Custom Queries
Shortest path to Domain Admin
From → Enable Users
powershell
MATCH p = shortestPath((n:User {enabled: true})-[*1..]->(m:Group))
WHERE m.objectid ENDS WITH "-512"
RETURN pFrom → Owned Users
powershell
MATCH p = shortestPath((n {owned: true})-[*1..]->(m:Group))
WHERE m.objectid ENDS WITH "-512"
RETURN pFrom Kerberoastable
powershell
MATCH p = shortestPath((n:User {hasspn: true})-[*1..]->(m:Group))
WHERE m.objectid ENDS WITH "-512"
RETURN p