Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update PrebuiltQueries.json #670

Merged
merged 18 commits into from
Jul 24, 2023
Merged

Update PrebuiltQueries.json #670

Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
ecfdc42
Update PrebuiltQueries.json
LuemmelSec May 23, 2023
66af4f9
Update PrebuiltQueries.json
LuemmelSec May 23, 2023
95aa211
Update PrebuiltQueries.json
LuemmelSec May 25, 2023
d172608
Update PrebuiltQueries.json
LuemmelSec May 25, 2023
bfee1c3
Update PrebuiltQueries.json
LuemmelSec May 26, 2023
70beda0
Update PrebuiltQueries.json
LuemmelSec May 26, 2023
66b6047
Update PrebuiltQueries.json
LuemmelSec May 26, 2023
d9d1bb6
Update PrebuiltQueries.json
LuemmelSec May 26, 2023
3dcb864
Update PrebuiltQueries.json
LuemmelSec May 26, 2023
a9ca614
Update PrebuiltQueries.json
LuemmelSec May 31, 2023
3e973c2
Update PrebuiltQueries.json
LuemmelSec May 31, 2023
f32c334
Update PrebuiltQueries.json
LuemmelSec May 31, 2023
b4308f7
Update PrebuiltQueries.json
LuemmelSec May 31, 2023
e87e756
Update PrebuiltQueries.json
LuemmelSec May 31, 2023
5620272
Update PrebuiltQueries.json
LuemmelSec May 31, 2023
bee1144
Update PrebuiltQueries.json
LuemmelSec May 31, 2023
9ca8e61
Update PrebuiltQueries.json
LuemmelSec Jun 1, 2023
92433e8
Update PrebuiltQueries.json
JonasBK Jul 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
154 changes: 154 additions & 0 deletions src/components/SearchContainer/Tabs/PrebuiltQueries.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -384,6 +384,160 @@
"endNode": "{}"
}
]
},
{
"name": "Find all Global Administrators",
"category": "Azure - General",
"querylist": [
{
"final": true,
"query": "MATCH p =(n)-[r:AZGlobalAdmin*1..]->(m) RETURN p",
"allowCollapse": false
}
]
},
{
"name": "Find all Members of High Privileged Roles",
"category": "Azure - General",
"querylist": [
{
"final": true,
"query": "MATCH p=(n)-[:AZHasRole|AZMemberOf*1..2]->(r:AZRole WHERE r.displayname =~ '(?i)Global Administrator|User Administrator|Cloud Application Administrator|Authentication Policy Administrator|Exchange Administrator|Helpdesk Administrator|PRIVILEGED AUTHENTICATION ADMINISTRATOR') RETURN p",
"allowCollapse": false
}
]
},
{
"name": "Find all Members of High Privileged Roles that are synced from OnPrem AD",
"category": "Azure - General",
"querylist": [
{
"final": true,
"query": "MATCH p=(n WHERE n.onpremisesyncenabled = true)-[:AZHasRole|AZMemberOf*1..2]->(r:AZRole WHERE r.displayname =~ '(?i)Global Administrator|User Administrator|Cloud Application Administrator|Authentication Policy Administrator|Exchange Administrator|Helpdesk Administrator|PRIVILEGED AUTHENTICATION ADMINISTRATOR') RETURN p",
"allowCollapse": false
}
]
},
{
"name": "Find all Azure Users with a Path to High Value Targets",
"category": "Azure - Paths",
"querylist": [
{
"final": true,
"query": "MATCH (m:AZUser),(n {highvalue:true}),p=shortestPath((m)-[r*1..]->(n)) WHERE NONE (r IN relationships(p) WHERE type(r)= \"GetChanges\") AND NONE (r in relationships(p) WHERE type(r)=\"GetChangesAll\") AND NOT m=n RETURN p",
"allowCollapse": true
}
]
},
{
"name": "Find OnPrem synced Users with Paths to High Value Targets",
"category": "Azure - Paths",
"querylist": [
{
"final": true,
"query": "MATCH (m:AZUser WHERE m.onpremisesyncenabled = true),(n {highvalue:true}),p=shortestPath((m)-[r*1..]->(n)) WHERE NONE (r IN relationships(p) WHERE type(r)= \"GetChanges\") AND NONE (r in relationships(p) WHERE type(r)=\"GetChangesAll\") AND NOT m=n RETURN p",
"allowCollapse": true
}
]
},
{
"name": "Find shortest Paths to Privileged Roles",
"category": "Azure - Paths",
"querylist": [
{
"final": true,
"query": "MATCH (n:AZRole WHERE n.displayname =~ '(?i)Global Administrator|User Administrator|Cloud Application Administrator|Authentication Policy Administrator|Exchange Administrator|Helpdesk Administrator|PRIVILEGED AUTHENTICATION ADMINISTRATOR'), (m), p=shortestPath((m)-[r*1..]->(n)) WHERE NOT m=n RETURN p",
"allowCollapse": true
}
]
},
{
"name": "Find Azure Applications with Paths to High Value Targets",
"category": "Azure - Paths",
"querylist": [
{
"final": true,
"query": "MATCH (m:AZApp),(n {highvalue:true}),p=shortestPath((m)-[r*1..]->(n)) WHERE NONE (r IN relationships(p) WHERE type(r)= \"GetChanges\") AND NONE (r in relationships(p) WHERE type(r)=\"GetChangesAll\") AND NOT m=n RETURN p",
"allowCollapse": true
}
]
},
{
"name": "Find shortest Paths to Azure Subscriptions",
"category": "Azure - Paths",
"querylist": [
{
"final": true,
"query": "MATCH (n:AZSubscription), (m), p=shortestPath((m)-[r*1..]->(n)) WHERE NOT m=n RETURN p",
"allowCollapse": true
}
]
},
{
"name": "Find shortest Paths from Owned Principals to to High Value Targets",
"category": "Azure - Paths",
"querylist": [
{
"final": true,
"query": "MATCH p = shortestPath((n {owned: true})-[*..]->(m {highvalue:true}) WHERE m<>n RETURN p",
"allowCollapse": true
}
]
},
{
"name": "Find shortest Paths to Privileged Roles",
"category": "Azure - Paths",
"querylist": [
{
"final": true,
"query": "MATCH (n:AZRole WHERE n.displayname =~ '(?i)Global Administrator|User Administrator|Cloud Application Administrator|Authentication Policy Administrator|Exchange Administrator|Helpdesk Administrator|PRIVILEGED AUTHENTICATION ADMINISTRATOR'), (m), p=shortestPath((m {owned: true})-[r*1..]->(n)) WHERE NOT m=n RETURN p",
"allowCollapse": true
}
]
},
{
"name": "Find all Service Principals with MS Graph Privilege to grant arbitrary App Roles",
"category": "Azure - MS Graph",
"querylist": [
{
"final": true,
"query": "MATCH p=(n)-[r:AZMGGrantAppRoles]->(o:AZTenant) RETURN p",
"allowCollapse": true
}
]
},
{
"name": "Find all Service Principals with MS Graph App Role Assignments",
"category": "Azure - MS Graph",
"querylist": [
{
"final": true,
"query": "MATCH p=(m:AZServicePrincipal)-[r:AZMGAppRoleAssignment_ReadWrite_All|AZMGApplication_ReadWrite_All|AZMGDirectory_ReadWrite_All|AZMGGroupMember_ReadWrite_All|AZMGGroup_ReadWrite_All|AZMGRoleManagement_ReadWrite_Directory|AZMGServicePrincipalEndpoint_ReadWrite_All]->(n:AZServicePrincipal) RETURN p",
"allowCollapse": true
}
]
},
{
"name": "Find all direct Controllers of MS Graph",
"category": "Azure - MS Graph",
"querylist": [
{
"final": true,
"query": "MATCH p = (n)-[r:AZAddOwner|AZAddSecret|AZAppAdmin|AZCloudAppAdmin|AZMGAddOwner|AZMGAddSecret|AZOwns]->(g:AZServicePrincipal {appdisplayname: \"Microsoft Graph\"}) RETURN p",
"allowCollapse": true
}
]
},
{
"name": "Find shortest Paths to MS Graph",
"category": "Azure - MS Graph",
"querylist": [
{
"final": true,
"query": "MATCH p = shortestPath((n)-[r*1..]->(g:AZServicePrincipal {appdisplayname: \"Microsoft Graph\"})) WHERE n<>g RETURN p",
"allowCollapse": true
}
]
}
]
}