AzureHound Cypher Cheatsheet

What it is

A page of copy-pasteable Cypher queries by hausec for exploring AzureHound-collected data in BloodHound. Queries are split into two targets: ones for the BloodHound GUI (entered via Settings > Query Debug Mode) and ones for the raw Neo4j console (default http://localhost:7474). The importable versions live in the hausec/Bloodhound-Custom-Queries JSON file.

What to do

The queries the summary only names, reproduced verbatim. GUI (path-returning, for graph exploration):

MATCH p =(n)-[r:AZGlobalAdmin*1..]->(m) RETURN p

MATCH p = (n)-[r]->(g:AZKeyVault) RETURN p

MATCH p = (n)-[r]->(g:AZVM) RETURN p

On-prem AD principals identified by SID prefix S-1-5-21; Azure groups synced from on-prem carry an azsyncid:

MATCH (n:Group) WHERE n.objectid CONTAINS 'S-1-5' AND n.azsyncid IS NOT NULL RETURN n

MATCH p = (g:AZServicePrincipal)-[r]->(n) RETURN p

MATCH p = (n)-[r:AZOwns]->(g:AZApp) RETURN p

Console (flat inventory lists — useful for scoping before path queries):

MATCH (n:AZKeyVault) return n.name
MATCH (n:AZVM) return n.name
MATCH (n:AZServicePrincipal) return n.objectid
MATCH p = (n)-[r:AZContributor]->(g) RETURN p

Caveats

The "On-Prem users with edges to Azure" query as published contains a malformed edge type near the end:

MATCH p=(m:User)-[r:AZResetPassword|AZOwns|AZUserAccessAdministrator|AZContributor|AZAddMembers|AZGlobalAdmin|AZVMContributor|AZOwnsAZAvereContributor]->(n) WHERE m.objectid CONTAINS 'S-1-5-21' RETURN p

AZOwnsAZAvereContributor is almost certainly two concatenated relationship types (AZOwns and AZAvereContributor) missing the | separator — that final term will match nothing as written; split it before relying on the result.

This is a 2020 cheatsheet against the original AzureHound/BloodHound schema. Edge and node labels (e.g. AZGlobalAdmin, AZAvereContributor, azsyncid) predate later BloodHound schema revisions and may not match current AzureHound output; validate label names against your ingested data before assuming an empty result means an empty finding. The page gives queries only — no interpretation of what any returned path authorizes.