This commit is contained in:
mgeeky 2022-05-05 13:32:10 +02:00
parent 3af8c488b9
commit 8837fa5add
4 changed files with 4 additions and 4 deletions

@ -1 +1 @@
Subproject commit a1f5ba28880e6470fa3e8a59ba50388272db1839
Subproject commit 9aa8a2a623077cae13922ba8a9cabe1d17bc5a5c

@ -1 +1 @@
Subproject commit 6ce9975ae639ac16b7dce5c6461a066d8988cec8
Subproject commit 75f6270d0417d749b56c718d0d8ad0003c74d785

@ -1 +1 @@
Subproject commit 9bc13dacc3e21ab9774b059f73f8daadfccdebf6
Subproject commit 7d3c3b5991cb430d6ff9c66c794688d67d5baa75

View File

@ -8,7 +8,7 @@ MATCH (u:User {enabled: true, allowedtodelegate: true}) WHERE toLower(u.name) EN
MATCH (u:User {enabled: true, unconstraineddelegation: true}) WHERE toLower(u.name) ENDS WITH "contoso.com" RETURN "Enabled Users with Unconstrained Delegation" AS what, count(u) AS number UNION ALL
MATCH (u:User {enabled: true, admincount: true}) WHERE toLower(u.name) ENDS WITH "contoso.com" RETURN "Enabled Users with Admin Count = 1" AS what, count(u) AS number UNION ALL
MATCH (u:User {enabled: true, hasspn: True}) WHERE toLower(u.name) ENDS WITH "contoso.com" AND NOT u.name STARTS WITH 'KRBTGT' RETURN "Kerberoastable & Enabled Users" AS what, count(u) AS number UNION ALL
MATCH (u:User {enabled: false, hasspn: True}) WHERE toLower(u.name) ENDS WITH "contoso.com" AND NOT u.name STARTS WITH 'KRBTGT' RETURN "Kerberoastable Users" AS what, count(u) AS number UNION ALL
MATCH (u:User {enabled: false, hasspn: True}) WHERE toLower(u.name) ENDS WITH "contoso.com" AND NOT u.name STARTS WITH 'KRBTGT' RETURN "Kerberoastable & Disabled Users" AS what, count(u) AS number UNION ALL
MATCH (u:User {enabled: true, passwordnotreqd: true}) WHERE toLower(u.name) ENDS WITH "contoso.com" RETURN "Enabled Users with Password Not Required" AS what, count(u) AS number UNION ALL
MATCH (u:User {enabled: true, pwdneverexpires: true}) WHERE toLower(u.name) ENDS WITH "contoso.com" RETURN "Enabled Users with Password Never Expires" AS what, count(u) AS number UNION ALL
MATCH (u:User {enabled: true, dontreqpreauth: true}) WHERE toLower(u.name) ENDS WITH "contoso.com" RETURN "Enabled Users with Dont Require Pre-Authentication (ASREP roastable)" AS what, count(u) AS number UNION ALL