Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ADCS cypher queries #342

Merged
merged 4 commits into from
Jan 30, 2024
Merged

ADCS cypher queries #342

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
96a122a
feat: Add ADCS pre-built queries
JonasBK Jan 24, 2024
eb23a0c
Merge branch 'main' into adcs-cypher-queries
JonasBK Jan 26, 2024
6ee47c3
Merge branch 'main' into adcs-cypher-queries
rvazarkar Jan 29, 2024
d1c804a
Merge branch 'main' into adcs-cypher-queries
JonasBK Jan 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 46 additions & 0 deletions packages/javascript/bh-shared-ui/src/commonSearches.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,52 @@ export const CommonSearches: CommonSearchType[] = [
},
],
},
{
subheader: 'Active Directory Certificate Services',
category: categoryAD,
queries: [
{
description: 'PKI hierarchy',
cypher: `MATCH p=()-[:HostsCAService|IssuedSignedBy|EnterpriseCAFor|RootCAFor|TrustedForNTAuth|NTAuthStoreFor*..]->()\nRETURN p`,
},
{
description: 'Public Key Services container',
cypher: `MATCH p = (c:Container)-[:Contains*..]->()\nWHERE c.distinguishedname starts with "CN=PUBLIC KEY SERVICES,CN=SERVICES,CN=CONFIGURATION,DC="\nRETURN p`,
},
{
description: 'Enrollment rights on published certificate templates',
cypher: `MATCH p = ()-[:Enroll|GenericAll|AllExtendedRights]->(ct:CertTemplate)-[:PublishedTo]->(:EnterpriseCA)\nRETURN p`,
},
{
description: 'Enrollment rights on published ESC1 certificate templates',
cypher: `MATCH p = ()-[:Enroll|GenericAll|AllExtendedRights]->(ct:CertTemplate)-[:PublishedTo]->(:EnterpriseCA)\nWHERE ct.enrolleesuppliessubject = True\nAND ct.authenticationenabled = True\nAND ct.requiresmanagerapproval = False\nRETURN p`,
},
{
description: 'Enrollment rights on published enrollment agent certificate templates',
cypher: `MATCH p = ()-[:Enroll|GenericAll|AllExtendedRights]->(ct:CertTemplate)-[:PublishedTo]->(:EnterpriseCA)\nWHERE ct.effectiveekus CONTAINS "1.3.6.1.4.1.311.20.2.1"\nOR ct.effectiveekus CONTAINS "2.5.29.37.0"\nOR SIZE(ct.effectiveekus) = 0\nRETURN p`,
},
{
description: 'Enrollment rights on published certificate templates with no security extension',
cypher: `MATCH p = ()-[:Enroll|GenericAll|AllExtendedRights]->(ct:CertTemplate)-[:PublishedTo]->(:EnterpriseCA)\nnWHERE ct.nosecurityextension = true\nRETURN p`,
},
{
description: 'Enrollment rights on certificate templates published to Enterprise CA with User Specified SAN enabled',
cypher: `MATCH p = ()-[:Enroll|GenericAll|AllExtendedRights]->(ct:CertTemplate)-[:PublishedTo]->(eca:EnterpriseCA)\nWHERE eca.isuserspecifiessanenabled = True\nRETURN p`,
},
{
description: 'CA administrators and CA managers',
cypher: `MATCH p = ()-[:ManageCertificates|ManageCA]->(:EnterpriseCA)\nRETURN p`,
},
{
description: 'Domain controllers with weak certificate binding enabled',
cypher: `MATCH p = (dc:Computer)-[:DCFor]->(d)\nWHERE dc.strongcertificatebindingenforcementraw = 0 OR dc.strongcertificatebindingenforcementraw = 1\nRETURN p`,
},
{
description: 'Domain controllers with UPN certificate mapping enabled',
cypher: `MATCH p = (dc:Computer)-[:DCFor]->(d)\nWHERE dc.certificatemappingmethodsraw IN [4, 5, 6, 7, 12, 13, 14, 15, 20, 21, 22, 23, 28, 29, 30, 31]\nRETURN p`,
}
],
},
{
subheader: 'General',
category: categoryAzure,
Expand Down
Loading