List node labels, relationship types and property keys with per-label counts.

Run a READ-ONLY Cypher query. Writes and procedure CALLs are rejected. Prefer the dedicated tools.

Find objects whose name/objectid contains a term. Optional label (User|Computer|Group|Domain|GPO|OU|Container|AZ*).

Full properties of a node (by name or objectid) plus inbound/outbound edge counts by type.

Security triage of a principal (by name or objectid): attributes, memberships, who controls it, tier-0 distance.

Shortest attack path between two nodes (by name/objectid). Only abusable edges by default; include_structural to traverse all.

Shortest attack paths from a principal to any tier-0 object (Domain Admins / tier-0).

What a principal can reach through abusable edges within N hops.

Mark a principal (by name/objectid) as attacker-owned (stored app-side, not written to the DB).

List principals currently marked as owned.

Shortest attack paths from any owned principal to tier-0.

Enabled users with an SPN (Kerberoastable). (requête vérifiée)

Enabled users that do not require Kerberos pre-auth (AS-REP roastable). (requête vérifiée)

Principals that can DCSync a domain (GetChanges + GetChangesAll). (requête vérifiée)

Users AND computers configured for unconstrained delegation. (requête vérifiée)

Principals with constrained delegation and their allowed targets. (requête vérifiée)

Resource-based constrained delegation (AllowedToAct). (requête vérifiée)

Principals that can read LAPS passwords, and on which computers. (requête vérifiée)

Principals that can read gMSA passwords. (requête vérifiée)

Tier-0 objects (CE label Tag_Tier_Zero). (requête vérifiée)

Members (direct + nested) of every Domain Admins group. (requête vérifiée)

Domain Controllers (members of the -516 group). (requête vérifiée)

Trust relationships between domains. (requête vérifiée)