Skip to content

Commit

Permalink
Update default.tasks
Browse files Browse the repository at this point in the history
yeah I'm a fool -- we already had those reports.  -- corrected the LA enumeration report to be distinct.
  • Loading branch information
Relkci committed Apr 5, 2024
1 parent 195db41 commit 64bc3ae
Showing 1 changed file with 1 addition and 3 deletions.
4 changes: 1 addition & 3 deletions tasks/default.tasks
Original file line number Diff line number Diff line change
Expand Up @@ -57,14 +57,12 @@
["Local AdminGroups Count", "HTML", "LocalAdmin_Groups_Count.html", "MATCH p=(m:Group)-[r:AdminTo]->(n:Computer) RETURN m.name as Group, count(*) as Computer ORDER BY Computer DESC"]
["Local AdminUsers","HTML","LocalAdmin_Users.html","MATCH p=(m:User)-[r:AdminTo]->(n:Computer) RETURN m.name as User, n.name as Computer ORDER BY m.name"]
["Local AdminUsers Count","HTML","LocalAdmin_UsersCount.html","MATCH p=(m:User)-[r:AdminTo]->(n:Computer) RETURN m.name as User, count(*) as Computer ORDER BY Computer DESC" ]
["Computers Vulnerable to Local Admin Enumeration","HTMLCSV","Computers_LocalAdminEnumeration","MATCH p=()-[:AdminTo]->(n:Computer) RETURN distinct(n.name) as Host, n.operatingsystem as OS"]
["Servers in OUs","HTML","ServersInOUs.html","MATCH (o:OU)-[:Contains]->(c:Computer) WHERE toUpper(c.operatingsystem) STARTS WITH 'WINDOWS SERVER' RETURN o.name as OU,c.name as Computer,c.operatingsystem as OS"]
["Computers with MSSQL SPN","HTMLCSV","Computers_MSSQL","MATCH (c:Computer) WHERE ANY (x IN c.serviceprincipalnames WHERE toUpper(x) CONTAINS 'MSSQL') RETURN c.name as Computer, c.enabled as Enabled, c.serviceprincipalnames as SPN ORDER BY c.name ASC"]
["Computers Admin of Computers","HTMLCSV","Computers_admin_computers","MATCH p=(m:Computer {enabled: True})-[r1:MemberOf*0..]->(g)-[r2:AdminTo*1..]->(n:Computer) WHERE n <> m RETURN m.name as Computer, n.name as TargetComputer"]
["Computers Admin of Computers Count","HTML","Computers_admin_computers_count.html","MATCH p=(m:Computer {enabled: True})-[r1:MemberOf*0..]->(g)-[r2:AdminTo*1..]->(n:Computer) WHERE n <> m RETURN m.name as Computer, COUNT(n) as TargetComputerCount"]
["Computers with Descriptions","HTMLCSV","Computers_WithDescriptions","MATCH (c:Computer) WHERE c.description IS NOT NULL RETURN c.name as Computer,c.description as Description"]
["Local Admin Users To Computers","HTMLCSV","LocalAdmin_Users","MATCH p=(s:User)-[:AdminTo]->(n:Computer) RETURN s.name as name, n.name as Host, n.operatingsystem as OS"]
["Local Admin Groups To Computers","HTMLCSV","LocalAdmin_Groups","MATCH p=(s:Group)-[:AdminTo]->(n:Computer) RETURN s.name as name, n.name as Host, n.operatingsystem as OS"]
["Local Admin Computers To Computers","HTMLCSV","LocalAdmin_Computers","MATCH p=(s:Computer)-[:AdminTo]->(n:Computer) RETURN s.name as name, n.name as Host, n.operatingsystem as OS"]
["Operating Systems Unsupported", "HTMLCSV", "OS_Unsupported", "MATCH (c:Computer) WHERE c.operatingsystem =~ '.*(2000|2003|2008|2012|xp|vista|7|me).*' RETURN c.name as Computer, c.operatingsystem as UnsupportedOS, c.enabled as Enabled, toString(datetime({epochSeconds: ToInteger(coalesce(c.pwdlastset,0))})) as PWDLastSet, toString(datetime({epochSeconds: ToInteger(coalesce(c.lastlogontimestamp,0))})) as LastLogonTimeStamp" ]
["Operating Systems Unsupported Count", "HTMLCSV", "OS_Unsupported_Count", "MATCH (c:Computer) WHERE c.operatingsystem =~ '.*(2000|2003|2008|2012|xp|vista|7|me).*' RETURN COUNT(DISTINCT(c.name)) as Computers, c.operatingsystem as UnsupportedOS, c.enabled as Enabled ORDER BY Enabled DESC, Computers DESC" ]
["Operating Systems Count", "HTMLCSV", "OS_Count", "MATCH (c:Computer) RETURN c.operatingsystem aS OS, count(*) as Computers, c.enabled as Enabled ORDER BY Enabled DESC, Computers DESC" ]
Expand Down

0 comments on commit 64bc3ae

Please sign in to comment.