Windows_OS

Bloodhound custom queries to find Windows OS versions in AD.

Open up the customqueries.json file location C:\Users\Add-Account-Name\AppData\Roaming\bloodhound\customqueries.json then add the following custom queries to hunt out Windows OS versions. Once saved hit the refresh key under custom queries section.

You can use it to hunt out OS in AD with or without active user sessions on the hosts.

 {
            "name": "Find Server 2000",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2000).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Server 2000 with session",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2000).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Server 2003",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2003).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Server 2003 with session",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2003).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Server 2008",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2008).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Server 2008 with session",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2008).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Windows XP",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(xp).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Windows XP with session",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(xp).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Windows 7",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(7).*' RETURN H"
                }
            ]
        },


 {
            "name": "Find Windows 7 session",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(7).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Server 2012",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2012).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Server 2012 with session",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2012).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Server 2016",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2016).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Server 2016 with session",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2016).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Server 2019",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).*(2019).*' RETURN H"
                }
            ]
        },

 {
            "name": "Find Server 2019 with session",
            "queryList": [
                {
                    "final": true,
                    "query": "MATCH (H:Computer)-[:HasSession]->(y) WHERE H.operatingsystem =~ '(?i).*(2019).*' RETURN H"
                }
            ]
        },