Bloodhound Playbook - Domain Admin Sessions.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Bloodhound Playbook - Domain Admin Sessions\n",
    "-----------------------------------------\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Import Libraries"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [],
   "source": [
    "from py2neo import Graph"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Initialize BloodHound neo4j Database Connection"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "<Graph database=<Database uri='bolt://127.0.0.1:7687' secure=False user_agent='py2neo/4.2.0 neobolt/1.7.15 Python/3.7.4-final-0 (win32)'> name='data'>"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "g = Graph(\"bolt://127.0.0.1:7687\", auth=(\"neo4j\", \"neo4j\"))\n",
    "g"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Retrieve All Domain Admin Account Sessions"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now we’ll construct the Cypher query that return all DA account sessions"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [],
   "source": [
    "da_sessions_df = g.run(\"\"\"\n",
    "MATCH (n:User)-[:MemberOf]->(g:Group {name:\"DOMAIN ADMINS@TESTLAB.NET\"})\n",
    "MATCH p = (c:Computer)-[:HasSession]->(n)\n",
    "return distinct n.name, count(p) AS DA_sessions\n",
    "ORDER BY DA_sessions DESC\n",
    "\"\"\").to_data_frame()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "da_sessions_df"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Retrieve Domain Admin Sessions To Non-Domain Controllers"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [],
   "source": [
    "non_dc_df = g.run(\"\"\"\n",
    "OPTIONAL MATCH (c:Computer)-[:MemberOf]->(t:Group)\n",
    "WHERE NOT t.name = \"DOMAIN CONTROLLERS@TESTLAB.NET\"\n",
    "WITH c as NonDC\n",
    "MATCH p=(NonDC)-[:HasSession]->(n:User)-[:MemberOf]->\n",
    "(g:Group {name:\"DOMAIN ADMINS@TESTLAB.NET\"})\n",
    "RETURN DISTINCT (n.name) as Username, COUNT(DISTINCT(NonDC)) as Connections\n",
    "ORDER BY COUNT(DISTINCT(NonDC)) DESC\n",
    "\"\"\").to_data_frame()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "non_dc_df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.4"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}