Skip to content

[Query Issue]: Users with logon scripts stored in a trusted domain #58

@johnmccash

Description

@johnmccash

Query GUID

8d94d3f3-3d53-4939-a206-3c0a4dd3f646

Query content

MATCH (n:User)
WHERE n.logonscript IS NOT NULL
MATCH (d:Domain)<-[:SameForestTrust|CrossForestTrust]-(:Domain)-[:Contains*1..]->(n)
WITH n,last(split(d.name, '@')) AS domain
WHERE toUpper(n.logonscript) STARTS WITH ("\\" + domain + "\")
RETURN n

Issue description

Unknown Cypher function: last

BloodHound version

BHE

BloodHound DB

Postgres

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions