get_foreign_admins
Identify security principals from one domain with administrative privileges in another domain to detect lateral movement and privilege escalation risks in Active Directory environments.
Instructions
Retrieves foreign admins from a specific domain in the Bloodhound database.
"Foreign Admins" are defined as security principals (users, groups, or computers) from one domain that have administrative privileges in another domain within the same forest.
These are potential targets for lateral movement and privilege escalation as well as cross domain compromise.
Args:
domain_id: The ID of the domain to query
limit: Maximum number of foreign admins to return (default: 100)
skip: Number of foreign admins to skip for pagination (default: 0)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain_id | Yes | ||
| limit | No | ||
| skip | No |