ᛉ Yggdrasil

Active Directory

BloodHound Cypher Queries

15 Sep 2026 · 3,074 words · 14 min

Contents

Legend: [ENUM] = Enumeration/Reconnaissance query | [ATTACK] = Attack path identification | [PRIVESC] = Privilege escalation chains | [LATERAL] = Lateral movement paths | [MAINT] = Persistence/Maintenance | [CUSTOM] = Custom query for specific scenarios

1. Cypher Query Fundamentals

Quick Syntax Primer

# Basic node matching
MATCH (u:User) RETURN u

# Relationship traversal
MATCH (u:User)-[r:MemberOf]->(g:Group) RETURN u, r, g

# With conditions
MATCH (u:User) WHERE u.name CONTAINS 'admin' RETURN u

# Multi-hop paths
MATCH p=(u:User)-[*1..3]->(c:Computer) RETURN p

# Counting results
MATCH (u:User) RETURN count(u)

# Collecting into lists
MATCH (g:Group)<-[r:MemberOf]-(u:User) 
WITH g, collect(u.name) as members 
RETURN g.name, members

# Union (combine query results)
MATCH (u:User {admincount: true}) RETURN u.name as name, 'High Priv User' as type
UNION
MATCH (c:Computer) WHERE c.enabled = true RETURN c.name as name, 'Active Computer' as type

Node Types in BloodHound

  • User - User accounts
  • Computer - Computer/machine objects
  • Group - Security groups
  • Domain - Domain object
  • OU - Organizational Unit
  • GPO - Group Policy Object
  • AZUser - Azure AD User
  • CertTemplate - Certificate template

Relationship Types (Edge Labels)

  • MemberOf - User/Computer is member of group
  • HasSession - User has session on computer
  • AdminTo - Local admin on computer
  • CanRDP, CanPSRemote - Remote access
  • GenericAll, GenericWrite, WriteDACL - ACL rights
  • AddMember - Can add to group
  • ForceChangePassword, ReadLAPSPassword - Account rights
  • GetChanges, GetChangesAll - DCSync rights
  • TrustedBy - Domain trust
  • Enroll - Certificate enrollment
  • GPLink - GPO linked to OU

2. User Enumeration & Analysis

2.1 Find All Users [ENUM]

MATCH (u:User) 
RETURN u.name, u.domain, u.enabled, u.pwdneverexpires, u.admincount
ORDER BY u.domain, u.name

2.2 Find Active Users (Enabled) [ENUM]

MATCH (u:User {enabled: true}) 
RETURN u.name, u.domain, u.lastlogontimestamp
ORDER BY u.lastlogontimestamp DESC

2.3 Find Disabled Users [ENUM]

MATCH (u:User {enabled: false}) 
RETURN u.name, u.domain, u.description

2.4 Find Users with Password Never Expires [ENUM]

MATCH (u:User {pwdneverexpires: true, enabled: true}) 
RETURN u.name, u.domain, u.admincount
ORDER BY u.admincount DESC

2.5 Find Service Accounts (SPN Present) [ENUM]

MATCH (u:User) 
WHERE u.hasspn = true 
RETURN u.name, u.serviceprincipalnames, u.domain, u.enabled
ORDER BY u.name

2.6 Find Admin Count Users (High Privilege) [ENUM]

MATCH (u:User {admincount: true}) 
RETURN u.name, u.domain, u.enabled
ORDER BY u.name

2.7 Find Users with Admin Privileges [PRIVESC]

MATCH (u:User)-[r:AdminTo]->(c:Computer) 
RETURN u.name, count(c) as num_admin_computers, collect(c.name) as computers
GROUP BY u.name
ORDER BY num_admin_computers DESC
LIMIT 20

2.8 Find Users Who Logged In to Multiple Computers [ENUM]

MATCH (u:User)-[r:HasSession]->(c:Computer) 
RETURN u.name, count(c) as num_sessions, collect(c.name) as computers
GROUP BY u.name
ORDER BY num_sessions DESC

2.9 Find Users Never Logged In (Honeypot Detection) [ENUM]

MATCH (u:User {enabled: true}) 
WHERE NOT (u)-[:HasSession]->(:Computer)
RETURN u.name, u.domain
ORDER BY u.name

2.10 Find Users in Sensitive Groups [ENUM]

MATCH (u:User)-[r:MemberOf]->(g:Group) 
WHERE g.name IN ['DOMAIN ADMINS@DOMAIN.LOCAL', 'ENTERPRISE ADMINS@DOMAIN.LOCAL', 
                  'SCHEMA ADMINS@DOMAIN.LOCAL']
RETURN u.name, u.domain, g.name
ORDER BY g.name, u.name

2.11 Find Service Accounts Kerberoastable [ATTACK]

MATCH (u:User {hasspn: true, enabled: true}) 
RETURN u.name, u.serviceprincipalnames, u.domain
ORDER BY u.name

2.12 Find Users with Multiple ACL Rights [PRIVESC]

MATCH (u:User)-[r:GenericAll|GenericWrite|WriteDACL|AddMember]->()
WITH u, count(r) as num_acls
WHERE num_acls >= 2
RETURN u.name, u.domain, num_acls
ORDER BY num_acls DESC

3. Computer/Host Enumeration

3.1 Find All Computers [ENUM]

MATCH (c:Computer) 
RETURN c.name, c.domain, c.enabled, c.operatingsystem
ORDER BY c.domain, c.name

3.2 Find Enabled Computers [ENUM]

MATCH (c:Computer {enabled: true}) 
RETURN c.name, c.operatingsystem, c.domain
ORDER BY c.domain, c.name

3.3 Find Domain Controllers [ENUM]

MATCH (c:Computer)-[:DCFor]->(d:Domain) 
RETURN c.name, c.domain, c.operatingsystem

3.4 Find Computers with LAPS Enabled [ENUM]

MATCH (c:Computer {haslaps: true}) 
RETURN c.name, c.domain, c.enabled
ORDER BY c.name

3.5 Find Computers Allowing Unconstrained Delegation [ATTACK]

MATCH (c:Computer {unconstraineddelegation: true}) 
RETURN c.name, c.domain, c.operatingsystem
ORDER BY c.name

3.6 Find Computers with Most Local Admins [ENUM]

MATCH (u:User)-[r:AdminTo]->(c:Computer) 
RETURN c.name, count(u) as num_admins, collect(u.name) as admin_users
GROUP BY c.name
ORDER BY num_admins DESC
LIMIT 20

3.7 Find Computers with Active User Sessions [ENUM]

MATCH (u:User)-[r:HasSession]->(c:Computer) 
RETURN c.name, count(u) as num_sessions, collect(u.name) as users_logged_in
GROUP BY c.name
ORDER BY num_sessions DESC

3.8 Find Vulnerable Windows Versions [ENUM]

MATCH (c:Computer {enabled: true}) 
WHERE c.operatingsystem CONTAINS 'Windows 7'
  OR c.operatingsystem CONTAINS 'Server 2003'
RETURN c.name, c.operatingsystem, c.domain
ORDER BY c.operatingsystem

3.9 Find Computers Accessible via RDP [LATERAL]

MATCH (u:User)-[r:CanRDP]->(c:Computer {enabled: true}) 
RETURN c.name, count(u) as num_rdp_users, collect(u.name) as rdp_users
GROUP BY c.name
ORDER BY num_rdp_users DESC

3.10 Find High-Value Targets (Multiple Admins) [ATTACK]

MATCH (u:User)-[r:AdminTo]->(c:Computer {enabled: true}) 
WITH c, count(u) as admin_count, collect(u.name) as admins
WHERE admin_count >= 3
RETURN c.name, admin_count, admins
ORDER BY admin_count DESC

4. Group & Membership Analysis

4.1 Find All Groups [ENUM]

MATCH (g:Group) 
RETURN g.name, g.domain, g.scope, size((g)<-[:MemberOf]-(:User)) as num_users
ORDER BY g.domain, g.name

4.2 Find Groups with Most Members [ENUM]

MATCH (g:Group)<-[r:MemberOf]-(u:User) 
RETURN g.name, count(u) as num_members, collect(u.name) as members
GROUP BY g.name
ORDER BY num_members DESC
LIMIT 20

4.3 Find Group Nesting (Groups in Groups) [ENUM]

MATCH (parent:Group)<-[r:MemberOf]-(child:Group) 
RETURN parent.name, child.name, child.domain
ORDER BY parent.name, child.name

4.4 Find Computers in Domain Computers Group [ENUM]

MATCH (c:Computer)-[:MemberOf]->(g:Group {name: 'DOMAIN COMPUTERS@DOMAIN.LOCAL'})
RETURN c.name, c.domain, c.operatingsystem
ORDER BY c.name

4.5 Find Admin Groups [ENUM]

MATCH (g:Group)
WHERE g.name CONTAINS 'admin'
RETURN g.name, g.domain, size((g)<-[:MemberOf]-(:User)) as num_members
ORDER BY num_members DESC

4.6 Find Users in Specific Admin Group [ENUM]

MATCH (u:User)-[:MemberOf]->(g:Group {name: 'DOMAIN ADMINS@DOMAIN.LOCAL'})
RETURN u.name, u.domain, u.enabled

4.7 Find Service Groups [ENUM]

MATCH (g:Group)
WHERE g.name CONTAINS 'svc' OR g.name CONTAINS 'service'
RETURN g.name, g.domain, size((g)<-[:MemberOf]-(:User)) as num_members
ORDER BY g.name

4.8 Find Users with Multiple High-Priv Group Memberships [PRIVESC]

MATCH (u:User)-[:MemberOf]->(g:Group)
WHERE g.name IN ['DOMAIN ADMINS@DOMAIN.LOCAL', 'ENTERPRISE ADMINS@DOMAIN.LOCAL',
                  'SCHEMA ADMINS@DOMAIN.LOCAL']
WITH u, collect(g.name) as groups
WHERE size(groups) > 1
RETURN u.name, groups, u.domain
ORDER BY u.name

5. ACL Abuse Queries

5.1 Find All ACL Relationships [ENUM]

MATCH (n:User|Computer|Group|Domain|GPO|OU)-[r:AllExtendedRights|GenericAll|GenericWrite|
  WriteDACL|WriteOwner|AddMember|ForceChangePassword|ReadLAPSPassword|GetChanges|GetChangesAll]->(m)
RETURN n.name as principal, type(r) as permission, m.name as target
ORDER BY principal, permission, target

5.2 Find GenericAll Rights [ATTACK]

MATCH (n:User|Computer|Group)-[r:GenericAll]->(m:User|Computer|Group|Domain)
RETURN n.name as principal, m.name as target, labels(m)[0] as target_type
ORDER BY n.name

5.3 Find GenericWrite Rights [ATTACK]

MATCH (n:User|Computer|Group)-[r:GenericWrite]->(m:User|Computer|Group)
RETURN n.name as principal, m.name as target, labels(m)[0] as target_type
ORDER BY n.name

5.4 Find WriteDACL on Domain [PRIVESC]

MATCH (n:User|Computer|Group)-[r:WriteDACL]->(d:Domain)
RETURN n.name as principal, d.name as domain
ORDER BY n.name

5.5 Find AddMember Rights [ATTACK]

MATCH (n:User|Computer)-[r:AddMember]->(g:Group)
RETURN n.name as principal, g.name as target_group
ORDER BY n.name

5.6 Find ForceChangePassword Rights [ATTACK]

MATCH (n:User|Computer)-[r:ForceChangePassword]->(u:User)
RETURN n.name as principal, u.name as target_user, u.domain
ORDER BY n.name

5.7 Find ReadLAPSPassword Rights [ATTACK]

MATCH (n:User|Computer)-[r:ReadLAPSPassword]->(c:Computer)
RETURN n.name as principal, c.name as target_computer
ORDER BY n.name

5.8 Find DCSync Rights [PRIVESC]

MATCH (n:User|Computer)-[r:GetChanges|GetChangesAll]->(d:Domain)
RETURN n.name as principal, type(r) as dcsync_right
ORDER BY n.name

5.9 Find Shadow Credentials Rights [ATTACK]

MATCH (n:User|Computer)-[r:AddKeyCredentialLink]->(m:User|Computer)
RETURN n.name as principal, m.name as target
ORDER BY n.name

5.10 Find ACL Rights on Specific User [ATTACK]

MATCH (n)-[r:GenericAll|GenericWrite|WriteDACL|AddMember|ForceChangePassword]->(u:User {name: 'TARGET@DOMAIN.LOCAL'})
RETURN n.name as attacker, type(r) as permission
ORDER BY n.name

5.11 Find AllExtendedRights (Most Dangerous) [PRIVESC]

MATCH (n:User|Computer|Group)-[r:AllExtendedRights]->(m)
RETURN n.name as principal, m.name as target, labels(m)[0] as target_type
ORDER BY n.name

5.12 Find Multiple ACLs per Principal [ATTACK]

MATCH (n:User|Computer|Group)-[r:GenericAll|GenericWrite|WriteDACL]->(m)
WITH n, count(r) as acl_count
WHERE acl_count >= 2
RETURN n.name, acl_count
ORDER BY acl_count DESC

6. Kerberos & Delegation Queries

6.1 Find All Kerberoastable Users [ATTACK]

MATCH (u:User {hasspn: true, enabled: true})
RETURN u.name, u.serviceprincipalnames, u.domain
ORDER BY u.name

6.2 Find Accounts with Unconstrained Delegation [ATTACK]

MATCH (c:Computer {unconstraineddelegation: true, enabled: true})
RETURN c.name, c.domain
ORDER BY c.name

6.3 Find Constrained Delegation Rights [ATTACK]

MATCH (u:User)-[r:AllowedToDelegate]->(target)
RETURN u.name, target.name
ORDER BY u.name

6.4 Find Accounts with Trusted-To-Auth-For-Delegation [ATTACK]

MATCH (u:User {trustedtoauth: true, enabled: true})
RETURN u.name, u.domain
ORDER BY u.name

6.5 Find S4U2Self Vulnerable (Unconstrained+SPN) [ATTACK]

MATCH (u:User {trustedtoauth: true, enabled: true, hasspn: true})
RETURN u.name, u.domain
ORDER BY u.name

6.6 Find ASREP-Roastable Users [ATTACK]

MATCH (u:User {dontreqpreauth: true, enabled: true})
RETURN u.name, u.domain
ORDER BY u.name

6.7 Find Service Accounts with Delegation [ATTACK]

MATCH (u:User {hasspn: true, enabled: true})
WHERE u.unconstraineddelegation = true OR u.trustedtoauth = true
RETURN u.name, u.domain
ORDER BY u.name

6.8 Find Kerberoastable Domain Admins [ATTACK]

MATCH (u:User {hasspn: true, enabled: true})-[:MemberOf]->
  (g:Group {name: 'DOMAIN ADMINS@DOMAIN.LOCAL'})
RETURN u.name, u.serviceprincipalnames
ORDER BY u.name

7. Certificate Services (ADCS) Queries

7.1 Find Certificate Templates [ENUM]

MATCH (ct:CertTemplate)
RETURN ct.name, ct.domain, ct.published
ORDER BY ct.name

7.2 Find Users Able to Enroll [ENUM]

MATCH (u:User)-[r:Enroll]->(ct:CertTemplate)
RETURN u.name, ct.name
ORDER BY u.name

7.3 Find Vulnerable ESC1 Templates [ATTACK]

MATCH (ct:CertTemplate)
WHERE ct.requiresmanagerapproval = false
RETURN ct.name, ct.domain
ORDER BY ct.name

7.4 Find High-Risk Templates [ATTACK]

MATCH (ct:CertTemplate)
WHERE ct.requiresmanagerapproval = false
WITH ct, size((ct)<-[:Enroll]-(:User)) as num_users
RETURN ct.name, num_users
ORDER BY num_users DESC

8. Trust & Domain Queries

8.1 Find Domain Trusts [ENUM]

MATCH (d1:Domain)-[r:TrustedBy]->(d2:Domain)
RETURN d1.name as trusting_domain, r.trusttype as trust_type, d2.name as trusted_domain
ORDER BY d1.name

8.2 Find External Trusts [ENUM]

MATCH (d1:Domain)-[r:TrustedBy]->(d2:Domain)
WHERE r.trusttype = 'External'
RETURN d1.name, d2.name

8.3 Find Transitive Trusts [ENUM]

MATCH (d1:Domain)-[r:TrustedBy]->(d2:Domain)
WHERE r.transitive = true
RETURN d1.name, d2.name

8.4 Find Trust Paths [ENUM]

MATCH p=(d1:Domain {name: 'DOMAIN1.LOCAL'})-[*1..5]-(d2:Domain {name: 'DOMAIN2.LOCAL'})
RETURN p

9. GPO & Container Queries

9.1 Find All GPOs [ENUM]

MATCH (g:GPO)
RETURN g.name, g.domain
ORDER BY g.name

9.2 Find GPOs Linked to OUs [ENUM]

MATCH (g:GPO)-[r:GPLink]->(ou:OU)
RETURN g.name, ou.name
ORDER BY g.name

9.3 Find Computers Affected by GPO [ENUM]

MATCH (c:Computer)-[r:AffectedByGPO]->(g:GPO)
RETURN c.name, g.name
ORDER BY c.name
LIMIT 30

9.4 Find GPOs with Write Access [ATTACK]

MATCH (n:User|Computer|Group)-[r:GenericAll|GenericWrite|WriteDACL]->(g:GPO)
RETURN n.name as principal, g.name as gpo
ORDER BY n.name

9.5 Find High-Impact GPOs [ATTACK]

MATCH (c:Computer)-[r:AffectedByGPO]->(g:GPO)
WITH g, count(c) as num_computers
WHERE num_computers >= 5
RETURN g.name, num_computers
ORDER BY num_computers DESC

10. Attack Path & Exploitation Queries

10.1 Shortest Path to Domain Admin [PRIVESC]

MATCH p=shortestPath((u:User {name: 'ATTACKER@DOMAIN.LOCAL'})-[*1..15]->
  (g:Group {name: 'DOMAIN ADMINS@DOMAIN.LOCAL'}))
RETURN p

10.2 All Paths to Domain Admin [PRIVESC]

MATCH p=(u:User {name: 'ATTACKER@DOMAIN.LOCAL'})-[*1..5]->
  (g:Group {name: 'DOMAIN ADMINS@DOMAIN.LOCAL'})
RETURN p
LIMIT 10

10.3 Find Derivative Local Admin [PRIVESC]

MATCH (u:User)-[:MemberOf]->(g:Group)-[:AdminTo]->(c:Computer)
RETURN u.name, g.name, c.name
ORDER BY u.name

10.4 Find Kerberoastable Admins to Computers [ATTACK]

MATCH (u:User {hasspn: true, enabled: true})-[:AdminTo]->(c:Computer {enabled: true})
RETURN u.name, count(c) as num_admin_computers
ORDER BY num_admin_computers DESC

10.5 Find ACL Chains to Domain [PRIVESC]

MATCH p=shortestPath((u:User)-[*1..10]->(d:Domain))
WHERE all(rel in relationships(p) WHERE type(rel) IN 
  ['GenericAll', 'GenericWrite', 'WriteDACL', 'MemberOf', 'AddMember'])
RETURN p
LIMIT 5

10.6 Find Session to Admin Computer [LATERAL]

MATCH (u:User)-[:HasSession]->(c:Computer {enabled: true})
MATCH (admin:User)-[:AdminTo]->(c)
RETURN u.name as session_user, admin.name as admin_user, c.name as computer
LIMIT 20

10.7 Find Multi-Hop ACL Abuse [PRIVESC]

MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDACL]->
  (intermediary:User|Computer|Group)-[:GenericAll|GenericWrite|WriteDACL]->
  (target:User|Computer|Domain)
RETURN p
LIMIT 10

10.8 Find Users with Multiple High-Value Accesses [ATTACK]

MATCH (u:User)-[r:AdminTo|CanRDP|CanPSRemote|HasSession]->(c:Computer)
WHERE c.name CONTAINS 'DC' OR c.name CONTAINS 'ADMIN'
WITH u, count(c) as num_high_value
WHERE num_high_value >= 2
RETURN u.name, num_high_value
ORDER BY num_high_value DESC

10.9 Find Compromisable High-Value Targets [ATTACK]

MATCH (u:User {enabled: true})-[r:AdminTo|HasSession|CanRDP]->
  (c:Computer {enabled: true, name: 'HIGH_VALUE_TARGET'})
RETURN u.name, type(r) as access_type
ORDER BY u.name

10.10 Find DCSync Capable Accounts [PRIVESC]

MATCH (n:User|Computer)-[r:GetChanges|GetChangesAll]->(d:Domain)
WITH n, collect(type(r)) as rights
WHERE all(right in ['GetChanges', 'GetChangesAll'] WHERE right IN rights)
RETURN n.name as principal
ORDER BY n.name

11. Lateral Movement Chains

11.1 Local Admin Lateral Movement [LATERAL]

MATCH (c1:Computer)<-[:AdminTo]-(u:User)-[:AdminTo]->(c2:Computer)
WHERE c1 <> c2
RETURN c1.name as from_computer, u.name as admin, c2.name as to_computer
LIMIT 20

11.2 Session-Based Lateral Movement [LATERAL]

MATCH (u:User)-[:HasSession]->(c:Computer {enabled: true})
RETURN u.name, count(c) as num_sessions
ORDER BY num_sessions DESC
LIMIT 20

11.3 RDP-Based Movement [LATERAL]

MATCH (u:User)-[:CanRDP]->(c:Computer {enabled: true})
RETURN u.name, c.name
ORDER BY u.name
LIMIT 30

11.4 Chained Admin Access [LATERAL]

MATCH (c1:Computer)<-[:AdminTo]-(u1:User)<-[:AdminTo]-(admin:User)
MATCH (admin)-[:AdminTo]->(c2:Computer)
WHERE c1 <> c2
RETURN admin.name, c1.name, c2.name
LIMIT 20

11.5 Session Stealing Path [LATERAL]

MATCH (u:User)-[:HasSession]->(c1:Computer)
MATCH (admin:User)-[:AdminTo]->(c1)
MATCH (admin)-[:AdminTo]->(c2:Computer)
WHERE c1 <> c2
RETURN u.name as compromised, admin.name as pivot, c2.name as lateral_target
LIMIT 20

11.6 Unconstrained Delegation Sessions [LATERAL]

MATCH (c:Computer {unconstraineddelegation: true})-[:HasSession]->(u:User)
RETURN c.name, u.name
LIMIT 20

12. Privilege Escalation Paths

12.1 Shortest Escalation to DA [PRIVESC]

MATCH p=shortestPath((u:User {name: 'CURRENT@DOMAIN.LOCAL'})-[*1..20]->
  (da:Group {name: 'DOMAIN ADMINS@DOMAIN.LOCAL'}))
RETURN p

12.2 Group Nesting Escalation [PRIVESC]

MATCH p=(u:User)-[:MemberOf]->
  (g1:Group)-[:MemberOf]->(g2:Group)-[:MemberOf]->
  (da:Group {name: 'DOMAIN ADMINS@DOMAIN.LOCAL'})
RETURN p

12.3 ACL Chain Escalation [PRIVESC]

MATCH p=(u:User)-[r:GenericAll|GenericWrite|WriteDACL]->
  (target:User|Computer|Group|Domain)
WHERE target:Group OR target:Domain
RETURN p
LIMIT 10

12.4 Local Admin to DA [PRIVESC]

MATCH (u:User)-[:AdminTo]->(c:Computer)
MATCH (da:User)-[:AdminTo]->(c)
MATCH (da)-[:MemberOf]->(g:Group {name: 'DOMAIN ADMINS@DOMAIN.LOCAL'})
RETURN u.name as compromised, c.name as pivot, da.name as admin
LIMIT 10

12.5 Kerberoasting Escalation [PRIVESC]

MATCH (u:User {hasspn: true})-[:MemberOf]->
  (g:Group {name: 'DOMAIN ADMINS@DOMAIN.LOCAL'})
RETURN u.name

12.6 Constrained Delegation Escalation [PRIVESC]

MATCH (u:User {hasspn: true, trustedtoauth: true})-[:AllowedToDelegate]->(target)
RETURN u.name, target.name

12.7 RBCD Escalation [PRIVESC]

MATCH (c:Computer)
WHERE c.allowedtoactnobehalfofotheridentity IS NOT NULL
RETURN c.name, c.allowedtoactnobehalfofotheridentity

12.8 Shadow Credentials Escalation [PRIVESC]

MATCH (attacker:User)-[r:AddKeyCredentialLink]->(victim:User|Computer)
RETURN attacker.name, victim.name

12.9 Certificate Abuse Escalation [PRIVESC]

MATCH (u:User)-[:Enroll]->(ct:CertTemplate)
WHERE ct.requiresmanagerapproval = false
RETURN u.name, ct.name

12.10 Password Reset Escalation [PRIVESC]

MATCH (attacker:User)-[r:ForceChangePassword]->(victim:User)
RETURN attacker.name, victim.name, victim.domain

13. Persistence & Backdoor Queries

13.1 Find WriteDACL on Domain (Persistence) [MAINT]

MATCH (u:User)-[r:WriteDACL]->(d:Domain)
RETURN u.name as backdoor_account, d.name as domain
ORDER BY u.name

13.2 Find DCSync Enabled Accounts [MAINT]

MATCH (u:User)-[r:GetChanges|GetChangesAll]->(d:Domain)
RETURN u.name as persistent_account
ORDER BY u.name

13.3 Find Backdoor Groups [ENUM]

MATCH (g:Group)
WHERE NOT (g)<-[:MemberOf]-(:User)
  AND (g.name CONTAINS 'backup' OR g.name CONTAINS 'temp')
RETURN g.name

13.4 Find Accounts with Password Never Expires [MAINT]

MATCH (u:User {pwdneverexpires: true, enabled: true})
RETURN u.name, u.domain
ORDER BY u.name

13.5 Find High-Priv Persistence Points [MAINT]

MATCH (u:User {admincount: true})-[r:GenericAll|GenericWrite|WriteDACL|GetChanges]->()
WITH u, count(r) as num_vectors
WHERE num_vectors >= 2
RETURN u.name, num_vectors
ORDER BY num_vectors DESC

13.6 Find GPO Persistence Points [MAINT]

MATCH (u:User)-[r:GenericAll|GenericWrite|WriteDACL]->(g:GPO)
RETURN u.name, g.name
ORDER BY u.name

13.7 Find Accounts Able to Reset Others [MAINT]

MATCH (u:User)-[r:ForceChangePassword]->(target:User)
RETURN u.name as admin_account, target.name as victim
ORDER BY u.name

13.8 Find Multiple Persistence Vectors [MAINT]

MATCH (u:User)-[r:GenericAll|GenericWrite|WriteDACL|GetChanges]->()
WITH u, count(r) as num_vectors
WHERE num_vectors >= 1
RETURN u.name, num_vectors
ORDER BY num_vectors DESC

14. Detection & Incident Response Queries

14.1 Find Newly Created Users [DETECT]

MATCH (u:User)
WHERE u.whencreated IS NOT NULL
RETURN u.name, u.domain, u.whencreated, u.enabled
ORDER BY u.whencreated DESC
LIMIT 20

14.2 Find Recently Added Domain Admins [DETECT]

MATCH (u:User)-[:MemberOf]->(g:Group {name: 'DOMAIN ADMINS@DOMAIN.LOCAL'})
RETURN u.name, u.domain, u.whencreated
ORDER BY u.whencreated DESC

14.3 Find Suspicious Local Admins [DETECT]

MATCH (u:User)-[:AdminTo]->(c:Computer)
WHERE NOT (u)-[:MemberOf]->(:Group {name: 'DOMAIN ADMINS@DOMAIN.LOCAL'})
RETURN u.name, c.name
LIMIT 30

14.4 Find Disabled Accounts with Privileges [DETECT]

MATCH (u:User {enabled: false})-[r:AdminTo|GenericAll|WriteDACL]->()
RETURN u.name, u.domain, count(r) as num_rights
ORDER BY num_rights DESC

14.5 Find Over-Privileged Service Accounts [DETECT]

MATCH (u:User {hasspn: true})-[r:GenericAll|GenericWrite|WriteDACL|GetChanges]->()
WITH u, count(r) as num_privileges
WHERE num_privileges >= 1
RETURN u.name, num_privileges
ORDER BY num_privileges DESC

14.6 Find Accounts with Multiple Abnormal Signals [DETECT]

MATCH (u:User {enabled: true})
WHERE (u.pwdneverexpires = true)
  AND (u.lastlogontimestamp IS NULL OR u.lastlogontimestamp < datetime.now - duration('P30D'))
  AND u.admincount = false
RETURN u.name, u.domain

14.7 Find Suspicious Session Patterns [DETECT]

MATCH (u:User)-[:HasSession]->(c:Computer)
WHERE c.operatingsystem CONTAINS 'DC'
RETURN u.name, c.name, count(c) as num_dc_sessions
ORDER BY num_dc_sessions DESC
LIMIT 20

15. Advanced Hunting & Custom Scenarios

15.1 Find Shadow Admin Accounts [CUSTOM]

MATCH (u:User {admincount: false})-[r:GenericAll|GenericWrite|WriteDACL]->
  (sensitive:Group|Domain)
RETURN u.name as shadow_admin, sensitive.name as target
ORDER BY u.name

15.2 Find Potential Ransomware Vectors [CUSTOM]

MATCH (c:Computer {enabled: true})-[:AffectedByGPO]->(g:GPO)
MATCH (admin:User)-[:AdminTo]->(c)
WITH c, count(admin) as num_admins
WHERE num_admins = 1
RETURN c.name, num_admins

15.3 Find Data Exfiltration Vectors [CUSTOM]

MATCH (u:User)-[r:AdminTo|CanRDP]->(c:Computer)
WHERE c.operatingsystem CONTAINS 'Windows Server'
RETURN u.name, c.name
LIMIT 20

15.4 Find Kerberos Golden Ticket Targets [CUSTOM]

MATCH (dc:Computer)-[:DCFor]->(d:Domain)
MATCH (admin:User)-[:AdminTo]->(dc)
RETURN dc.name, count(admin) as num_admins
ORDER BY num_admins DESC

15.5 Find Attack Chain: User → Local Admin → DA [CUSTOM]

MATCH (u:User {name: 'COMPROMISED@DOMAIN.LOCAL'})-[:AdminTo]->(c:Computer)
MATCH (c)<-[:AdminTo]-(da:User)
MATCH (da)-[:MemberOf]->(g:Group {name: 'DOMAIN ADMINS@DOMAIN.LOCAL'})
RETURN u.name, c.name, da.name

Quick Tips for Red Teaming

High-Priority Queries for CPTS/OSCP:

  • Shortest Path to DA - Essential for any engagement
  • Find GenericAll Rights - Quick wins
  • Find Kerberoastable Users - Quick cracking targets
  • Find Constrained Delegation - S4U2Self/Proxy abuse

Quick Wins:

  • Service Accounts with SPNs
  • Computers with Unconstrained Delegation
  • LAPS-Enabled Computers (for admins)
  • RDP-Accessible High-Value Computers

Post-Exploitation:

  • Persistence queries to find backdoor points
  • Lateral movement chains for further compromise
  • GPO write access for domain-wide persistence
  • DCSync rights for golden ticket generation

Integration:

  • Run queries in BloodHound GUI
  • Export results for documentation
  • Chain multiple queries for complete assessment
  • Use LIMIT to prevent GUI freezes

← Active Directory top ↑