[Query Issue]: Users with logon scripts stored in a trusted domain

[johnmccash]

Query GUID

8d94d3f3-3d53-4939-a206-3c0a4dd3f646

Query content

MATCH (n:User)
WHERE n.logonscript IS NOT NULL
MATCH (d:Domain)<-[:SameForestTrust|CrossForestTrust]-(:Domain)-[:Contains*1..]->(n)
WITH n,last(split(d.name, '@')) AS domain
WHERE toUpper(n.logonscript) STARTS WITH ("\\" + domain + "\")
RETURN n

Issue description

Unknown Cypher function: last

BloodHound version

BHE

BloodHound DB

Postgres

[martinsohn]

Thank you for reporting! I am fixing this in an upcomig release.

This query has been bugging me for a long time, so I will reduce it to simply Users with logon scripts.

• The check for logon script WITHIN a trusted domain is equally important, if not less important, than a logon script OUTSIDE a trusted domain.

• The query itself is complex and brittle

  This is my current best iteration:

  MATCH (n:User)
  WHERE n.logonscript IS NOT NULL
  MATCH (d:Domain)<-[:SameForestTrust|CrossForestTrust]-(:Domain)-[:Contains*1..]->(n)
  WHERE toUpper(n.logonscript) STARTS WITH ("\\\\" + toUpper(d.name) + "\\")
  RETURN n
  

  However, it can still return false-negagives due to possible variations of the network path: FQDN, short domain name, explicit server/DC hostnames, IP addresses, ...

[martinsohn]

Fixed in the latest release.