Skip to content

Latest commit

 

History

History
3309 lines (1728 loc) · 46.2 KB

OperatorCheat.md

File metadata and controls

3309 lines (1728 loc) · 46.2 KB

BloodHoundOperator - CheatSheet

Table Of Content



BHCOMPOSER

Get-BHComposer

Get BloodHound Composer

Syntax:

Get-BHComposer [-ComposerFolder <Object>] 

Get-BHComposer -Composer [-ComposerFolder <Object>] 

Get-BHComposer -Env [-ComposerFolder <Object>] 

Get-BHComposer -Config [-ComposerFolder <Object>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Get-BHComposer

See Help Get-BHComposer for more info



BackToTop


Invoke-BHComposer

Alias: BHComposer

Invoke BloodHound Composer

Syntax:

Invoke-BHComposer [[-Action] <string>] [-ComposerFolder <string>] [-Force] 

Invoke-BHComposer -Command <string> [-ComposerFolder <string>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Invoke-BHComposer Up

See Help BHComposer for more info



BackToTop


New-BHComposer

New BloodHound Composer

Syntax:

New-BHComposer [[-ComposerFolder] <string>] [-IncludeEnv] [-IncludeConfig]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > New-BHComposer $FolderLocation

See Help New-BHComposer for more info



BackToTop


Get-BHComposerLog

Alias: BHLog

Get BloodHound Composer Logs

Syntax:

Get-BHComposerLog [-Limit <string>] [-ComposerFolder <Object>] 

Get-BHComposerLog -Trace [-Limit <string>] [-ComposerFolder <Object>] 

Get-BHComposerLog -TraceObject [-Limit <string>] [-ComposerFolder <Object>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHLog -TraceObject | select time,status,message

See Help BHLog for more info



BackToTop



BHSESSION

Get-BHSession

Alias: BHSession

Get BloodHound API Session

Syntax:

Get-BHSession [-Selected]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Get-BHSession


-------------------------- EXAMPLE 2 --------------------------

PS > Get-BHSession -Selected

See Help BHSession for more info



BackToTop


New-BHSession

New BloodHound API Session

Syntax:

New-BHSession [-JWT] <string> [-Server <string>] [-Port <string>] [-Protocol <string>] [-CypherClip] 

New-BHSession -TokenID <string> -Token <securestring> [-Server <string>] [-Port <string>] [-Protocol <string>] [-CypherClip]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > $TokenKey = Get-Clipboard | Convertto-SecureString -AsPlainText -Force

Convert plaintext token key from clipboard to secure string variable


-------------------------- EXAMPLE 2 --------------------------

PS > New-BHSession -TokenID $TokenID -Token $TokenKey

Create a BHCE session (localhost:8080).
- $TokenKey must be secure string.


-------------------------- EXAMPLE 3 --------------------------

PS > New-BHSession -Server $Instance -TokenID $TokenID -Token $TokenKey

Create a BHE session.
- $TokenKey must be secure string.


-------------------------- EXAMPLE 4 --------------------------

PS > New-BHSession -JWT $JWT [-Server $Instance]

Create Session with JWT

See Help New-BHSession for more info



BackToTop


Remove-BHSession

Remove BloodHound API Session

Syntax:

Remove-BHSession [-ID] <int[]> [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Remove-BHSession

See Help Remove-BHSession for more info



BackToTop


Select-BHSession

Alias: BHSelect

Select BloodHound API Session

Syntax:

Select-BHSession [-ID] <int[]> 

Select-BHSession -None

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Select-BHSession 1

See Help BHSelect for more info



BackToTop


Set-BHSession

Set BloodHound API Session

Syntax:

Set-BHSession [[-Limit] <int>] [[-Timeout] <int>] [-CypherClip] [-NoClip]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Set-BHSession

See Help Set-BHSession for more info



BackToTop


Invoke-BHSessionScript

Alias: BHScript

Invoke BloodHound API Session Script

Syntax:

Invoke-BHSessionScript [[-Script] <scriptblock>] [[-SessionID] <int[]>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHScript {BHOperator -self | select principal_name} -SessionID 1,2

See Help BHScript for more info



BackToTop



BHAPI

Get-BHAPI

Alias: BHAPIInfo

Get BloodHound API Info

Syntax:

Get-BHAPI

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Get-BHAPI


-------------------------- EXAMPLE 2 --------------------------

PS > Get-BHAPI | select-object method,route,summary | sort-object route

See Help BHAPIInfo for more info



BackToTop


Invoke-BHAPI

Alias: BHAPI

Invoke BloodHound API call

Syntax:

Invoke-BHAPI [-URI] <string> [[-Method] <string>] [[-Body] <string>] [[-Filter] <string[]>] [[-SessionID] <int[]>] [[-Timeout] <int>] [[-Expand] <string>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Invoke-BHAPI /api/version | Select-Object -ExpandProperty data | Select-Object -ExpandProperty server_version


-------------------------- EXAMPLE 2 --------------------------

PS > bhapi api/version -expand data.server_version


-------------------------- EXAMPLE 3 --------------------------

PS > BHAPI bloodhound-users POST $Json

See Help BHAPI for more info



BackToTop



BHSERVER

Get-BHServerAuditLog

Alias: BHAudit

Get BloodHound Server Audit Log

Syntax:

Get-BHServerAuditLog [[-Limit] <string>] [[-Before] <datetime>] [[-After] <datetime>] [[-Filter] <string[]>] [[-Skip] <string>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHAudit

See Help BHAudit for more info



BackToTop


Get-BHServerConfig

Alias: BHConfig

Get BloodHound Server Config

Syntax:

Get-BHServerConfig

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHConfig

See Help BHConfig for more info



BackToTop


Set-BHServerConfig

Alias: Set-BHConfig

Set BloodHound Server Config

Syntax:

Set-BHServerConfig [-ConfigKey] <string[]> [-Value] <hashtable>

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Set-BHConfig -key prune.ttl -value @{base_ttl="P8D";has_session_edge_ttl="P5D"}


-------------------------- EXAMPLE 2 --------------------------

PS > Set-BHConfig -key analysis.reconciliation -value @{enabled=$true}

See Help Set-BHConfig for more info



BackToTop


Get-BHServerFeature

Alias: BHFeature

Get BloodHound Server Feature

Syntax:

Get-BHServerFeature

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHFeature

See Help BHFeature for more info



BackToTop


Set-BHServerFeature

Alias: Set-BHFeature

Set BloodHound Server Feature

Syntax:

Set-BHServerFeature -FeatureID <int[]> -Enabled 

Set-BHServerFeature -FeatureID <int[]> -Disabled

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Set-BHFeature -id 1 -Enabled

See Help Set-BHFeature for more info



BackToTop


Get-BHServerSAMLEndpoint

Alias: BHSAMLEndpoint

Get BloodHound SAML Endpoints

Syntax:

Get-BHServerSAMLEndpoint

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Get-BHServerSAMLEndpoint

See Help BHSAMLEndpoint for more info



BackToTop


Get-BHServerSAMLProvider

Alias: BHSAMLProvider

Get BloodHound SAML Provider

Syntax:

Get-BHServerSAMLProvider [[-ProviderID] <int>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Get-BHServerSAMLProvider

See Help BHSAMLProvider for more info



BackToTop


New-BHServerSAMLProvider

Alias: New-BHSAMLProvider

New BloodHound SAML Provider

Syntax:

New-BHServerSAMLProvider [-Name] <string> [-Metadata] <string>

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > New-BHServerSAMLProvider

See Help New-BHSAMLProvider for more info



BackToTop


Remove-BHServerSAMLProvider

Alias: Remove-BHSAMLProvider

Remove BloodHound SAML Provider

Syntax:

Remove-BHServerSAMLProvider [-ProviderID] <int> [-Force] [-PassThru]

Examples:

-------------------------- EXAMPLE 1 --------------------------

Remove-BHServerSAMLProvider -id <id>[-Force]

See Help Remove-BHSAMLProvider for more info



BackToTop


Get-BHServerVersion

Alias: BHVersion

Get BloodHound Server version

Syntax:

Get-BHServerVersion [[-SessionID] <int[]>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHVersion

See Help BHVersion for more info



BackToTop



BHOPERATOR

Disable-BHOperator

Disable BloodHound Operator

Syntax:

Disable-BHOperator [-OperatorID] <string[]> [-PassThru]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHOperator -id 2 | Disable-BHOperator

See Help Disable-BHOperator for more info



BackToTop


Enable-BHOperator

Enable BloodHound Operator

Syntax:

Enable-BHOperator [-OperatorID] <string[]> [-PassThru]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHOperator -id 2 | Enable-BHOperator

See Help Enable-BHOperator for more info



BackToTop


Get-BHOperator

Alias: BHOperator

Get BloodHound Operator

Syntax:

Get-BHOperator 

Get-BHOperator -ID <string[]> 

Get-BHOperator -Name <string[]> 

Get-BHOperator -Current 

Get-BHOperator -Role <string>

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHOperator

See Help BHOperator for more info



BackToTop


New-BHOperator

New BloodHound Operator

Syntax:

New-BHOperator [-Name] <string> [[-FirstName] <string>] [[-LastName] <string>] [[-Email] <string>] [[-Role] <int[]>] [-PassThru]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > New-BHOperator -name bob

See Help New-BHOperator for more info



BackToTop


Remove-BHOperator

Remove BloodHound Operator

Syntax:

Remove-BHOperator [-OperatorID] <string[]> [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Remove-BHOperator

See Help Remove-BHOperator for more info



BackToTop


Set-BHOperator

Set BloodHound Operator

Syntax:

Set-BHOperator [-OperatorID] <string> [[-Name] <string>] [[-FirstName] <string>] [[-LastName] <string>] [[-Email] <string>] [[-Role] <int[]>] [-PassThru]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHOperator -id 2 | Set-BHOperator -firstname alice

See Help Set-BHOperator for more info



BackToTop


Approve-BHOperatorEULA

[BHE] Approve BloodHound EULA

Syntax:

Approve-BHOperatorEULA

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Approve-BHOperatorEULA

See Help Approve-BHOperatorEULA for more info



BackToTop


Get-BHOperatorHelp

Alias: BHHelp

Get BloodHound Operator Help

Syntax:

Get-BHOperatorHelp [-ReadTheDocs] [-Online] 

Get-BHOperatorHelp [-TierZero] [-Online]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHHelp

See Help BHHelp for more info



BackToTop


Get-BHOperatorMFAStatus

Alias: BHOperatorMFA

Get BloodHound Operator MFA status

Syntax:

Get-BHOperatorMFAStatus [-ID] <string[]>

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHOperator -self | Get-BHOperatorMFAStatus

See Help BHOperatorMFA for more info



BackToTop


Get-BHOperatorPermission

Alias: BHPermission

Get BloodHound Operator Permission

Syntax:

Get-BHOperatorPermission [-Current]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHPermission

See Help BHPermission for more info



BackToTop


Get-BHOperatorRole

Alias: BHRole

Get BloodHound Operator Role

Syntax:

Get-BHOperatorRole [-Current]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHRole

See Help BHRole for more info



BackToTop


Revoke-BHOperatorSecret

Alias: Revoke-BHSecret

Revoke BloodHound Operator Secret

Syntax:

Revoke-BHOperatorSecret [-OperatorID] <string> [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Revoke-BHSecret

See Help Revoke-BHSecret for more info



BackToTop


Set-BHOperatorSecret

Alias: Set-BHSecret

Set BloodHound Operator Secret

Syntax:

Set-BHOperatorSecret [-OperatorID] <string> [[-Secret] <string>] [-RequireReset] [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Set-BHSecret

See Help Set-BHSecret for more info



BackToTop


Get-BHOperatorToken

Alias: BHToken

Get BloodHound Operator Token

Syntax:

Get-BHOperatorToken [[-Operator] <string[]>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHToken

See Help BHToken for more info



BackToTop


New-BHOperatorToken

Alias: New-BHToken

New BloodHound Operator Token

Syntax:

New-BHOperatorToken [-OperatorID] <string> [[-TokenName] <string>] [-AsPlainText] [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > New-BHToken -ID $OperatorID -TokenName $TokenName

See Help New-BHToken for more info



BackToTop


Revoke-BHOperatorToken

Alias: Revoke-BHToken

Revoke BloodHound Operator Token

Syntax:

Revoke-BHOperatorToken [[-TokenID] <string[]>] [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Revoke-BHToken

See Help Revoke-BHToken for more info



BackToTop



BHDATA

Get-BHData

Alias: BHData

Get BloodHound Data

Syntax:

Get-BHData [[-ID] <string[]>] [-Limit <int>] [-Filter <string[]>] [-Expand <string>] 

Get-BHData -ListDomain [-Collected] [-Limit <int>] [-Filter <string[]>] [-Expand <string>] 

Get-BHData -Platform <string> [-Limit <int>] [-Filter <string[]>] [-Expand <string>] 

Get-BHData -PipeStatus [-Limit <int>] [-Filter <string[]>] [-Expand <string>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHData -ListDomain


-------------------------- EXAMPLE 2 --------------------------

PS > BHData -Platform AD


-------------------------- EXAMPLE 3 --------------------------

PS > BHData -id $DomainID


-------------------------- EXAMPLE 4 --------------------------

PS > BHData

See Help BHData for more info



BackToTop


Start-BHDataAnalysis

Alias: BHDataAnalysis

Start BloodHound Data Analysis

Syntax:

Start-BHDataAnalysis

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Start-BHDataAnalysis

See Help BHDataAnalysis for more info



BackToTop


Clear-BHDatabase

Clear BloodHound Database

Syntax:

Clear-BHDatabase [-GraphData] [-IngestHistory] [-DataHistory] [-Force] [-Really]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Clear-BHDatabase -GraphData -Force -Really

See Help Clear-BHDatabase for more info



BackToTop


Get-BHDataCollector

Alias: BHCollector

Get BloodHound Data Collector

Syntax:

Get-BHDataCollector [[-Collector] <string[]>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Get-BHDataCollector

See Help BHCollector for more info



BackToTop


Import-BHDataCollector

Alias: Import-BHCollector

Import BloodHound Data Collector

Syntax:

Import-BHDataCollector -SharpHound [-Version <string>] [-Unzip] 

Import-BHDataCollector -AzureHound [-Version <string>] [-Unzip]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Import-BHDataCollector -SharpHound

See Help Import-BHCollector for more info



BackToTop


Get-BHDataPosture

Alias: BHPosture

[BHE] Get BloodHound Data Posture

Syntax:

Get-BHDataPosture -DomainID <string[]> [-Limit <int>] [-StartDate <datetime>] [-EndDate <datetime>] 

Get-BHDataPosture -DomainID <string[]> -Exposure [-StartDate <datetime>] [-EndDate <datetime>] 

Get-BHDataPosture -DomainID <string[]> -Findings [-StartDate <datetime>] [-EndDate <datetime>] 

Get-BHDataPosture -DomainID <string[]> -Assets [-StartDate <datetime>] [-EndDate <datetime>] 

Get-BHDataPosture -DomainID <string[]> -GroupCompleteness [-StartDate <datetime>] [-EndDate <datetime>] 

Get-BHDataPosture -DomainID <string[]> -SessionCompleteness [-StartDate <datetime>] [-EndDate <datetime>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Get-BHDataPosture


-------------------------- EXAMPLE 2 --------------------------

PS > BHSearch Domain test | BHPosture -Exposure -StartDate (date).adddays(-30)

See Help BHPosture for more info



BackToTop


Read-BHDataSource

Alias: BHRead

Read BloodHound Data Source

Syntax:

Read-BHDataSource [-Source] <string[]> [[-Split] <int>] [-Unpack]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Read-BHDataSource $Zip -Split 5000

See Help BHRead for more info



BackToTop


Get-BHDataUpload

Alias: BHUpload

Get BloodHound Data Upload

Syntax:

Get-BHDataUpload [[-Expand] <string>] [[-Limit] <int>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Get-BHDataUpload


-------------------------- EXAMPLE 2 --------------------------

PS > Get-BHDataUpload -limit 10

See Help BHUpload for more info



BackToTop


Invoke-BHDataUpload

Alias: BHDataUpload

Invoke BloodHound Data Upload

Syntax:

Invoke-BHDataUpload [-Data] <string[]> [[-Split] <int>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHDataUpload $Zip

See Help BHDataUpload for more info



BackToTop


New-BHDataUpload

Alias: BHDataUploadJSON

New BloodHound Data Upload

Syntax:

New-BHDataUpload [-UploadJSON] <string[]>

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHDataUploadJSON $JSON

See Help BHDataUploadJSON for more info



BackToTop



BHNODE

Format-BHNode

Alias: BHFormat

Format BloodHound Node

Syntax:

Format-BHNode [-Object] <psobject> [-PropOnly]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHFormat

See Help BHFormat for more info



BackToTop


Get-BHNode

Alias: BHNode

Get BloodHound Node

Syntax:

Get-BHNode [[-List] <string>] [-ObjectID] <string[]> [-PropOnly] [-Expand <string>] [-AsPath] [-Limit <int>] [-Cypher] [-SessionID <int[]>] 

Get-BHNode [[-List] <string>] [[-Keyword] <string[]>] -Search [-PropOnly] [-Expand <string>] [-AsPath] [-Limit <int>] [-Cypher] [-SessionID <int[]>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

BHNode User -id <id>


-------------------------- EXAMPLE 2 --------------------------

PS > BHNode -Search User alice


-------------------------- EXAMPLE 3 --------------------------

PS > bhnode -search user yoda -list controllers


-------------------------- EXAMPLE 4 --------------------------

PS > bhnode -search user yoda -list controllers -AsPath [-Cypher] # EXPERIMENTAL - DO NOT TRUST OUTPUT

See Help BHNode for more info



BackToTop


Search-BHNode

Alias: BHSearch

Search BloodHound Node

Syntax:

Search-BHNode [[-Label] <BHEntityType[]>] [[-Keyword] <string[]>] [-Limit <int>] [-Exact] [-SessionID <int[]>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHSearch user bob

See Help BHSearch for more info



BackToTop


Remove-BHNodeFromNodeGroup

Remove BHNode From BHNodeGroup

Syntax:

Remove-BHNodeFromNodeGroup [-ObjectID] <string[]> [-NodeGroupID] <int[]> [-Analyse] [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHSearch User alice | Remove-BHNodeFromNodeGroup -NodeGroupID 1

See Help Remove-BHNodeFromNodeGroup for more info



BackToTop


Get-BHNodeGroup

Alias: BHNodeGroup

Get BloodHound Asset Group

Syntax:

Get-BHNodeGroup [[-ID] <string[]>] [-Selector] 

Get-BHNodeGroup [-ID] <string[]> -Member [-EnvironmentID <string>] [-Count] 

Get-BHNodeGroup [-ID] <string[]> 

Get-BHNodeGroup [-ID] <string[]> -CustomCount

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHNodeGroup

See Help BHNodeGroup for more info



BackToTop


New-BHNodeGroup

New BloodHound Asset Group

Syntax:

New-BHNodeGroup [-Name] <string> [[-Tag] <string>] [-PassThru]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > New-BHNodeGroup TestGroup

See Help New-BHNodeGroup for more info



BackToTop


Remove-BHNodeGroup

Remove BloodHound Asset Group

Syntax:

Remove-BHNodeGroup [-ID] <int[]> [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Remove-BHNodeGroup 2

See Help Remove-BHNodeGroup for more info



BackToTop


Set-BHNodeGroup

Set BloodHound Asset Group

Syntax:

Set-BHNodeGroup [-ID] <int> [-Name] <string>

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Set-BHNodeGroup -ID $GroupID -Name $NewName

See Help Set-BHNodeGroup for more info



BackToTop


Get-BHNodeMeta

Alias: BHMeta

[BHE] Get BloodHound Entity Meta

Syntax:

Get-BHNodeMeta [-ID] <string[]>

Examples:

-------------------------- EXAMPLE 1 --------------------------

BHMeta <objectID>

See Help BHMeta for more info



BackToTop


Add-BHNodeToNodeGroup

Add BHNode To BHNodeGroup

Syntax:

Add-BHNodeToNodeGroup [-ObjectID] <string[]> [-NodeGroupID] <int> [-Analyze] [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHSearch User alice | Add-BHNodeToNodeGroup -NodeGroupID 1

See Help Add-BHNodeToNodeGroup for more info



BackToTop



BHPATH

Get-BHPath

Alias: BHCypher

Get BloodHound Path

Syntax:

Get-BHPath [-Query] <string> [-Cypher] [-NoConvert] [-Minimal] [-Expand <string>] 

Get-BHPath -TargetID <string[]> [-All] [-Shortest] [-SourceID <string[]>] [-Edge <string[]>] [-Hop <string>] [-SourceWhere <string>] [-TargetWhere <string>] [-PathWhere <string>] [-Return <string>] [-OrderBy <string>] [-Limit <int>] [-Cypher] [-NoConvert] [-Minimal] [-Expand <string>] 

Get-BHPath [-All] [-Shortest] [-Source <string>] [-Target <string>] [-Edge <string[]>] [-Hop <string>] [-SourceWhere <string>] [-TargetWhere <string>] [-PathWhere <string>] [-Return <string>] [-OrderBy <string>] [-Limit <int>] [-Cypher] [-NoConvert] [-Minimal] [-Expand <string>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHPath

See Help BHCypher for more info



BackToTop


Get-BHPathComposition

Alias: BHComposition

Get BloodHound Path Composition

Syntax:

Get-BHPathComposition [-SourceID] <string> [-TargetID] <string> [-EdgeType] <string>

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Get-BHPathComposition -SourceID $x -EdgeType $r -TargetID $y


-------------------------- EXAMPLE 2 --------------------------

BHPath "MATCH p=(:User{name:'$UserName'})-[:ADCSESC1]->(:Domain) RETURN p" | BHComposition | ft

See Help BHComposition for more info



BackToTop


Get-BHPathFilter

Alias: BHFilter

Get BloodHound Path Filter

Syntax:

Get-BHPathFilter [-String] [-Cypher] 

Get-BHPathFilter -ListAll

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHFilter

See Help BHFilter for more info



BackToTop


Select-BHPathFilter

Alias: BHFilterSelect

Select BloodHound Path Filter

Syntax:

Select-BHPathFilter -All 

Select-BHPathFilter -None 

Select-BHPathFilter -Platform <BHPlatform[]> [-NoSelect] 

Select-BHPathFilter -EdgeGroup <BHEdgeGroup[]> [-NoSelect] 

Select-BHPathFilter -Edge <BHEdge[]> [-NoSelect]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Select-BHFilter

See Help BHFilterSelect for more info



BackToTop


Approve-BHPathFinding

Alias: Approve-BHFinding

[BHE] Approve BloodHound Path Finding

Syntax:

Approve-BHPathFinding [-ID] <int[]> [-FindingType] <BHFindingType> [-Accepted] <bool> [[-Until] <datetime>] [-Force] [-PassThru]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Approve-BHPathFinding -ID $id [-Force]

See Help Approve-BHFinding for more info



BackToTop


Get-BHPathFinding

Alias: BHFinding

[BHE] Get BloodHound Path Finding

Syntax:

Get-BHPathFinding [-TypeList] 

Get-BHPathFinding [-DomainID] <string[]> -ListAvail 

Get-BHPathFinding [-DomainID] <string[]> -Detail [-FindingType <BHFindingType[]>] [-Limit <int>] 

Get-BHPathFinding [-DomainID] <string[]> -Sparkline [-FindingType <BHFindingType[]>] [-StartDate <datetime>] [-EndDate <datetime>] [-Limit <int>] 

Get-BHPathFinding [-DomainID] <string[]> -Trend [-StartDate <datetime>] [-EndDate <datetime>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHFinding -TypeList


-------------------------- EXAMPLE 2 --------------------------

PS > BHFinding -ListAvail -DomainID $ID


-------------------------- EXAMPLE 3 --------------------------

PS > BHFinding -Detail -DomainID $ID -Type Kerberoasting


-------------------------- EXAMPLE 4 --------------------------

PS > BHSearch Domain | BHFinding -Trend -Verbose -start (date).adddays(-10)

See Help BHFinding for more info



BackToTop


Start-BHPathFinding

Alias: BHPathAnalysis

[BHE] Start BloodHound Path Finding

Syntax:

Start-BHPathFinding

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Start-BHPathFinding

See Help BHPathAnalysis for more info



BackToTop


Get-BHPathFindingInfo

Alias: BHFindingInfo

Get-BHPathFindingInfo [[-FindingType] <BHFindingType[]>] [-Full] [-OutMarkDown] []

Syntax:

Get-BHPathFindingInfo [[-FindingType] <BHFindingType[]>] [-Full] [-OutMarkDown]

Examples:

-------------------------- EXAMPLE 1

See Help BHFindingInfo for more info



BackToTop


Get-BHPathQuery

Alias: BHQuery

Get BloodHound Query

Syntax:

Get-BHPathQuery [[-ID] <string[]>] [-Expand <string>] 

Get-BHPathQuery -Name <string[]> [-Expand <string>] 

Get-BHPathQuery -Scope <string> [-Expand <string>] 

Get-BHPathQuery -Description <string[]> [-Expand <string>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > BHQuery


-------------------------- EXAMPLE 2 --------------------------

PS > BHQuery -ID 123


-------------------------- EXAMPLE 3 --------------------------

PS > BHQuery -name MyQuery


-------------------------- EXAMPLE 4 --------------------------

BHQuery -description <keyword>


-------------------------- EXAMPLE 5 --------------------------

BHQuery -scope <shared|public>

See Help BHQuery for more info



BackToTop


Invoke-BHPathQuery

Alias: BHInvoke

Invoke BloodHound Query

Syntax:

Invoke-BHPathQuery [-Query] <string> [[-Description] <string>] [[-Name] <string>] [[-ID] <string>] [[-Param] <hashtable>] [[-Expand] <string>] [[-Select] <string[]>] [-Minimal] [-Cypher]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Invoke-BHQuery "MATCH (x:User) RETURN x LIMIT 1"


-------------------------- EXAMPLE 2 --------------------------

PS > Invoke-BHQuery "api/version"


-------------------------- EXAMPLE 3 --------------------------

PS > BHQuery -ID 123 | BHInvoke


-------------------------- EXAMPLE 4 --------------------------

PS > "MATCH (x{objectid:'${oid}'}) RETURN x" | BHInvoke -Param @{oid='S-1-5-21-928081958-2569533466-1777930793-1800'}

See Help BHInvoke for more info



BackToTop


New-BHPathQuery

Alias: New-BHQuery

New BloodHound Query

Syntax:

New-BHPathQuery [-Name] <string> [[-Description] <string>] [-Query] <string> [-PassThru]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > New-BHPathQuery -Name MySavedQuery -Query "MATCH (x:User) RETURN x LIMIT 1" -Desc "My Saved Query"

See Help New-BHQuery for more info



BackToTop


Remove-BHPathQuery

Alias: Remove-BHQuery

Remove BloodHound Saved Query

Syntax:

Remove-BHPathQuery [-ID] <string> [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

Remove-BHPathQuery -id <QueryID>-Force

See Help Remove-BHQuery for more info



BackToTop


Set-BHPathQuery

Alias: Set-BHQuery

Set BloodHound Query

Syntax:

Set-BHPathQuery [-ID] <int> [[-Name] <string>] [[-Query] <string>] [[-Description] <string>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Set-BHPathQuery -ID 123 -Name MySavedQuery

See Help Set-BHQuery for more info



BackToTop


Set-BHPathQueryScope

Alias: Set-BHQueryScope

Set BloodHound Query Scope

Syntax:

Set-BHPathQueryScope [-ID] <int> -Public 

Set-BHPathQueryScope [-ID] <int> -Private 

Set-BHPathQueryScope [-ID] <int> -Share <string[]> [-Remove]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Set-BHQueryScope -ID 123 -Public


-------------------------- EXAMPLE 2 --------------------------

PS > Set-BHQueryScope -ID 123 -Private


-------------------------- EXAMPLE 3 --------------------------

Set-BHQueryScope -ID 123 -Share <UserID[]>


-------------------------- EXAMPLE 4 --------------------------

Set-BHQueryScope -ID 123 -Share <UserID[]>-Remove

See Help Set-BHQueryScope for more info



BackToTop



BHCLIENT

Get-BHClient

Alias: BHClient

[BHE] Get BloodHound Client

Syntax:

Get-BHClient 

Get-BHClient -ID <string[]> [-CompletedJobs]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Get-BHClient -ID $ClientID


-------------------------- EXAMPLE 2 --------------------------

PS > Get-BHClient -ID $ClientID -CompletedJobs

See Help BHClient for more info



BackToTop


New-BHClient

[BHE] New BloodHound Client

Syntax:

New-BHClient [-Name] <string[]> [-ClientType] <string> [[-DomainController] <string>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > $Client = @{
Prop = value
}
New-BHClient @Client

See Help New-BHClient for more info



BackToTop


Remove-BHClient

[BHE] Remove-BloodHound Client

Syntax:

Remove-BHClient [-ID] <string> [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Example

See Help Remove-BHClient for more info



BackToTop


Set-BHClient

[BHE] Set BloodHound Client

Syntax:

Set-BHClient [-ID] <string> [[-Name] <string>] [[-DomainController] <string>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Example

See Help Set-BHClient for more info



BackToTop


Get-BHClientJob

Alias: BHJob

[BHE] Get BloodHound Client Job

Syntax:

Get-BHClientJob [-ClientID <string[]>] [-Status <int>] [-Limit <int>] 

Get-BHClientJob -IncludeUnfinished [-ClientID <string[]>] [-Status <int>] [-Only] 

Get-BHClientJob -JobID <string> [-Logs]

Examples:

-------------------------- EXAMPLE 1 --------------------------

Get-BHClientJob [-status <status>] [-ClientID <client_id>]


-------------------------- EXAMPLE 2 --------------------------

PS > BHJob -IncludeUnfinished [-Only]


-------------------------- EXAMPLE 3 --------------------------

PS > BHJob -JobId 1234 [-log]

See Help BHJob for more info



BackToTop


Remove-BHClientJob

Alias: Remove-BHJob

[BHE] Remove BloodHound Client Job

Syntax:

Remove-BHClientJob [-ID] <string> [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Remove-BHClientJob -Id $JobId

See Help Remove-BHJob for more info



BackToTop


Start-BHClientJob

Alias: Start-BHJob

[BHE] Start BloodHound Client Job

Syntax:

Start-BHClientJob [-ClientID] <string[]> [[-OU] <string[]>] [[-Domain] <string[]>] [-SessionCollection] [-LocalGroupCollection] [-ADStructureCollection] [-CertServiceCollection] [-CARegistryCollection] [-DCRegistryCollection] [-AllDomain] [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Start-BHClientJob

See Help Start-BHJob for more info



BackToTop


New-BHClientToken

[BHE] New BloodHound Client Token

Syntax:

New-BHClientToken [-ID] <string[]> [-AsPlainText] [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > New-BHClientToken -id $ClientID [-Force]

See Help New-BHClientToken for more info



BackToTop



BHEVENT

Get-BHEvent

[BHE] Get BloodHound Client Event

Syntax:

Get-BHEvent -EventID <string[]> 

Get-BHEvent [-ClientID <string[]>]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Get-BHEvent

See Help Get-BHEvent for more info



BackToTop


New-BHEvent

[BHE] New BloodHound Client Event

Syntax:

New-BHEvent [[-ClientID] <string[]>] [[-Rule] <string>] [[-OU] <string[]>] [[-Domain] <string[]>] [-SessionCollection] [-LocalGroupCollection] [-ADStructureCollection] [-CertServiceCollection] [-CARegistryCollection] [-DCRegistryCollection] [-AllDomain]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > New-BHEvent

See Help New-BHEvent for more info



BackToTop


Remove-BHEvent

[BHE] Remove BloodHound Client Event

Syntax:

Remove-BHEvent [-ID] <string> [-Force]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Remove-BHEvent $EventID

See Help Remove-BHEvent for more info



BackToTop


Set-BHEvent

[BHE] Set BloodHound Client Event

Syntax:

Set-BHEvent [-ID] <string[]> [[-Rule] <string>] [[-SessionCollection] <bool>] [[-LocalGroupCollection] <bool>] [[-ADStructureCollection] <bool>] [[-CertServiceCollection] <bool>] [[-CARegistryCollection] <bool>] [[-DCRegistryCollection] <bool>] [[-AllDomain] <bool>] [[-OU] <string[]>] [[-Domain] <string[]>] [-PassThru]

Examples:

-------------------------- EXAMPLE 1 --------------------------

PS > Set-BHEvent

See Help Set-BHEvent for more info



BackToTop



Thursday, March 13, 2025 10:15:06 AM