From c8414be74a1683cb0e8180bb83fe70d07a4b7838 Mon Sep 17 00:00:00 2001 From: Mohit Gupta Date: Tue, 8 Oct 2024 18:06:03 +0100 Subject: [PATCH] adds another query example to the README --- README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/README.md b/README.md index fe29c6e..5ba993c 100644 --- a/README.md +++ b/README.md @@ -72,6 +72,19 @@ This performs the same, but restricts the query to start at nodes of type Pod / MATCH p = SHORTEST 1 (src)-[r {attack_path: 1}]->+(crb:ClusterRoleBinding)-[:GRANTS_PERMISSION {attack_path: 1}]->(cr:ClusterRole {name: "cluster-admin"}) WHERE (src:ServiceAccount OR src:Pod or src:User or src:Group) RETURN p ``` +Using the old `shortestPath` syntax: + +```cypher +MATCH (crb:ClusterRoleBinding)-[r:GRANTS_PERMISSION {attack_path: 1}]->(cr:ClusterRole {name: 'cluster-admin'}) +WITH crb, cr, r +MATCH (src) WHERE src:ServiceAccount OR src:Pod OR src:User or src:Group +WITH src, crb, cr, r +UNWIND src as s +MATCH p=shortestPath((s)-[*]->(crb)) +WHERE all(r in relationships(p) where r.attack_path is not null) +RETURN p, cr, r +``` + ## Acknowledgements - [BloodHound](https://github.com/BloodHoundAD/BloodHound) - The original project showing the power of graph databases for security