diff --git a/red-teaming/Handy-BloodHound-Cypher-Queries.md b/red-teaming/Handy-BloodHound-Cypher-Queries.md index 0440d15..c4a097f 100644 --- a/red-teaming/Handy-BloodHound-Cypher-Queries.md +++ b/red-teaming/Handy-BloodHound-Cypher-Queries.md @@ -100,7 +100,7 @@ MATCH (n) WHERE n.description CONTAINS '\\\\' RETURN n.name, n.description RETURN shortestPath((O:{owned:True})-[*1..]->(H {highvalue: True})) ``` -- Riccardo Ancarani's cypher queries (src: [GPOPowerParser](https://github.com/RiccardoAncarani/GPOPowerParser)) useful for any lateral movement insights: +- [Riccardo Ancarani's](https://github.com/RiccardoAncarani) cypher queries (src: [GPOPowerParser](https://github.com/RiccardoAncarani/GPOPowerParser)) useful for any lateral movement insights: - Find all the NTLM relay opportunities for computer accounts: ``` MATCH (u1:Computer)-[:AdminTo]->(c1:Computer {signing: false}) RETURN u1.name, c1.name @@ -112,4 +112,4 @@ MATCH (u2)-[:MemberOf*1..]->(g:Group)-[:AdminTo]->(c2 {signing: false}) RETURN u MATCH (u:User)-[:CanRDP]->(c:Computer) WITH u,c OPTIONAL MATCH (u)-[:MemberOf*1..]->(g:Group)-[:CanRDP]->(c) WITH u,c MATCH (u)-[:CanPrivesc]->(c) RETURN u.name, c.name -``` \ No newline at end of file +```