Remove registry logged on, remove GPCO from high value targets

BloodHoundAD · Oct 29, 2020 · ee437a5 · ee437a5
1 parent 32e663c
commit ee437a5
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 3 deletions.
diff --git a/SharpHound3/Tasks/ConvertToWrapperTasks.cs b/SharpHound3/Tasks/ConvertToWrapperTasks.cs
@@ -112,8 +112,7 @@ internal static LdapWrapper CreateLdapWrapper(SearchResultEntry searchResultEntr
                         DisplayName = $"{accountName}@{accountDomain}".ToUpper()
                     };
 
-                    if (objectIdentifier.EndsWith("-512") || objectIdentifier.EndsWith("-516") || objectIdentifier.EndsWith("-519") ||
-                        objectIdentifier.EndsWith("-520") || objectIdentifier.EndsWith("S-1-5-32-544") || objectIdentifier.EndsWith("S-1-5-32-550") ||
+                    if (objectIdentifier.EndsWith("-512") || objectIdentifier.EndsWith("-516") || objectIdentifier.EndsWith("-519") || objectIdentifier.EndsWith("S-1-5-32-544") || objectIdentifier.EndsWith("S-1-5-32-550") ||
                         objectIdentifier.EndsWith("S-1-5-32-549") || objectIdentifier.EndsWith("S-1-5-32-551") || objectIdentifier.EndsWith("S-1-5-32-548"))
                     {
                         wrapper.Properties.Add("highvalue", true);

diff --git a/SharpHound3/Tasks/LoggedOnTasks.cs b/SharpHound3/Tasks/LoggedOnTasks.cs
@@ -32,7 +32,7 @@ internal static async Task<LdapWrapper> ProcessLoggedOn(LdapWrapper wrapper)
                 {
                     var sessions = new List<Session>();
                     sessions.AddRange(await GetLoggedOnUsersAPI(computer));
-                    sessions.AddRange(await GetLoggedOnUsersRegistry(computer));
+                    //sessions.AddRange(await GetLoggedOnUsersRegistry(computer));
                     var temp = computer.Sessions.ToList();
                     temp.AddRange(sessions);
                     computer.Sessions = temp.Distinct().ToArray();