BloodHound Custom Cypher Query Cheat Sheet

// Shortest path from owned user to Domain Admins
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
RETURN p

// All paths from owned nodes to DA (longer, more thorough)
MATCH p=allShortestPaths((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
RETURN p

// All Kerberoastable users
MATCH (u:User {hasspn:true}) RETURN u.name, u.description

// Kerberoastable users who are Domain Admins
MATCH (u:User {hasspn:true})-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
RETURN u.name

// High-value Kerberoastable accounts (admincount=true)
MATCH (u:User {hasspn:true, admincount:true}) RETURN u.name

// All accounts without Kerberos pre-auth
MATCH (u:User {dontreqpreauth:true}) RETURN u.name, u.description

// AS-REP roastable users with paths to DA
MATCH p=shortestPath(
  (u:User {dontreqpreauth:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
) RETURN p

// Find objects with WriteDACL on the domain
MATCH (n)-[:WriteDACL]->(d:Domain) RETURN n.name, labels(n)

// GenericAll on privileged accounts
MATCH (u)-[:GenericAll]->(v:User {admincount:true})
RETURN u.name, v.name

// All principals with DCSync rights
MATCH p=(n)-[:DCSync|AllExtendedRights|GenericAll*1..]->(d:Domain)
RETURN p

// Mark a user as owned
MATCH (u:User {name:"SVC-ALFRESCO@HTB.LOCAL"}) SET u.owned=true

// What can owned users reach?
MATCH p=(u:User {owned:true})-[r:MemberOf|AdminTo|HasSession|AllowedToDelegate*1..5]->(n)
RETURN p LIMIT 100

// Sessions of owned users on computers
MATCH p=(u:User {owned:true})-[:HasSession]->(c:Computer)
RETURN p

// Unconstrained delegation (except DCs)
MATCH (c:Computer {unconstraineddelegation:true})
WHERE NOT c.name STARTS WITH "DC"
RETURN c.name

// Constrained delegation targets
MATCH (n)-[:AllowedToDelegate]->(c:Computer)
RETURN n.name, c.name

// Resource-based constrained delegation
MATCH (n)-[:AllowedToAct]->(c:Computer)
RETURN n.name, c.name

// All admincount=true accounts (approx. tier 0)
MATCH (n {admincount:true}) RETURN n.name, labels(n)

// Direct admin rights on DCs
MATCH p=(u:User)-[:AdminTo]->(c:Computer {name:$dc_name})
RETURN p

// Foreign group members (cross-domain)
MATCH (u:User)-[:MemberOf]->(g:Group)
WHERE u.domain <> g.domain RETURN u.name, g.name

// Local admins on servers (excluding DCs)
MATCH p=(u:User)-[:AdminTo]->(c:Computer)
WHERE NOT c.name STARTS WITH "DC"
RETURN p LIMIT 50