diff --git a/red-teaming/Handy-BloodHound-Cypher-Queries.md b/red-teaming/Handy-BloodHound-Cypher-Queries.md index a0eb20f..fd778fb 100644 --- a/red-teaming/Handy-BloodHound-Cypher-Queries.md +++ b/red-teaming/Handy-BloodHound-Cypher-Queries.md @@ -317,6 +317,13 @@ MATCH (u)-[:CanPrivesc]->(c) RETURN u.name, c.name ## CREATE Nodes and Edges +- Mark nodes as Owned: +``` +MATCH (u) WHERE toLower(u.name) = "user1@contoso.com" SET u.owned RETURN 1 UNION +MATCH (u) WHERE toLower(u.name) = "group2@contoso.com" SET u.owned RETURN 1 UNION +MATCH (u) WHERE toLower(u.name) = "computer3@contoso.com" SET u.owned RETURN 1 +``` + - Mark High Value all members of High Value groups: ``` MATCH (u)-[:MemberOf]->(n {highvalue: true}) SET u.highvalue = true