Authority
Cypher query: MATCH p=(g)-[:ManageCa|ManageCertificates|Auditor|Operator|Read|Enroll]->(n:GPO {name:$result}) RETURN p
Description: Rights for Certificate Authority
Cypher query: MATCH p=(g)-[:ManageCa|ManageCertificates|Auditor|Operator|Read|Enroll]->(n:GPO) WHERE n.type = 'Enrollment Service' return p
Description: Top-10 users with cross-domain sessions (requires sessions)
Cypher query: MATCH p=(g1:Group)<-[:MemberOf*1..]-(u:User {enabled:true, domain: $result})<-[r:HasSession]-(c:Computer) WHERE NOT u.domain = c.domain WITH u, count(r) AS rel_count ORDER BY rel_count DESC LIMIT 10 MATCH p=(c:Computer)-[r:HasSession]->(u) WHERE NOT u.domain = c.domain RETURN p ORDER BY c.name
Description: Top-10 users with most Local Admin rights (in a chosen domain)
Cypher query: MATCH (n:User {domain: $result}),(m:Computer), (n)-[r:AdminTo]->(m) WHERE NOT n.name STARTS WITH 'ANONYMOUS LOGON' AND NOT n.name='' WITH n, count(r) AS rel_count ORDER BY rel_count DESC LIMIT 10 MATCH p=(m)<-[r:AdminTo]-(n) RETURN p
Description: Top-10 users with most Sessions (requires collected sessions)
Cypher query: MATCH (n:User {domain: $result}),(m:Computer), (n)<-[r:HasSession]-(m) WHERE NOT n.name STARTS WITH 'ANONYMOUS LOGON' AND NOT n.name='' WITH n, count(r) AS rel_count ORDER BY rel_count DESC LIMIT 10 MATCH p=(m)-[r:HasSession]->(n) RETURN p
Description: Top Ten Computers with the most local‑admin principals
Cypher query: MATCH (n:User),(m:Computer),(n)-[r:AdminTo]->(m) WHERE NOT n.name STARTS WITH 'ANONYMOUS LOGON' AND NOT n.name='' WITH m, COUNT(r) AS rel_count ORDER BY rel_count DESC LIMIT 10 MATCH p=(m)<-[r:AdminTo]-(n) RETURN p
Description: Unconstrained Delegation systems
Cypher query: MATCH (c {unconstraineddelegation:true}) return c
Description: Unconstrained Delegation systems (without domain controllers)
Cypher query: MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH COLLECT(c1.name) AS domainControllers MATCH (c2 {unconstraineddelegation:true}) WHERE NOT c2.name IN domainControllers RETURN c2
Description: Users never logged on and account still active
Cypher query: MATCH (n:User) WHERE n.lastlogontimestamp=-1.0 AND n.enabled=true RETURN n
Description: Users with adminCount, not sensitive for delegation, not members of Protected Users
Cypher query: MATCH (u)-[:MemberOf*1..]->(g:Group) WHERE g.objectid =~ "(?i)S-1-5-.*-525" WITH COLLECT (u.name) as protectedUsers MATCH p=(u2:User)-[:MemberOf*1..3]->(g2:Group) WHERE u2.admincount=true AND u2.sensitive=false AND NOT u2.name IN protectedUsers RETURN p
Description: Users with most local admin rights
Cypher query: MATCH (U:User)-[r:MemberOf|AdminTo*1..]->(C:Computer) WITH U.name as n, COUNT(DISTINCT(C)) AS c RETURN n,c ORDER BY c DESC LIMIT 5
Description: View all Group Policy Objects (GPOs)
Cypher query: MATCH (n:GPO) RETURN n
Description: View all groups that contain the word 'admin'
Cypher query: MATCH (n:Group) WHERE n.name CONTAINS 'ADMIN' RETURN n
Description: Where can owned users RDP
Cypher query: MATCH p=(m:User {owned: true})-[r:MemberOf|CanRDP*1..]->(n:Computer) RETURN p
Description: All Computers in Domain Admins group
Cypher query: MATCH p = (c:Computer)-[:MemberOf]->(g:Group) WHERE toUpper(g.name) STARTS WITH 'DOMAIN ADMINS' OR g.objectid ENDS WITH '-512' RETURN p
Description: All Computers that are local administrators to another computer
Cypher query: MATCH p = (c1:Computer)-[:AdminTo]->(c2:Computer) RETURN p
Description: Domains with Machine Account Quota > 0
Cypher query: MATCH (d:Domain) WHERE toInteger(d.machineaccountquota) > 0 RETURN d
Description: Interesting objects by sensitive keywords in name / description
Cypher query: UNWIND ['admin','empfindlich','geheim','important','azure','MSOL','kennwort','pass','secret','sensib','sensitiv','wichtig','backdoor','honey'] AS word MATCH p = (:Domain)-[:Contains*1..]->(b:Base) WHERE toLower(b.name) CONTAINS toLower(word) OR toLower(b.description) CONTAINS toLower(word) RETURN p
Description: Users with clear‑text password attributes (userpassword / unixpassword / sfupassword / unicodepassword)
Cypher query: MATCH p = (:Domain)-[:Contains*1..]->(u:User) WHERE u.userpassword <> '' OR u.unixpassword <> '' OR u.sfupassword <> '' OR u.unicodepassword <> '' RETURN p
Description: Users whose passwords are stored with reversible encryption
Cypher query: MATCH p = (:Domain)-[:Contains*1..]->(:Base {encryptedtextpwdallowed: true}) RETURN p
Description: Users with the same sAMAccountName in different domains
Cypher query: MATCH p = (:Domain)-[:Contains*1..]->(u1:User),(u2:User) WHERE u1.samaccountname = u2.samaccountname AND u1.domain <> u2.domain RETURN p