get_foreign_users
Retrieve foreign user accounts from a specific domain to identify cross-domain relationships and potential lateral movement targets in Active Directory security analysis.
Instructions
Retrieves foreign users from a specific domain in the Bloodhound database.
"Foreign Users" are defined as user accounts from one domain that are referenced in another domain within the same forest. These represent user accounts that have some form of relationship or access across domain boundaries.
These are potential targets for lateral movement and privilege escalation as well as cross domain compromise.
Args:
domain_id: The ID of the domain to query
limit: Maximum number of foreign users to return (default: 100)
skip: Number of foreign users to skip for pagination (default: 0)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain_id | Yes | ||
| limit | No | ||
| skip | No |