Tier0HoundDashboard.json

{
  "title": "Tier 0 Hound Dashboard",
  "version": "2.4",
  "settings": {
    "pagenumber": 0,
    "editable": true,
    "fullscreenEnabled": false,
    "parameters": {},
    "theme": "light",
    "queryTimeLimit": 30000,
    "downloadImageEnabled": true
  },
  "pages": [
    {
      "title": "Overview",
      "reports": [
        {
          "id": "ed994c68-297b-49cc-a0bb-8030aa24f5a4",
          "title": "Active Directory Overview",
          "query": "MATCH (u:User) \nRETURN \"Users in total (Enabled and Disabled)\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:User {enabled: true}) \nRETURN \"Users in total (Enabled)\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:User {enabled: false}) \nRETURN \"Disabled Users\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:Computer {enabled: true}) \nRETURN \"Computers in total\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:Group) \nRETURN \"Groups in total\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:Domain) \nRETURN \"Domains in total\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:OU) \nRETURN \"OUs in total\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:GPO) \nRETURN \"GPOs in total\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:User {enabled: true, hasspn: true}) WHERE NOT u.name STARTS WITH 'KRBTGT'\nRETURN \"Kerberoastable Service Accounts (~)\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u {tier0: true}) \nRETURN \"Tier-0 objects\" AS what, count(u) AS number\nUNION ALL\n\nMATCH (u {tier1: true}) \nRETURN \"Tier-1 objects\" AS what, count(u) AS number\nUNION ALL\n\nMATCH (u {tier2: true}) \nRETURN \"Tier-2 objects\" AS what, count(u) AS number\nUNION ALL\n\nMATCH (u:User {enabled: true, admincount: true}) \nRETURN \"Admin Count Users\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u {highvalue: true}) \nRETURN \"Highvalue objects\" AS what, count(u) AS number\nUNION ALL\n\nMATCH (u:User {enabled: true, allowedtodelegate: true}) \nRETURN \"Users with Allowed to Delegate\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:User {enabled: true, unconstraineddelegation: true}) \nRETURN \"Users with Unconstrained Delegation\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:Computer {enabled: true, unconstraineddelegation: true}) WHERE (NOT u.distinguishedname CONTAINS 'DOMAIN CONTROLLERS') \nRETURN \"Computers with Unconstrained Delegation\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:User {enabled: true, passwordnotreqd: true}) \nRETURN \"Users with Password Not Required\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:User {enabled: true, pwdneverexpires: true}) \nRETURN \"Users with Password Never Expires\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:User {enabled: true, dontreqpreauth: true}) \nRETURN \"Users with Dont Require Pre-Authentication (ASREP roastable)\" AS what, count(u) AS number \nUNION ALL\n\nMATCH (u:User {enabled: true}) WHERE u.pwdlastset > 0 AND u.lastlogon > 0 \nWITH u.name AS name, u.description AS description, u.enabled AS enabled, datetime({ epochSeconds: toInteger(u.pwdlastset) }) AS pwdlastset, duration.inDays(datetime({ epochSeconds: toInteger(u.pwdlastset) }), date()).days AS days_since_pwdlastset, datetime({ epochSeconds: toInteger(u.lastlogon) }) AS lastlogon, duration.inDays(datetime({ epochSeconds: toInteger(u.lastlogon) }), date()).days AS days_since_lastlogon \nWHERE days_since_pwdlastset > 90 AND days_since_lastlogon < 7 \nRETURN \"Enabled Users pwdlastset > 90 days and lastlogon < 7 days\" AS what, count(name) AS number \nUNION ALL\n\nMATCH (u:User {enabled: true}) WHERE u.pwdlastset > 0 AND u.lastlogon > 0 \nWITH u.name AS name, u.description AS description, u.enabled AS enabled, datetime({ epochSeconds: toInteger(u.pwdlastset) }) AS pwdlastset, duration.inDays(datetime({ epochSeconds: toInteger(u.pwdlastset) }), date()).days AS days_since_pwdlastset \nWHERE days_since_pwdlastset > 90 \nRETURN \"Enabled Users pwdlastset > 90 days\" AS what, count(name) AS number \nUNION ALL\n\nMATCH (u:User {enabled: true}) WHERE u.pwdlastset > 0 AND u.lastlogon > 0 \nWITH u.name AS name, u.description AS description, u.enabled AS enabled, datetime({ epochSeconds: toInteger(u.lastlogon) }) AS lastlogon, duration.inDays(datetime({ epochSeconds: toInteger(u.lastlogon) }), date()).days AS days_since_lastlogon \nWHERE days_since_lastlogon > 90 \nRETURN \"Enabled Users lastlogon > 180 days\" AS what, count(name) AS number \nUNION ALL\n\nMATCH (u:User {enabled: false}) WHERE u.pwdlastset > 0 AND u.lastlogon > 0 \nWITH u.name AS name, u.description AS description, u.enabled AS enabled, datetime({ epochSeconds: toInteger(u.pwdlastset) }) AS pwdlastset, duration.inDays(datetime({ epochSeconds: toInteger(u.pwdlastset) }), date()).days AS days_since_pwdlastset, datetime({ epochSeconds: toInteger(u.lastlogon) }) AS lastlogon, duration.inDays(datetime({ epochSeconds: toInteger(u.lastlogon) }), date()).days AS days_since_lastlogon \nWHERE days_since_pwdlastset > 90 AND days_since_lastlogon < 7 \nRETURN \"Disabled Users pwdlastset > 90 days and lastlogon < 7 days\" AS what, count(name) AS number \nUNION ALL\n\nMATCH (u:User {enabled: false}) WHERE u.pwdlastset > 0 AND u.lastlogon > 0 \nWITH u.name AS name, u.description AS description, u.enabled AS enabled, datetime({ epochSeconds: toInteger(u.pwdlastset) }) AS pwdlastset, duration.inDays(datetime({ epochSeconds: toInteger(u.pwdlastset) }), date()).days AS days_since_pwdlastset \nWHERE days_since_pwdlastset > 90 \nRETURN \"Disabled Users pwdlastset > 90 days\" AS what, count(name) AS number \nUNION ALL\n\nMATCH (u:User {enabled: false}) WHERE u.pwdlastset > 0 AND u.lastlogon > 0 \nWITH u.name AS name, u.description AS description, u.enabled AS enabled, datetime({ epochSeconds: toInteger(u.lastlogon) }) AS lastlogon, duration.inDays(datetime({ epochSeconds: toInteger(u.lastlogon) }), date()).days AS days_since_lastlogon \nWHERE days_since_lastlogon > 90 \nRETURN \"Disabled Users lastlogon > 180 days\" AS what, count(name) AS number \nUNION ALL\n\nMATCH (u {owned: true})\nRETURN \"Compromised Accounts during the Assessment\" AS what, count(u) AS number ",
          "width": 8,
          "height": 4,
          "x": 0,
          "y": 0,
          "type": "table",
          "selection": {},
          "settings": {
            "allowDownload": true,
            "compact": true,
            "fullscreenEnabled": true,
            "transposed": false,
            "columnWidthsType": "Relative (%)",
            "refreshButtonEnabled": true
          }
        },
        {
          "id": "38a1fe6b-b6e3-4639-9efd-ad539727ac38",
          "title": "Users with path to Tier-0 objects",
          "query": "MATCH (u:User{enabled:true})\nWITH COUNT(u{enabled:true}) as userCount\nMATCH p = shortestPath((u:User{enabled:true})-[r:MemberOf|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GPLink|AddAllowedToAct|AllowedToAct|SQLAdmin|ReadGMSAPassword|HasSIDHistory|SyncLAPSPassword|AddSelf|WriteSPN|AddKeyCredentialLink|DCSync|HasSession|CanRDP|CanPSRemote|ExecuteDCOM*1..]->(g {tier0:true})) where g <> u RETURN 100.0 * COUNT(DISTINCT u) / userCount as PercentUsersToDa",
          "width": 8,
          "height": 4,
          "x": 16,
          "y": 0,
          "type": "gauge",
          "selection": {},
          "settings": {
            "arcsLength": "0.02,0.03,0.95"
          },
          "schema": []
        },
        {
          "id": "e02fb056-a3a1-4063-8b21-7aea5b7d4b94",
          "title": "Users with path to the DA Group",
          "query": "MATCH (u:User{enabled:true})\nMATCH (g:Group) WHERE g.objectid ENDS WITH '-512'\nWITH g, COUNT(u{enabled:true}) as userCount\nMATCH p = shortestPath((u:User{enabled:true})-[r:MemberOf|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GPLink|AddAllowedToAct|AllowedToAct|SQLAdmin|ReadGMSAPassword|HasSIDHistory|SyncLAPSPassword|AddSelf|WriteSPN|AddKeyCredentialLink|DCSync|HasSession|CanRDP|CanPSRemote|ExecuteDCOM*1..]->(g)) RETURN 100.0 * COUNT(DISTINCT u) / userCount as percent",
          "width": 8,
          "height": 4,
          "x": 8,
          "y": 0,
          "type": "gauge",
          "selection": {},
          "settings": {
            "downloadImageEnabled": false,
            "arcsLength": "0.02,0.03,0.95"
          },
          "schema": []
        },
        {
          "id": "236d5e16-ba4b-4d6c-88c1-7303976d5c9f",
          "title": "AD Objects with path to DA Group",
          "query": "MATCH (u{enabled:true})\nMATCH (g:Group) WHERE g.objectid ENDS WITH '-512'\nWITH g, COUNT(u) as userCount\nMATCH p = shortestPath((u{enabled:true})-[r:MemberOf|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GPLink|AddAllowedToAct|AllowedToAct|SQLAdmin|ReadGMSAPassword|HasSIDHistory|SyncLAPSPassword|AddSelf|WriteSPN|AddKeyCredentialLink|DCSync|HasSession|CanRDP|CanPSRemote|ExecuteDCOM*1..]->(g)) RETURN 100.0 * COUNT(DISTINCT u) / userCount as percent",
          "width": 8,
          "height": 4,
          "x": 16,
          "y": 8,
          "type": "gauge",
          "selection": {},
          "settings": {
            "arcsLength": "0.02,0.03,0.95"
          },
          "schema": []
        },
        {
          "id": "33689f5c-27dc-4dc7-857b-0ecadc25a482",
          "title": "Computers with path to DA Group",
          "query": "MATCH (c:Computer{enabled:true})\nMATCH (g:Group) WHERE g.objectid ENDS WITH '-512'\nWITH g, COUNT(c) as ComputerCount\nMATCH p = shortestPath((c:Computer{enabled:true})-[r:MemberOf|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GPLink|AddAllowedToAct|AllowedToAct|SQLAdmin|ReadGMSAPassword|HasSIDHistory|SyncLAPSPassword|AddSelf|WriteSPN|AddKeyCredentialLink|DCSync|HasSession|CanRDP|CanPSRemote|ExecuteDCOM*1..]->(g)) RETURN 100.0 * COUNT(c) / ComputerCount as PercentComputersToDa",
          "width": 8,
          "height": 4,
          "x": 0,
          "y": 8,
          "type": "gauge",
          "selection": {},
          "settings": {
            "arcsLength": "0.02,0.03,0.95"
          },
          "schema": []
        },
        {
          "id": "e41ac053-a79c-49fd-9d0f-84089b440ed8",
          "title": "Computers with session data",
          "query": "MATCH (c:Computer)-[:HasSession]->()\nWITH COUNT(DISTINCT(c)) as computersWithSessions\nMATCH (c2:Computer)\nRETURN toInteger(100 * (toFloat(computersWithSessions) / COUNT(c2))) as PercentComputersWithSessions",
          "width": 8,
          "height": 4,
          "x": 16,
          "y": 20,
          "type": "gauge",
          "selection": {},
          "settings": {},
          "schema": []
        },
        {
          "id": "6f4b12f9-d36c-42d0-8952-c0e88ce0dc2b",
          "title": "Top 15 computers by # admins",
          "query": "MATCH (c:Computer) WITH c OPTIONAL MATCH (n)-[r:AdminTo]->(c) WITH c,COUNT(n) as expAdmins OPTIONAL MATCH (n)-[r:MemberOf*1..]->(g:Group)-[r2:AdminTo]->(c) WITH c,expAdmins,COUNT(DISTINCT(n)) as unrolledAdmins RETURN SPLIT(c.name,'.')[0] as hostname,expAdmins,unrolledAdmins,expAdmins + unrolledAdmins as totalAdmins ORDER BY totalAdmins DESC LIMIT 15\n\n\n",
          "width": 8,
          "height": 4,
          "x": 8,
          "y": 28,
          "type": "bar",
          "selection": {
            "index": "hostname",
            "value": "totalAdmins",
            "key": "(none)"
          },
          "settings": {
            "layout": "horizontal",
            "marginLeft": 120,
            "hideSelections": true,
            "barValues": true
          },
          "schema": []
        },
        {
          "id": "cc109b16-2d78-474f-8f50-c7f7bd3cce30",
          "title": "Top 15 computers by # admins",
          "query": "MATCH (c:Computer) WITH c OPTIONAL MATCH (n:User)-[r:AdminTo]->(c) WITH c,COUNT(n) as expAdmins OPTIONAL MATCH (n:User)-[r:MemberOf*1..]->(g:Group)-[r2:AdminTo]->(c) WITH c,expAdmins,COUNT(DISTINCT(n)) as unrolledAdmins RETURN c.name as system,expAdmins + unrolledAdmins as AdminCount ORDER BY AdminCount desc LIMIT 15\n\n\n",
          "width": 8,
          "height": 4,
          "x": 0,
          "y": 28,
          "type": "bar",
          "selection": {
            "index": "system",
            "value": "AdminCount",
            "key": "(none)"
          },
          "settings": {
            "xScale": "point",
            "legend": false,
            "curve": "step",
            "fullscreenEnabled": true,
            "hideSelections": true,
            "pointSize": 1,
            "interactive": true,
            "layout": "horizontal",
            "marginLeft": 200,
            "barValues": true
          },
          "schema": []
        },
        {
          "id": "99fbc733-1bcd-4a58-a811-7bba403d9cdb",
          "title": "Average Admins per Computers",
          "query": "MATCH (c:Computer) WITH c \nOPTIONAL MATCH (n)-[r:AdminTo]->(c) \nWITH c,COUNT(n) as expAdmins \nOPTIONAL MATCH (n)-[r:MemberOf*1..]->(g:Group)-[r2:AdminTo]->(c) \nWITH c,expAdmins,COUNT(DISTINCT(n)) as unrolledAdmins \nRETURN AVG(expAdmins + unrolledAdmins) as avgTotalAdmins\n\n\n",
          "width": 8,
          "height": 4,
          "x": 16,
          "y": 24,
          "type": "value",
          "selection": {},
          "settings": {
            "monospace": false
          },
          "schema": []
        },
        {
          "id": "2eba82a8-30b5-4ad0-a94d-da47d237ce21",
          "title": "Top 15 outbound control rights (First Degree Object Control) (highvalue=false)",
          "query": "MATCH p=(u)-[r1]->(n) WHERE r1.isacl=true  and u.tier0<>true\nWITH u.name as name, LABELS(u)[1] as type, \nCOUNT(DISTINCT(n)) as controlled \nWHERE name IS NOT NULL \nRETURN type, name, controlled \nORDER BY controlled desc\nLIMIT 15\n\n\n",
          "width": 8,
          "height": 4,
          "x": 16,
          "y": 16,
          "type": "bar",
          "selection": {
            "index": "name",
            "value": "controlled",
            "key": "(none)"
          },
          "settings": {
            "layout": "horizontal",
            "groupMode": "stacked",
            "colors": "set2",
            "barValues": true,
            "valueScale": "linear",
            "hideSelections": true,
            "showOptionalSelections": false,
            "marginLeft": 300,
            "marginBottom": 45
          },
          "schema": []
        },
        {
          "id": "63fa7f47-3a8b-4615-88f6-154835764877",
          "title": "Top 15 degree centrality algorithm (all)",
          "query": "// Verify if fullgraph was already created. Otherwise a fullgraph is created. \nCALL gds.graph.exists('fullgraph') YIELD exists\nCALL apoc.do.when(\n  exists = false, \n  'CALL gds.graph.project.cypher(\n      \"fullgraph\",\n      \"MATCH (n) RETURN id(n) AS id\",\n      \"MATCH (n)-[e]-(m) RETURN id(n) AS source, e.weight AS weight, id(m) AS target\"\n  ) YIELD graphName', \n  'RETURN null',\n  {}\n) YIELD value\n\nCALL gds.degree.stream('fullgraph')\nYIELD nodeId,score\nWhere gds.util.asNode(nodeId).name <> \"\"\nRETURN gds.util.asNode(nodeId).name AS name, labels(gds.util.asNode(nodeId)) as label, score\nORDER BY score desc limit 15\n\n",
          "width": 8,
          "height": 4,
          "x": 0,
          "y": 16,
          "type": "bar",
          "selection": {
            "index": "name",
            "value": "score",
            "key": "(none)"
          },
          "settings": {
            "layout": "horizontal",
            "groupMode": "stacked",
            "colors": "set2",
            "barValues": true,
            "valueScale": "linear",
            "hideSelections": true,
            "showOptionalSelections": false,
            "refreshButtonEnabled": true,
            "marginLeft": 300,
            "marginBottom": 45,
            "marginTop": 0,
            "fullscreenEnabled": true,
            "description": "The degree centrality algorithm can help to determine popular nodes in a graph. The algorithm measures the number of incoming and outgoing edges from a node. If nodes have a high number of edges, in particular outgoing edges, the entity should be flagged as highly privileged",
            "autorun": false
          },
          "schema": []
        },
        {
          "id": "e88a25b8-5b2d-4613-9dee-034651c22393",
          "title": "(Tier0=false) Top 15 degree centrality algorithm",
          "query": "// Verify if fullgraph was already created. Otherwise a fullgraph is created. \nCALL gds.graph.exists('fullgraph') YIELD exists\nCALL apoc.do.when(\n  exists = false, \n  'CALL gds.graph.project.cypher(\n      \"fullgraph\",\n      \"MATCH (n) RETURN id(n) AS id\",\n      \"MATCH (n)-[e]-(m) RETURN id(n) AS source, e.weight AS weight, id(m) AS target\"\n  ) YIELD graphName', \n  'RETURN null',\n  {}\n) YIELD value\n\nCALL gds.degree.stream('fullgraph')\nYIELD nodeId,score\nwhere gds.util.asNode(nodeId).tier0=false and gds.util.asNode(nodeId).name <> \"\"\nRETURN gds.util.asNode(nodeId).name AS name, labels(gds.util.asNode(nodeId)) as label, score\nORDER BY score desc limit 15\n",
          "width": 8,
          "height": 4,
          "x": 8,
          "y": 16,
          "type": "bar",
          "selection": {
            "index": "name",
            "value": "score",
            "key": "(none)"
          },
          "settings": {
            "layout": "horizontal",
            "groupMode": "stacked",
            "colors": "set2",
            "barValues": true,
            "valueScale": "linear",
            "hideSelections": true,
            "showOptionalSelections": false,
            "refreshButtonEnabled": true,
            "marginLeft": 320,
            "marginBottom": 45,
            "marginTop": 0,
            "fullscreenEnabled": true,
            "description": "The degree centrality algorithm can help to determine popular nodes in a graph. The algorithm measures the number of incoming and outgoing edges from a node. If nodes have a high number of edges, in particular outgoing edges, the entity should be flagged as highly privileged",
            "autorun": false
          },
          "schema": []
        },
        {
          "id": "65dd3ef8-7253-400f-af30-aee7335fd72a",
          "title": "(Tier0=false) Top 15 closeness centrality algorithm",
          "query": "// Verify if fullgraph was already created. Otherwise a fullgraph is created. \nCALL gds.graph.exists('fullgraph') YIELD exists\nCALL apoc.do.when(\n  exists = false, \n  'CALL gds.graph.project.cypher(\n      \"fullgraph\",\n      \"MATCH (n) RETURN id(n) AS id\",\n      \"MATCH (n)-[e]-(m) RETURN id(n) AS source, e.weight AS weight, id(m) AS target\"\n  ) YIELD graphName', \n  'RETURN null',\n  {}\n) YIELD value\n\nCALL gds.beta.closeness.stream('fullgraph')\nYIELD nodeId, score\nwhere gds.util.asNode(nodeId).tier0=false and gds.util.asNode(nodeId).name <> \"\"\nRETURN gds.util.asNode(nodeId).name AS name, labels(gds.util.asNode(nodeId)) as label, score*100 as score\nORDER BY score desc limit 15",
          "width": 8,
          "height": 4,
          "x": 16,
          "y": 12,
          "type": "bar",
          "selection": {
            "index": "name",
            "value": "score",
            "key": "(none)"
          },
          "settings": {
            "layout": "horizontal",
            "groupMode": "stacked",
            "colors": "set2",
            "barValues": true,
            "valueScale": "linear",
            "hideSelections": true,
            "showOptionalSelections": false,
            "refreshButtonEnabled": true,
            "marginLeft": 320,
            "marginBottom": 45,
            "marginTop": 0,
            "fullscreenEnabled": true,
            "description": "The closeness centrality algorithm measures the nodes' average farness to all other nodes and generates a list of nodes that are able to propagate information efficiently through a graph. Nodes with a high closeness score have the shortest distances to all other nodes, which makes them privileged entities",
            "autorun": false,
            "positionLabel": "off",
            "expandHeightForLegend": false,
            "legendPosition": "Vertical",
            "customDimensions": false,
            "labelRotation": 0,
            "marginRight": 24,
            "barWidth": 7
          },
          "schema": []
        },
        {
          "id": "a13649fb-2488-426c-aabd-ed55bb327ee7",
          "title": "Top 15 privileged groups with direct local admin rights",
          "query": "MATCH (g:Group)-[:AdminTo]->(c:Computer) RETURN SPLIT(g.name,'@')[0] as GroupName,COUNT(c) as adminCount ORDER BY adminCount DESC LIMIT 15",
          "width": 8,
          "height": 4,
          "x": 16,
          "y": 28,
          "type": "bar",
          "selection": {
            "index": "GroupName",
            "value": "adminCount",
            "key": "(none)"
          },
          "settings": {
            "layout": "horizontal",
            "groupMode": "stacked",
            "colors": "set2",
            "barValues": true,
            "valueScale": "linear",
            "hideSelections": true,
            "showOptionalSelections": false,
            "refreshButtonEnabled": true,
            "marginLeft": 120,
            "marginBottom": 45,
            "marginTop": 0,
            "fullscreenEnabled": true
          },
          "schema": []
        },
        {
          "id": "ce1c8832-715d-4dc6-9a0b-8b4cf991d61d",
          "title": "AD Objects with path to DA Group",
          "query": "MATCH (g:Group) WHERE g.objectid ENDS WITH '-512'\nWITH g\nMATCH p = shortestPath((u{enabled:true})-[:MemberOf|HasSession|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|CanRDP|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GPLink|AddAllowedToAct|AllowedToAct|SQLAdmin|ReadGMSAPassword|HasSIDHistory|CanPSRemote|SyncLAPSPassword|AZAddMembers|AZAddSecret|AZAvereContributor|AZContains|AZContributor|AZExecuteCommand|AZGetCertificates|AZGetKeys|AZGetSecrets|AZGlobalAdmin|AZGrant|AZGrantSelf|AZHasRole|AZMemberOf|AZOwner|AZOwns|AZPrivilegedRoleAdmin|AZResetPassword|AZUserAccessAdministrator|AZAppAdmin|AZCloudAppAdmin|AZRunsAs|AZKeyVaultContributor|AZVMAdminLogin|AddSelf|WriteSPN|AddKeyCredentialLink|AZAddOwner|AZManagedIdentity|AZPrivilegedAuthAdmin|AZVMContributor|AZLogicAppContributor|DumpSMSAPassword|DCSync*1..]->(g)) RETURN DISTINCT(u.name) as name\n\n\n",
          "width": 8,
          "height": 4,
          "x": 0,
          "y": 12,
          "type": "table",
          "selection": {},
          "settings": {}
        },
        {
          "id": "862e47b5-2b73-4105-8711-d2ce4dac7e0d",
          "title": "Users with path to Tier-0 Objects",
          "query": "MATCH p = shortestPath((u:User{enabled:true})-[r:MemberOf|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GPLink|AddAllowedToAct|AllowedToAct|SQLAdmin|ReadGMSAPassword|HasSIDHistory|SyncLAPSPassword|AddSelf|WriteSPN|AddKeyCredentialLink|DCSync*1..]->(g {highvalue:true})) where g <> u RETURN DISTINCT(u.name) as name",
          "width": 8,
          "height": 4,
          "x": 0,
          "y": 4,
          "type": "table",
          "selection": {},
          "settings": {}
        },
        {
          "id": "3e67f2d1-6d85-400c-85b4-4c3997ecf72c",
          "title": "Computers with path to DA Group",
          "query": "MATCH p = shortestPath((c:Computer{enabled:true})-[r:MemberOf|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GPLink|AddAllowedToAct|AllowedToAct|SQLAdmin|ReadGMSAPassword|HasSIDHistory|SyncLAPSPassword|AddSelf|WriteSPN|AddKeyCredentialLink|DCSync|HasSession|CanRDP|CanPSRemote|ExecuteDCOM*1..]->(g{highvalue:true})) where c<>g RETURN DISTINCT(c.name) as name\n",
          "width": 8,
          "height": 4,
          "x": 8,
          "y": 8,
          "type": "table",
          "selection": {},
          "settings": {}
        },
        {
          "id": "84b73d5c-891b-4815-9b0f-c6b4e41f3563",
          "title": "Top 15 closeness centrality algorithm",
          "query": "// Verify if fullgraph was already created. Otherwise a fullgraph is created. \nCALL gds.graph.exists('fullgraph') YIELD exists\nCALL apoc.do.when(\n  exists = false, \n  'CALL gds.graph.project.cypher(\n      \"fullgraph\",\n      \"MATCH (n) RETURN id(n) AS id\",\n      \"MATCH (n)-[e]-(m) RETURN id(n) AS source, e.weight AS weight, id(m) AS target\"\n  ) YIELD graphName', \n  'RETURN null',\n  {}\n) YIELD value\n\nCALL gds.beta.closeness.stream('fullgraph')\nYIELD nodeId, score\nwhere gds.util.asNode(nodeId).name <> \"\"\nRETURN gds.util.asNode(nodeId).name AS name, labels(gds.util.asNode(nodeId)) as label, score*100 as score\nORDER BY score desc limit 15",
          "width": 8,
          "height": 4,
          "x": 8,
          "y": 12,
          "type": "bar",
          "selection": {
            "index": "name",
            "value": "score",
            "key": "(none)"
          },
          "settings": {
            "layout": "horizontal",
            "groupMode": "stacked",
            "colors": "set2",
            "barValues": true,
            "valueScale": "linear",
            "hideSelections": true,
            "showOptionalSelections": false,
            "refreshButtonEnabled": true,
            "marginLeft": 300,
            "marginBottom": 45,
            "marginTop": 0,
            "fullscreenEnabled": true,
            "description": "The closeness centrality algorithm measures the nodes' average farness to all other nodes and generates a list of nodes that are able to propagate information efficiently through a graph. Nodes with a high closeness score have the shortest distances to all other nodes, which makes them privileged entities",
            "autorun": false
          },
          "schema": []
        },
        {
          "id": "6f4011ec-1893-4f50-93d9-5f2a52acd22a",
          "title": "Groups with path to Tier-0 objects",
          "query": "MATCH (g:Group)\nWITH COUNT(g) as groupCount\nMATCH p = shortestPath((g:Group)-[r:MemberOf|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GPLink|AddAllowedToAct|AllowedToAct|SQLAdmin|ReadGMSAPassword|HasSIDHistory|SyncLAPSPassword|AddSelf|WriteSPN|AddKeyCredentialLink|DCSync|HasSession|CanRDP|CanPSRemote|ExecuteDCOM*1..]->(n {tier0:true})) where g <> n RETURN 100.0 * COUNT(DISTINCT g) / groupCount as PercentUsersToDa\n",
          "width": 8,
          "height": 4,
          "x": 8,
          "y": 4,
          "type": "gauge",
          "selection": {},
          "settings": {
            "arcsLength": "0.02,0.03,0.95"
          },
          "schema": []
        },
        {
          "id": "5233d537-17e1-4476-9ca8-4e9107113614",
          "title": "Groups with path to Tier-0 Objects",
          "query": "MATCH p = shortestPath((g:Group)-[r:MemberOf|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GPLink|AddAllowedToAct|AllowedToAct|SQLAdmin|ReadGMSAPassword|HasSIDHistory|SyncLAPSPassword|AddSelf|WriteSPN|AddKeyCredentialLink|DCSync|HasSession|CanRDP|CanPSRemote|ExecuteDCOM*1..]->(n {tier0:true})) where g <> n RETURN DISTINCT(g.name) as name\n",
          "width": 8,
          "height": 4,
          "x": 16,
          "y": 4,
          "type": "table",
          "selection": {},
          "settings": {}
        },
        {
          "id": "a54ab962-3230-490d-98c7-04ac0962b1b3",
          "title": "Kerberoastable Accounts",
          "query": "MATCH (u:User {enabled: true, hasspn: true}) WHERE NOT u.name STARTS WITH 'KRBTGT'\nRETURN DISTINCT(u.name) as name ",
          "width": 8,
          "height": 4,
          "x": 8,
          "y": 20,
          "type": "table",
          "selection": {},
          "settings": {}
        },
        {
          "id": "cb6a446f-692f-4b8c-a2be-24646219ea79",
          "title": "ASREP roastable",
          "query": "MATCH (u {enabled: true, dontreqpreauth: true}) \nRETURN DISTINCT(u.name) as name ",
          "width": 8,
          "height": 4,
          "x": 0,
          "y": 20,
          "type": "table",
          "selection": {},
          "settings": {}
        },
        {
          "id": "adfb932f-2f52-43a6-a554-7535f6885645",
          "title": " Top 15 Computers with most sessions",
          "query": "Match (c:Computer)-[r:HasSession]->(u:User)\n                            WITH c,COUNT(u) as session\n                            RETURN c.name,session\n                            ORDER BY session DESC Limit 15",
          "width": 8,
          "height": 4,
          "x": 8,
          "y": 24,
          "type": "bar",
          "selection": {
            "index": "c.name",
            "value": "session",
            "key": "(none)"
          },
          "settings": {
            "layout": "horizontal",
            "marginLeft": 200,
            "hideSelections": true,
            "barValues": true
          },
          "schema": []
        },
        {
          "id": "ebc9b8ed-d231-44b9-8e6d-2d419e4e5b23",
          "title": " Top 15 Users with most sessions",
          "query": "MATCH (u:User)<-[s:HasSession]-(c:Computer)\n                            WITH u, count(s) as session\n                            RETURN u.name,session\n                            ORDER BY session DESC\n                            LIMIT 15",
          "width": 8,
          "height": 4,
          "x": 0,
          "y": 24,
          "type": "bar",
          "selection": {
            "index": "u.name",
            "value": "session",
            "key": "(none)"
          },
          "settings": {
            "layout": "horizontal",
            "marginLeft": 200,
            "hideSelections": true,
            "barValues": true
          },
          "schema": []
        },
        {
          "id": "635886eb-b2a5-4c0d-a230-5fdcdf80a93a",
          "title": "Local Admins",
          "query": "MATCH (c:Computer) WITH c OPTIONAL MATCH (n:User)-[r:AdminTo]->(c) WITH c OPTIONAL MATCH (n:User)-[r:MemberOf*1..]->(g:Group)-[r2:AdminTo]->(c) WITH n RETURN distinct(n.name) as name",
          "width": 8,
          "height": 4,
          "x": 0,
          "y": 32,
          "type": "table",
          "selection": {},
          "settings": {
            "layout": "horizontal",
            "marginLeft": 200,
            "hideSelections": true,
            "barValues": true,
            "refreshButtonEnabled": true
          },
          "schema": []
        },
        {
          "id": "b3f5b1fe-59c8-421f-8385-3509d22c4d9e",
          "title": "Top 15 computers with RemoteDesktopUser rights",
          "query": "MATCH (c:Computer) WITH c OPTIONAL MATCH (n)-[r:CanRDP]->(c) WITH c,COUNT(n) as expAdmins OPTIONAL MATCH (n)-[r:MemberOf*1..]->(g:Group)-[r2:CanRDP]->(c) WITH c,expAdmins,COUNT(DISTINCT(n)) as unrolledAdmins RETURN c.name as hostname,expAdmins,unrolledAdmins,expAdmins + unrolledAdmins as totalAdmins ORDER BY totalAdmins DESC LIMIT 15\n\n\n",
          "width": 8,
          "height": 4,
          "x": 8,
          "y": 32,
          "type": "bar",
          "selection": {
            "index": "hostname",
            "value": "totalAdmins",
            "key": "(none)"
          },
          "settings": {
            "layout": "horizontal",
            "marginLeft": 120,
            "hideSelections": true,
            "barValues": true
          },
          "schema": []
        },
        {
          "id": "95c65ba1-d8d2-489c-8670-e1a53a54642a",
          "title": "Can RDP",
          "query": "MATCH (c:Computer) WITH c OPTIONAL MATCH (n)-[r:CanRDP]->(c) WITH c OPTIONAL MATCH (n)-[r:MemberOf*1..]->(g:Group)-[r2:CanRDP]->(c) WITH n RETURN distinct(n.name) as name",
          "width": 8,
          "height": 4,
          "x": 16,
          "y": 32,
          "type": "table",
          "selection": {},
          "settings": {
            "layout": "horizontal",
            "marginLeft": 200,
            "hideSelections": true,
            "barValues": true,
            "refreshButtonEnabled": true
          },
          "schema": []
        }
      ]
    }
  ],
  "parameters": {},
  "extensions": {
    "active": true,
    "activeReducers": [],
    "advanced-charts": {
      "active": true
    }
  },
  "_tier0houndVersion": "20240311",
  "_tier0houndSource": "https://github.com/m8r1us/Tier0Hound",
  "uuid": "9934707a-5c7e-4077-9e43-a1460e969ec8"
}