BloodHound Cypher Queries Commands

10 BloodHound Cypher Queries commands from the Enumeration category, each with its placeholders, supported authentication methods and upstream references.

Tools covered: MATCH, bloodhound-ce-python, rusthound-ce

• BloodHound.py CE Collector Collect AD data into the BloodHound Community Edition JSON format from Linux. Use --zip for a single…
• Cypher: ADCS ESC1 Candidates (Certipy BloodHound) List every user that can enroll in an ESC1-vulnerable certificate template (enrollee supplies subject +…
• Cypher: All Paths from Owned to High-Value All shortest paths from any owned principal to any high-value target (Domain Admins, Enterprise Admins, DCs,…
• Cypher: AS-REP Roastable Users List every user with DONT_REQ_PREAUTH set — these accounts can be AS-REP roasted without prior…
• Cypher: Kerberoastable Users List every kerberoastable user in the domain (has a SPN, not krbtgt). Pair with hasLAPS / admincount /…
• Cypher: Principals With DCSync Rights Find every principal that holds DS-Replication-Get-Changes / DS-Replication-Get-Changes-All on the domain…
• Cypher: RBCD Write Targets Surface every account that can write to a computer object — the precondition for Resource-Based Constrained…
• Cypher: Shortest Path to Domain Admins Find the shortest attack path from any owned user to the Domain Admins group. The bread-and-butter…
• Cypher: Unconstrained Delegation Find every computer or user with TRUSTED_FOR_DELEGATION set, excluding the DCs themselves. Coercing a…
• RustHound-CE Collector Faster Rust-based BloodHound CE collector. Single static binary, ideal when Python isn't available or LDAP…