BloodHound Cypher Cheatsheet | hausec

• Users with SPNs

MATCH (u:User {hasspn:true}) RETURN u

• AS-REP Roastable users

MATCH (u:User {dontrepreauth:true}) RETURN u

• Computers AllowedToDelegate to other computers

MATCH (c:Computer), (t:Computer), p=((c)-[:AllowedToDelegate]->(t)) return p

• Computers in Unconstrained Delegations

MATCH (c:Computer {unconstraineddelegation:true}) return c

• Shortest path from Kerberoastable user

MATCH (u:User {hasspn:true}), (c:Computer), p=shortestPath((u)-[*1..]->(c)) RETURN p

• Rights against GPOs

MATCH (gr:Group), (gp:GPO), p=((gr)-[:GenericWrite]->(gp)) return p

• Potential SQL Admins