Skip to content
This repository has been archived by the owner on Sep 2, 2022. It is now read-only.

Suggestion: keep SID attribute for MappedPrincipals #91

Open
cnotin opened this issue Jan 9, 2020 · 0 comments
Open

Suggestion: keep SID attribute for MappedPrincipals #91

cnotin opened this issue Jan 9, 2020 · 0 comments

Comments

@cnotin
Copy link
Contributor

cnotin commented Jan 9, 2020

Several well-known SIDs are converted to MappedPrincipal objects, see: https://github.com/BloodHoundAD/SharpHound/blob/9d71fb7e3033a7da07cf2ba6daaebd11c09bbd7b/Sharphound2/Enumeration/MappedPrincipal.cs

This is nice as it allows to perform queries using common names, like "Anonymous" without caring about the local AD language. However, the original SID (like "S-1-5-7" for "Anonymous") is lost in the process and is missing from the Group object in neo4j (objectsid attribute).
Groups with missing objectsid attributes can be found with:
MATCH (n:Group) where n.objectsid IS NULL RETURN n

I suggest keeping the SID information to have it in the Group object in neo4j to be able to perform Cypher queries based on SID

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant