Cypher Queries for Finding User Credentials
Search user descriptions for “pass” or “pw”:
MATCH (e:User) WHERE e.description =~ '(?i).*(pass|pw).*' RETURN e.name,e.description
Also consider searching for:
- change
- As in “password change” and “Exchange”
- admin
Search computer descriptions for “pass” or “pw”:
MATCH (e:Computer) WHERE e.description =~ '(?i).*(pass|pw).*' RETURN e.name,e.description
Also consider searching for:
- change
- As in “password change” and “Exchange”
- admin
Users with password in Active Directory:
Find every user object where the “userpassword” attribute is populated:
MATCH (u:User) WHERE NOT u.userpassword IS null RETURN u.name,u.userpassword