Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Suggestions for new Queries

Aperta
  • Qualcosa non va?
#65 1 commento 0 reazioni 1 assegnatario Vedi su GitHub

@martinsohn ci sta già lavorando.

Dal 4/8/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

I haven't found these in the database, but since we always check them in a customers environment, I though I suggest including them. They're both kinda related, to I only created a single issue.

name: Check for Objects not owned by Tier Zero
guid: b67b5d95-fe53-40f0-b0c5-a874abb086a5
prebuilt: false
platform: Active Directory 
category: Dangerous Privileges
description: In most Active Directory environments, objects should usually be owned only by privileged 
administrative groups (e.g., Domain Administrators or Enterprise Administrators). Assigned ownership to other 
users or groups introduce potential privilege escalation risks, as object owners can always modify permissions and
regain full control. Therefore, object ownership should be regularly reviewed and corrected.
query:
  MATCH p = (n)-[:Owns*1..]->(o)
  WHERE NOT ((n:Tag_Tier_Zero) OR COALESCE(n.system_tags, '') CONTAINS 'admin_tier_0')
  RETURN p 
  LIMIT 1000
revision: 1
resources: https://rdr-it.com/en/active-directory-change-object-owner-in-bulk/
acknowledgements: @kaasimir

The following query was created, since I often got false positives out of Bloodhound -> often a user was the owner of an object, but beside the Owns edge, other like WriteDacl, WriteOwner or GenericWrite where shown as well. With this query I check for implicit assigned permissions, which has been kinda handy in the past:

name: Check for Object Takeover Permissions
guid: 465e5364-3976-474e-b666-6e6d2ac573bf
prebuilt: false
platform: Active Directory 
category: Dangerous Privileges
description: Object ownership implicitly grants the ability to modify an object's permissions, which can result in 
additional effective rights. As a result, BloodHound may display multiple privilege edges even though ownership is 
the underlying cause, making remediation more complex. This query identifies explicitly assigned critical 
permissions, allowing them to be reviewed independently and removed where appropriate.
query:
  MATCH p = (o)<-[:GenericWrite|GenericAll|WriteOwner|WriteDacl]-(n)
  WHERE NOT (o)<-[:Owns]-(n)
  AND NOT ((n:Tag_Tier_Zero) OR COALESCE(n.system_tags, '') CONTAINS 'admin_tier_0')
  AND NOT n.name STARTS WITH 'MSOL'
  RETURN p
  LIMIT 1000
revision: 1
resources: -
acknowledgements: @kaasimir

Thx a ton guys, hope those are helpful and keep up the great work!
Cheers, kaasimir

Lingua principale
Python
Stelle
207
Fork
24
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.