Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
55 commits
Select commit Hold shift + click to select a range
e12b269
Create Shortest Paths from Owned Principals to Disabled Objects.yml
martinsohn Nov 1, 2026
33bbbce
Create Non-Tier Zero Principals with Control of Disabled Objects.yml
martinsohn Nov 1, 2026
bb77fc6
Create All Domain Controllers.yml
martinsohn Nov 1, 2026
b00b934
"AdminSDHolder to protected objects relationship" replaces "AdminSDHo…
martinsohn Nov 1, 2026
cff419d
Change "Non-Tier Zero principals with control of AdminSDHolder" to us…
martinsohn Nov 1, 2026
64c0f46
Update Computer owners who can obtain LAPS passwords.yml
martinsohn Nov 1, 2026
739382f
Update Computer owners who can obtain LAPS passwords.yml
martinsohn Nov 1, 2026
2fc69b6
Add AD Site graph queries
martinsohn Nov 1, 2026
44beb82
Align 'Users which do not require password to authenticate' with BH b…
martinsohn Nov 1, 2026
fb2917e
Create Accounts with local Administrator access to Tier Zero computer…
martinsohn Nov 2, 2026
f7afb01
Create Accounts with possible secrets in description.yml
martinsohn Nov 2, 2026
4fac43d
Create Hybrid accounts Tier Zero in both Entra ID and Active Directory
martinsohn Nov 2, 2026
c54c792
Create Non-Tier Zero accounts with WriteDACL on Tier Zero group
martinsohn Nov 2, 2026
1f8d331
LIMIT 1000 on Accounts with weak password storage encryption.yml
martinsohn Nov 2, 2026
a0c9002
Recursive memberships on All members of Operator groups
martinsohn Nov 2, 2026
3e5c5d5
Change to Role GUID matching in All privileged Azure Service Principals
martinsohn Nov 2, 2026
788ae33
Update description on Enrollment rights on published ESC15 certificat…
martinsohn Nov 2, 2026
4ceb67c
Add guest primary group in scope of Users with non-default Primary Gr…
martinsohn Nov 2, 2026
b12b55d
Update security-assessment-mapping.json
martinsohn Nov 2, 2026
fafae66
Update security-assessment-mapping.md
martinsohn Nov 2, 2026
15e164b
Update security assessment mapping references
martinsohn Nov 2, 2026
99585fa
Publish assessment mapping with query bundle
martinsohn Nov 3, 2026
77aceaa
Remove MDI "unmonitored" mappings
martinsohn Nov 3, 2026
1f0c202
Update Computer owners who can obtain LAPS passwords.yml
martinsohn Nov 3, 2026
9fa5284
Fix WriteDacl edge name in Tier Zero group query
martinsohn Nov 3, 2026
fbb7d7d
Include direct and group-delegated service principal roles
martinsohn Nov 3, 2026
4b89fcf
Fix Guest non-default primary group detection
martinsohn Nov 3, 2026
5493fe7
Create run_tenant_queries.py
martinsohn Nov 3, 2026
48c0103
Fix MDI source for privileged external account mapping
martinsohn Nov 3, 2026
a010980
Fix MDI sources for Operator and service account mappings
martinsohn Nov 3, 2026
c8a5390
Update run_tenant_queries.py
martinsohn Nov 3, 2026
f122cbf
Create AD query: Foreign principals in Tier Zero groups
martinsohn Nov 3, 2026
1ae2c27
Create: Computers with passwords older than the default maximum passw…
martinsohn Nov 3, 2026
3d5d23e
Add more functional levels to: Domains with functional level not the …
martinsohn Nov 3, 2026
7ecc61f
Add W10 to: Computers with unsupported operating systems
martinsohn Nov 3, 2026
4be29a6
Remove duplicate mapping for PingCastle: A-CertTempCustomSubject
martinsohn Nov 3, 2026
b2000be
Map PurpleKnight hybrid privileges to dual Tier Zero query
martinsohn Nov 3, 2026
4cee49a
Clarify combined LDAP relay assessment mapping scopes
martinsohn Nov 3, 2026
c75c39b
Add Administrators to: Kerberos-enabled service account member of bui…
martinsohn Nov 3, 2026
86150c3
Consolidate duplicate Tier Zero ownership mapping
martinsohn Nov 3, 2026
97e52a7
Add AES configuration query and update assessment mappings
martinsohn Nov 3, 2026
e041e28
Update Computers with non-default Primary Group membership.yml
martinsohn Nov 3, 2026
1eeb517
Update All DNSAdmins.yml
martinsohn Nov 3, 2026
b3740ea
Update Tier Zero accounts not members of Denied RODC Password Replica…
martinsohn Nov 3, 2026
cccf971
Update Accounts with SID History to a non-existent domain.yml
martinsohn Nov 3, 2026
74e9d99
Fix syntax: Kerberos-enabled service accounts without AES encryption
martinsohn Nov 3, 2026
e2a87cb
Remove redundant query and replace mapping for P-DelegationEveryone
martinsohn Nov 4, 2026
aa9ddc2
All traversable edges except memberships: Large default groups with o…
martinsohn Nov 4, 2026
1c925a9
All traversable edges except MemberOf: Principals With Direct Rights …
martinsohn Nov 4, 2026
4c1cf7a
Create GPOs with computer configuration disabled linked to computers.yml
martinsohn Nov 4, 2026
75e3444
Create GPOs with computer configuration disabled linked to computers.yml
martinsohn Nov 4, 2026
996d689
Create GPOs with paths outside domain SYSVOL.yml
martinsohn Nov 4, 2026
3da7902
Restore prebuilt unsupported operating systems query
martinsohn Nov 4, 2026
04af1d4
Restore unsupported operating systems mapping scope
martinsohn Nov 4, 2026
46e3111
Add Netlogon collection check to DC registry health query
martinsohn Nov 4, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ jobs:
run: |
mkdir pages
cp Queries.json pages/Queries.json
cp docs/security-assessment-mapping.json pages/security-assessment-mapping.json

- name: Upload GitHub Pages artifact
uses: actions/upload-pages-artifact@v4
Expand Down
7 changes: 5 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ The library contains queries that demonstrate BloodHound's versatility beyond tr
- Cherry-picked community queries
- SpecterOps-created queries BloodHound Enterprise customers found valuable
- Community contributed queries (see [Contributing](#contributing))
- Novel queries to further showcase BloodHound's security assessment capabilities (see [security-assessment-mapping.md](/docs/security-assessment-mapping.md))
- Novel queries to further showcase BloodHound's [security assessment capabilities](#security-assessment-mapping).

Individual query files are stored in [/queries](/queries/) as `.yml` and are automatically combined into a single Queries.json/Queries.zip as part of our [releases](https://github.com/SpecterOps/BloodHoundQueryLibrary/releases).

Expand Down Expand Up @@ -72,7 +72,10 @@ Whenever new queries are added, the syntax is automatically validated, ensuring

BloodHound queries in this library have been mapped to controls from common security assessment tools, demonstrating how BloodHound can validate findings typically associated with dedicated tools like PingCastle, Microsoft Defender for Identity, and Tenable Nessus.

For full coverage details and mapping structure, see [security-assessment-mapping.md](/docs/security-assessment-mapping.md).
Explore supported tools, mapped controls, and coverage statistics on the [Security Assessments page](https://queries.specterops.io/security-assessments). The page is backed by the repository's [mapping overview](docs/security-assessment-mapping.md) and [mapping data](docs/security-assessment-mapping.json).

<!-- Screenshot placeholder: replace the filename when adding a screenshot of the Security Assessments page. -->
![Security Assessments page screenshot](queries.specterops.io-security-assessments.png)

## Learning Cypher Queries

Expand Down
Loading
Loading