Graph

Graph shows every edge between the entities of the scanned environments: Active Directory, Entra ID and Azure resources, AWS, GCP and GitHub. Objects from different platforms are drawn on the same graph, together with the edges that connect them.

Use it to find the attack paths caused by the relationships and access control entries between these entities.

Initial Foothold

When the Graph page is opened from the menu, it draws a starting node that depends on the platforms scanned in the selected scan:

• Active Directory scanned: the Domain Admins group.

• Otherwise Azure: the Global Administrator role.

• Otherwise GCP: the first GCP user whose name contains "admin".

• Otherwise AWS: the first IAM user whose name contains "admin".

• Otherwise GitHub: the enterprise, or every organization when no enterprise was collected.

Any entity can be opened as the starting node from the Graph » button (Admin Path » for shadow admins) in the header of its detail page, or from the search box on the top bar.

The graph can also be opened with a query already run:

• The shortest path links on entity detail pages open the graph with that query applied to the entity. If no path is found, the page shows "No path found with your current relationship filters. You can adjust them in graph settings."

• A saved search in Search & Reports can be drawn on the graph.

Graph Module

Hover over a node to see its entity type.

Each node is drawn as a coloured circle with the icon of its entity type. A small badge on its lower-right edge shows the provider the object came from: Active Directory, Azure, AWS, GCP or GitHub. A Tier 0 object additionally carries a crown badge above the node.

Active Directory Icon-to-Entity Mapping

Icon	Entity Type
	Forest
	Domain
	Unknown Trust (trusted domain that was not scanned)
	Container
	Organizational Unit
	User
	Group
	Computer (domain controllers, servers and clients)
	Group Policy Object
	GPO Owned Script
	Managed Service Account
	Group Managed Service Account
	Delegated Managed Service Account
	Local User
	Local Group
	Service Principal Name
	Certificate Authority
	Certificate Template
	CA Certificate
	Fine Grained Password Policy
	DNS Zone

Azure Icon-to-Entity Mapping

Icon	Entity Type
	Tenant
	User
	Group
	Device
	Application
	Service Principal
	Role
	Administrative Unit
	Conditional Access Policy
	Application Secret
	Application Certificate
	Application Federated Credential
	Management Group
	Subscription
	Resource Group
	ARM Role
	Virtual Machine
	VM Scale Set
	Managed Cluster (AKS)
	Web App
	Function App
	Logic App
	Automation Account
	Container Registry
	Storage Account
	Storage Container
	Key Vault
	SQL Server
	User-Assigned Managed Identity
	Teams Settings
	Teams Meeting Policy
	Teams Messaging Policy
	Teams External Access Settings
	SharePoint Settings
	SharePoint Site

GCP Icon-to-Entity Mapping

Icon	Entity Type
	Customer
	Organization
	Organizational Unit
	Folder
	Project
	User
	Group
	Service Account
	Service Account Key
	Role
	Device
	Principal
	Workforce Identity Pool
	Workforce Provider
	Workload Identity Pool
	Workload Provider
	VM Instance
	KMS Key

AWS Icon-to-Entity Mapping

Icon	Entity Type
	Organization
	Organizational Unit
	Account
	IAM User
	IAM Group
	IAM Role
	IAM Policy
	IAM Access Key
	Identity Center
	SSO User
	SSO Group
	Permission Set

GitHub Icon-to-Entity Mapping

Icon	Entity Type
	Enterprise
	Organization
	User
	Team
	Repository
	Organization Role
	App Installation

Other Nodes

Icon	Entity Type
	Cluster (neighbours grouped with Cluster Options)
	Unified Identity
	Scan
	Vulnerability

Every node type above has its own icon. A type with no icon of its own is drawn with the computer icon.

Graph Canvas Controls

Use the mouse wheel to zoom in and out, and drag the background to move around the graph. Drag a node to move it.

Search: The Search... box in the upper-left corner searches the nodes that are currently drawn on the graph and moves the view to the selected node.

Slide Bar: The vertical slider on the lower left corner limits the number of results a query returns. The range is 50 to 2000 in steps of 50, and the default is 100. In large environments, common objects can have tens of thousands of relation paths.

Graph Visualization Controls

Zoom In / Zoom Out: Zooms the graph in or out.

Reset View: Centers the graph.

Full Screen: Shows the graph in full screen.

Edge Highlights: When enabled, the relationships of the node under the mouse cursor are highlighted while hovering over it.

Show Outgoing Edges from Cluster Nodes: When enabled, outgoing relationships from clustered nodes (see Right-Click Menu) are displayed.

Layout: The Layout menu at the bottom shows the current layout and changes it:

• Sequential Down: Hierarchical layout from top to bottom.

• Sequential Right: Hierarchical layout from left to right (the default).

• Standard: Iterative force-directed layout.

The canvas settings (slider value, Edge Highlights, layout) are remembered in the browser.

Right-Click Menu

Right-clicking a node opens a menu with three groups:

• HIDE NODE: Removes the node from the drawing.

• Cluster Options: Groups the neighbours of the node into cluster nodes to keep large graphs readable:

  • Incoming All / Outgoing All: Groups all incoming or outgoing neighbours into one cluster node.

  • Entity Type: Groups the incoming (left button) or outgoing (right button) neighbours by entity type.

  • Rel Type: Groups the incoming (left button) or outgoing (right button) neighbours by relation type.

  On a cluster node the menu offers OPEN for the option that created it, which expands the cluster again.

• Filter Options: Lists every relation type of the node with its number of incoming (left) and outgoing (right) relations, for example →0 IN_SCAN 1→. Clicking a count adds the neighbours connected with that relation to the graph.

Right-click menu

The right-click menu is not available with a trial licence.

Built-in Graph Features

Click a node or edge to open the operation pane on the right side of the graph. Drag the pane's edge to resize it.

The pane has five tabs:

• Info (The queries varies according to the selected entity type)

• ACL List

• Queries (Fixed)

• Path Finder (Fixed)

• Settings (Fixed)

Side Pane

The identifier information of the selected node is shown above the tabs, so it stays visible on every tab:

• FSName: Name of the node. It links to the entity's detail page (opens in a new tab).

• DN: Distinguished name, where the object has one.

• Type: Entity type, followed by its tier, for example Group, Tier0.

• Guid and Id.

Info Tab

For a selected node, the Info tab contains built-in graph queries in two sections:

• Node Queries: Queries that vary according to the selected entity type (see Node Specific Built-in Queries).

• Shortest Path Queries: Shortest path queries of the platform the selected node belongs to. Only the queries of that platform are listed. For example, an AWS node shows only the AWS queries.

These built-in queries find the most common incoming and outgoing attack paths.

For a selected edge, the Info tab shows the edge's Id, its properties (for example Role Guid, SourceObjectFSName or Role Assignment Resource, linked to the related objects) and the documentation of the relation type in collapsible sections, such as its abuse and remediation information.

Edge information

ACL List Tab

The ACL List tab lists the relations of the selected node that are drawn on the graph, in two collapsible tables: Incoming Relations - N and Outgoing Relations - N. The columns are Type, Relation and FSName. Each column can be sorted and has a text filter. Clicking an FSName moves the view to that node.

For a cluster node, the columns are From Type, From Node, Relation, To Type and To Node.

ACL List

Shortest Path Queries - Active Directory Built-in Queries

These shortest path queries are listed for every Active Directory entity type, regardless of the selected node.

Get Shortest Path to AD Admin Objects: Finds the shortest path from the selected node to administrative objects.

Get All AD Shortest Path to Here: Finds the shortest path from any Active Directory node to the selected node.

Get All AD Shortest Path to Here from Non-Privileged Objects: Finds the shortest privilege escalation path from non privileged Active Directory objects, such as standard users or computers, to the selected node.

Get All AD Shortest Path to Here from Everyone-Like Objects: Identifies the shortest paths from broadly accessible identities, such as Domain Users or Authenticated Users, to the selected object.

Get AD Shortest Path to Here from Cross Domain/Forest: Finds the shortest path from any node that belongs to another domain or forest to the selected node.

Get AD Shortest Path to Cross Domain/Forest: Finds the shortest path from the selected node to any node that belongs to another domain or forest.

Get Shortest Path to Hybrid Admin Objects (AD->Azure): Finds the shortest attack path from on-premises Active Directory objects to hybrid administrative objects in Azure environments.

Calculation of the shortest paths is according to the hop numbers between edges. Only the relations enabled on the Settings tab are used.

The example below finds the shortest paths to the Domain Admins object of the fsprotect.io domain.

Get All AD Shortest Path to Here

Shortest Path Queries - Azure Built-in Queries

These shortest path queries are listed for every Azure entity type, regardless of the selected Azure object.

Get Shortest Path to Azure Admin Objects: Finds the shortest path from the selected Azure identity to Azure administrative (Tier 0) objects.

Get All Azure Shortest Path to Here: Finds the shortest path from any Azure identity to the selected Azure object.

Get All Azure Shortest Path to Here from Non-Privileged Objects: Finds the shortest privilege escalation path from non-privileged Azure identities, such as standard users or service principals, to the selected Azure object.

Get Shortest Path to Hybrid Admin Objects (Azure->AD): Finds the shortest attack path from Azure identities to hybrid administrative objects in on-premises Active Directory environments.

Azure shortest path queries

Shortest Path Queries - GCP Built-in Queries

Get Shortest Path to GCP Admin Objects: Finds the shortest path from the selected GCP object to GCP Tier 0 objects.

Get All GCP Shortest Path to Here: Finds the shortest path from any GCP object to the selected object.

Get All GCP Shortest Path to Here from Non-Privileged Objects: Finds the shortest path from non-privileged GCP objects to the selected object, through non-privileged objects only.

Shortest Path Queries - AWS Built-in Queries

Get Shortest Path to AWS Admin Objects: Finds the shortest path from the selected AWS object to Tier 0 objects. For an object that can escalate its own privileges, it shows that self-escalation instead.

Get All AWS Shortest Path to Here: Finds the shortest path from any AWS object to the selected object.

Get All AWS Shortest Path to Here from Non-Privileged Objects: Finds the shortest path from non-privileged AWS objects to the selected object, through non-privileged objects only.

Find AWS Self-Escalation: Finds the policy-modification relations with which the selected object can escalate its own privileges (for example attaching or putting a policy on itself or on its group, or changing a policy version or permission set).

Get Shortest Path to AWS Tier 0 Objects: Finds the shortest path from the selected object to AWS Tier 0 objects.

Get Shortest Path to AWS Privileged Objects: Finds the shortest path from the selected object to privileged AWS objects that are not Tier 0.

Find AWS Cross-Account Attack Paths: Finds the shortest paths from the selected object to Tier 0 or privileged objects in another AWS account.

Shortest Path Queries - GitHub Built-in Queries

Get Shortest Path to GitHub Admin Objects: Finds the shortest path from the selected GitHub object to GitHub Tier 0 objects.

Get All GitHub Shortest Path to Here: Finds the shortest path from any GitHub object to the selected object.

Get All GitHub Shortest Path to Here from Non-Privileged Objects: Finds the shortest path from non-privileged GitHub objects to the selected object, through non-privileged objects only.

Active Directory Node Specific Built-in Queries

Forest - Node Specific Built-in Queries

• Get Trust Relations: Trust relations between this forest and other domains/forests.

Domain - Node Specific Built-in Queries

• Dangerous access control entries on this domain: Directly incoming access control entries from non-privileged objects to this domain node. Owners of the access control entries have permission to perform critical operations on this node. (See Relations)

• Get Trust Relations: Trust relations between this domain node and other domains/forests.

Computer - Node Specific Built-in Queries

Includes all the domain controllers, servers and clients.

• Who can read this computer password ?: The attack paths that allow other entities to read the selected computer's password.

• Who can rdp into this computer?: The attack paths that allow other entities to connect with Remote Desktop Protocol to the selected computer.

• Who can exec command on this computer?: The attack paths that allow other entities to execute command with DCOM, Powershell, and etc. on the selected computer.

• Find nested group memberships: Reveals the nested parent group membership paths of the selected computer.

• Explicit local admin rights: The attack paths that grants the selected computer the Local Administrator rights on other computers. These attack paths are caused by direct/explicit membership in the Local Administrators group.

• Group delegated local admin rights: The attack paths that grants the selected computer the Local Administrator rights on other computers. These attack paths are caused by the nested membership in the Local Administrators group.

• Derivative local admin rights: It is very similar to the Group delegated local admin rights query. The only difference is, Derivative local admin rights takes the existing sessions into consideration which can be abused by impersonation or credential harvesting.

  • Example: Incoming - Derivative local admin rights on the [e-mail] domain controller;

Derivative Local Admin Rights

When no session is involved, the result shows the same paths as the group delegated query, as in the figure. In a derivative path, a user that has local admin rights on the target computer also has a SESSION on another computer. Any entity with local admin rights on that second computer can harvest the credentials, hashes or tickets of the user, or impersonate its processes, and so reach the target computer as a local administrator.

• Incoming - Explicit local admin rights: The attack paths that allow other entities to gain explicit local administrator privileges on the selected computer.

• Incoming - Group delegated local admin rights: The attack paths that allow other entities to obtain local administrator privileges on the selected computer through group-based delegation.

• Incoming - Derivative local admin rights: The attack paths that allow other entities to gain local administrator privileges on the selected computer indirectly, through sessions.

• Dangerous access control entries on this computer: Directly incoming access control entries from non-privileged objects to this computer node. Owners of the access control entries have permission to perform critical operations on this node. (See Relations)

• Group Policies can apply to this computer: The Group Policy Objects (GPOs) that can be applied to the selected computer and may affect its configuration, security settings, or privilege assignments.

User - Node Specific Built-in Queries

• Who can reset this users password?: The attack paths that allow other entities to reset the selected user's password.

• Find nested group memberships: Reveals the nested parent group membership paths of the selected user.

• Explicit local admin rights: The attack paths that grants the selected user node to the Local Administrator rights on the computer entities. These attack paths are caused by direct/explicit membership in the Local Administrators group in any computer.

• Group delegated local admin rights: The attack paths that grants the selected user node to the Local Administrator rights on the computer entities. These attack paths are caused by the nested membership in the Local Administrators group in any computer.

• Derivative local admin rights: The attack paths that grants the selected user node to the Local Administrator rights on the computer entities. It is very similar to the Group delegated local admin rights query. The only difference is, Derivative local admin rights takes the existing sessions into consideration which can be abused by impersonation or credential harvesting.

• Dangerous access control entries on this user: Directly incoming access control entries from non-privileged objects to this user node. Owners of the access control entries have permission to perform critical operations on this node. (See Relations)

• Group Policies can apply to this user: The Group Policy Objects (GPOs) that can be applied to the selected user and may affect the user's permissions, security settings, or policy-based configurations.

Group - Node Specific Built-in Queries

• Who Can Add Members to This Group ?: Find the entities that can add members to the selected group node.

• Find Nested Parent Groups: Reveals the nested parent group membership paths of the selected group.

• Find Nested Child Groups: Reveals the nested child group membership paths of the selected group.

• Explicit local admin rights: The attack paths that grants the selected group node to the Local Administrator rights on the computer entities. These attack paths are caused by direct/explicit membership in the Local Administrators group in any computer.

• Group delegated local admin rights: The attack paths that grants the selected group node to the Local Administrator rights on the computer entities. These attack paths are caused by the nested membership in the Local Administrators group in any computer.

• Dangerous access control entries on this group: Directly incoming access control entries from non-privileged objects to this group node. Owners of the access control entries have permission to perform critical operations on this node. (See Relations)

Group Policy Object - Node Specific Built-in Queries

• Who can edit this Group Policy?: Reveals the entities that can directly edit this group policy objects.

• Which nodes does this Group Policy apply to?: The nodes (such as users, computers, or organizational units) that the selected Group Policy Object (GPO) is applied to through scope, inheritance, and filtering rules.

• Dangerous access control entries on this Group Policy: Directly incoming access control entries from non-privileged objects to this group policy object node. Owners of the access control entries have permission to perform critical operations on this node. (See Relations)

Organizational Unit - Node Specific Built-in Queries

• Dangerous access control entries on this OU: Directly incoming access control entries from non-privileged objects to this organizational unit node. Owners of the access control entries have permission to perform critical operations on this node. (See Relations)

Managed Service Account - Node Specific Built-in Queries

The same queries are available for Group Managed Service Account and Delegated Managed Service Account nodes.

• Who can read this user password ?: The attack paths that allow other entities to read the selected account's password.

• Find nested group memberships: Reveals the nested parent group membership paths of the selected account.

• Explicit local admin rights: The attack paths that grants the selected account the Local Administrator rights on the computer entities. These attack paths are caused by direct/explicit membership in the Local Administrators group in any computer.

• Group delegated local admin rights: The attack paths that grants the selected account the Local Administrator rights on the computer entities. These attack paths are caused by the nested membership in the Local Administrators group in any computer.

• Dangerous access control entries on this account: Directly incoming access control entries from non-privileged objects to this account. Owners of the access control entries have permission to perform critical operations on this node. (See Relations)

Group Managed Service Account - Node Specific Built-in Queries

Same as Managed Service Account.

Delegated Managed Service Account - Node Specific Built-in Queries

Same as Managed Service Account.

Local Group - Node Specific Built-in Queries

• Get Domain Members of Local Group: Find the members of the selected local group that belong to the domain. Reveals the membership paths between domain environment to local environment.

Certificate Authority - Node Specific Built-in Queries

• Who can Request a Certificate from the Certificate Authority ?: Reveals the entities that have permission to enroll any certificate template published by the selected certificate authority node.

• Published Certificate Templates from this CA that Enables Domain Authentication & Arbitrary SAN: Finds the certificate templates published by the selected certificate authority node, that allow enrolled users to authenticate to the domain environment and specify arbitrary Subject Alternative Name.

Certificate Template - Node Specific Built-in Queries

• Who Have Enrollment Rights on the Certificate Template ?: Finds the entities that have permissions to enroll this certificate template node.

Cloud Node Specific Built-in Queries

Cloud nodes have their own node queries. Queries marked "(includes nested groups)" or "(includes inherited)" also follow nested group memberships or role assignments inherited from parent scopes. "Non-privileged identities" means identities that are neither privileged nor Tier 0.

Azure (Entra ID)

Node	Node Queries
Tenant	Who is Global Administrator on this tenant? (includes nested groups) Who holds a tenant-level privileged admin role? (Global / Security / Privileged Auth / Privileged Role / Intune Admin) Which guest accounts are Global Administrators on this tenant?
User	Who can reset this user's password? (includes nested groups) Who can reset this user's password from non-privileged identities? (not AZ-privileged, not Tier 0) Who can reset this user's password from guest accounts?
Group	Who can add members to this group? (includes nested groups) Who can add members to this group from non-privileged identities? (not AZ-privileged, not Tier 0) Who can add members to this group from guest accounts?
Application	Who can add credentials to this application (and sign in as it)? (includes nested groups) Who can add credentials to this application from non-privileged identities? (not AZ-privileged, not Tier 0) Who can add credentials to this application from guest accounts?
Service Principal	Who can take over this service principal (add credentials/owner or app admin)? (includes nested groups) Who can take over this service principal from non-privileged identities? (not AZ-privileged, not Tier 0) Who can take over this service principal from guest accounts?
Role	Who holds this directory role? (includes nested groups) Which guest accounts hold this directory role?
Device	Who owns this device? (includes nested groups)

Azure Resources (ARM)

Node	Node Queries
Management Group	Who owns this Management Group? (includes inherited) Who is contributor on this Management Group? (includes inherited) Who can assign roles on this Management Group? Who can modify role definitions on this Management Group? Who has access to this Management Group from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this Management Group from guest accounts?
Subscription	Who owns this Subscription? (includes inherited) Who is contributor on this Subscription? (includes inherited) Who can assign roles on this Subscription? Who can modify role definitions on this Subscription? Who has access to this Subscription from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this Subscription from guest accounts?
Resource Group	Who owns this Resource Group? (includes inherited) Who is contributor on this Resource Group? (includes inherited) Who can assign roles on this Resource Group? Who can modify role definitions on this Resource Group? Who has access to this Resource Group from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this Resource Group from guest accounts?
ARM Role	Who holds this ARM role? (includes nested groups) Where is this ARM role scoped? Which guest accounts hold this ARM role?
Virtual Machine	Who owns this VM? (includes inherited) Who is contributor on this VM? (includes inherited) Who is VM Contributor (or Avere Contributor) on this VM? (includes inherited) Who can execute commands on this VM? Who can admin-login to this VM? Who can SSH into this VM? Who can RDP into this VM? Who has access to this VM from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this VM from guest accounts?
VM Scale Set	Who owns this Scale Set? (includes inherited) Who is contributor on this Scale Set? (includes inherited) Who is VM Contributor on this Scale Set? (includes inherited) Who can execute commands on this Scale Set? Who has access to this Scale Set from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this Scale Set from guest accounts?
Managed Cluster	Who owns this cluster? (includes inherited) Who is contributor on this cluster? (includes inherited) Who is AKS Contributor on this cluster? (includes inherited) Who can execute commands on this cluster? Who can list cluster admin credentials? Who has access to this cluster from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this cluster from guest accounts?
Web App	Who owns this Web App? (includes inherited) Who is contributor on this Web App? (includes inherited) Who is Website Contributor on this Web App? (includes inherited) Who can execute commands / deploy code to this Web App? Who has access to this Web App from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this Web App from guest accounts?
Function App	Who owns this Function App? (includes inherited) Who is contributor on this Function App? (includes inherited) Who is Website Contributor on this Function App? (includes inherited) Who can execute commands / deploy code to this Function App? Who has access to this Function App from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this Function App from guest accounts?
Logic App	Who owns this Logic App? (includes inherited) Who is contributor on this Logic App? (includes inherited) Who is Logic App Contributor on this Logic App? (includes inherited) Who can modify / run this Logic App? Who has access to this Logic App from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this Logic App from guest accounts?
Automation Account	Who owns this Automation Account? (includes inherited) Who is contributor on this Automation Account? (includes inherited) Who is Automation Contributor on this Automation Account? (includes inherited) Who can control this Automation Account (run runbooks as its identity)? Who has access to this Automation Account from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this Automation Account from guest accounts?
Container Registry	Who owns this Container Registry? (includes inherited) Who is contributor on this Container Registry? (includes inherited) Who is Container Registry Contributor on this Container Registry? (includes inherited) Who can list admin credentials for this Container Registry? (includes inherited) Who can run build tasks on this Container Registry? (code execution, includes inherited) Who can obtain registry credentials from non-privileged identities? (not ARM-privileged, not Tier 0)
Storage Account	Who owns this Storage Account? (includes inherited) Who is contributor on this Storage Account? (includes inherited) Who is Storage Account Contributor on this Storage Account? (includes inherited) Who has access to this Storage Account from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this Storage Account from guest accounts? Who can list account keys for this Storage Account? (full data access, includes inherited) Who can generate SAS tokens for this Storage Account? (delegated data access, includes inherited) Who is Storage Account Contributor? (full management-plane control, includes inherited) Who can read blob data on this Storage Account? (data-plane read, includes inherited) Who can write blob data on this Storage Account? (data-plane write/delete, includes inherited) Who can access data on this Storage Account from non-privileged identities? (not ARM-privileged, not Tier 0)
Storage Container	Who owns the parent Storage Account of this Container? (includes inherited) Who is contributor on the parent Storage Account of this Container? (includes inherited) Who can list account keys granting access to this Container? (includes inherited) Who can generate SAS tokens granting access to this Container? (includes inherited) Who can read blob data on this Container? (data-plane read via parent, includes inherited) Who can write blob data on this Container? (data-plane write/delete via parent, includes inherited) Who can access this Container from non-privileged identities? (not ARM-privileged, not Tier 0)
Key Vault	Who owns this Key Vault? (includes inherited) Who is contributor on this Key Vault? (includes inherited) Who is Key Vault Contributor on this Key Vault? (includes inherited) Who has access to this Key Vault? Who can read secrets from this Key Vault? Who can read keys from this Key Vault? Who can read certificates from this Key Vault? Who has access to this Key Vault from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this Key Vault from guest accounts?
SQL Server	Who owns this SQL Server? (includes inherited) Who is contributor on this SQL Server? (includes inherited) Who is SQL Server Contributor on this SQL Server? (includes inherited) Who has access to this SQL Server? Who has access to this SQL Server from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this SQL Server from guest accounts?
User-Assigned Managed Identity	Who owns this User-Assigned Managed Identity? (includes inherited) Who is contributor on this User-Assigned Managed Identity? (includes inherited) Which resources are assigned this User-Assigned Managed Identity? Who has access to this User-Assigned Managed Identity from non-privileged identities? (not ARM-privileged, not Tier 0) Who has access to this User-Assigned Managed Identity from guest accounts? Who can assign this User-Assigned Managed Identity to resources?

AWS

Node	Node Queries
Organization	Find accounts Organization Hierarchy
Organizational Unit	Find member accounts Find child OUs Find parent OU
Account	Find organization Find parent OU
IAM User	Find group memberships Find attached policies Find access keys
IAM Group	Find member users Find attached policies
IAM Role	Find attached policies Find users that can assume this role
IAM Policy	Find users with this policy Find roles with this policy
IAM Access Key	Find owner user
SSO User	Find SSO Groups Find Permission Sets
SSO Group	Find SSO Users Find Permission Sets
Permission Set	Find SSO Users Find assumed roles Find assigned accounts

GCP

Node	Node Queries
Customer	Find organizations under this customer Find organizational units under this customer
Organization	Who can set IAM policy on this organization Find all folders in this organization
Organizational Unit	Find users in this organizational unit Find child organizational units Find path to parent customer
Folder	Who can set IAM policy on this folder Find path to parent organization
Project	Who can set IAM policy on this project Find path to parent organization
User	Find group memberships Find roles assigned to this user
Group	Find direct members of this group Find roles assigned to this group
Service Account	Find roles assigned to this service account Who can act as or impersonate this service account
Service Account Key	Find parent service account Find roles reachable through this key's service account
Role	Find all principals assigned this role Find users who inherit this role through group membership
Device	Find users of this device Find privileged users with access to this device
Principal	Find workload identity pool Find workforce identity pool
Workforce Identity Pool	Find parent organization Find workforce providers in pool Find principals in pool
Workforce Provider	Find parent workforce identity pool
Workload Identity Pool	Find parent project Find workload providers in pool Find principals in pool
Workload Provider	Find parent workload identity pool
VM Instance	Find path to parent project
KMS Key	Find path to parent project

GitHub

Node	Node Queries
User	Find team memberships

Queries Tab

The Queries tab contains built-in graph queries that run on the whole environment, not only on the selected node.

They show how Active Directory is operated and managed. The category of each query (General, Domain Users, Administrator, Groups, Service Accounts or Trust) is shown under its name.

Queries

Find Objects with DCSync Rights: DCSync is a special right that allows entities to obtain the password hash database from the domain controllers. This query finds all the objects that have DCSync rights on the domain objects.

Find Non Builtin Admin Objects with WriteDACL Rights: WriteDACL is a special right that allows right holders to change the access control entries on a target. In general, the administrator groups (Domain Admins,Enterprise Admins,Administrators) or their members own this right over the entities. This query finds the objects that have WriteDACL rights on any entity but are neither an administrator group nor a member of one.

Find Top Ten Users with Most Sessions: Finds the top ten users that have the most number of sessions over the computers in the environment.

Find Top Ten Computers with Most Sessions: Finds the top ten computers that have the most number of incoming sessions from the entities in the environment.

Find Top Ten Computers with Most Admins: Finds the top ten computers that have the most local administrative entities.

Find All Users that have Local Admin Rights: Finds all users/local users that have local administrator rights on any computer in the environment.

Find All Computers that have Local Admin Rights: Finds all computer accounts that have local administrator rights on any other computer in the environment.

Find Domain Members of Local Groups: Find the members of the local group objects that belong to the domain. Reveals the membership paths between domain environment to local environment.

Find Computers where Domain Users are Local Administrator: Finds the computer objects where the Domain Users group has explicit local admin rights.

Find Computers where Domain Users can RDP to: Finds the computer objects where the Domain Users group has been allowed to connect with Remote Desktop Protocol.

Find Other Rights which Domain Users Shouldn't Have: Finds the too-permissive rights that cause attack paths from the Domain Users to any entity. Since these rights allow critical operations, broad groups like Domain Users should not have such rights.

Find Administrators (DA,BA,EA) Sessions: Finds sessions from members of the Administrator groups (Domain Admins,Built-in Administrators,Enterprise Admins) to any computers.

Find Administrators (DA,BA,EA) Sessions to Non Domain Controllers: Finds sessions from members of the Administrator groups (Domain Admins,Built-in Administrators,Enterprise Admins) to computers where the computer is not a domain controller.

Find Groups with RDP Rights: Finds group objects that have been allowed to connect with Remote Desktop Protocol to a computer.

Find Groups with PS Remoting Rights: Finds group objects that have been allowed to connect and execute commands on a computer over the PowerShell.

Find Groups with DCOM Execution Rights: Finds group objects that have been allowed to connect and execute commands on a computer over the Distributed Component Object Model (DCOM).

Find Groups that have Local Admin Rights: Finds group objects that have local administrator rights on any computer in the environment.

Find Service Accounts' Sessions: Finds the service users that have an existing session on any computer object.

Find Accounts which Used in Local Services: Finds accounts that are responsible for managing and running a local service.

Get All Trust Relations: Gets all trust relations between domains/forests and other domains/forests.

Get Inter Domain/Forest Group Memberships: Gets group memberships between entities from different domains or forests.

Get Inter Domain/Forest Access Control Entries: Finds the access control entries between entities from different domains or forests.

Settings Tab

The Settings tab holds the Relation List: the relations that the shortest path and Path Finder queries are allowed to use. When you turn a relation off, paths that need it are no longer reported.

Relation List

The relations are split into one tab per platform: AD, Azure, GCP, AWS and GitHub.

Within a platform tab:

Filter relations: Narrows the list to the relations whose name matches what you type.

Selected counter: Shows how many relations are enabled out of the total for that platform, for example 47/47.

All / None: Enables or disables every relation on the platform tab at once.

Categories: The relations are grouped into categories such as Default, Local and GPO/Container, each with its own checkbox and its own enabled-of-total count, for example Local (4/4). Toggling the category checkbox toggles every relation inside it.

Path Finder

The Path Finder tab finds the shortest paths between two entities. The paths use only critical relations, which allow a critical operation on a node or a full compromise of it.

1. Type at least two characters of the starting entity's name in the From box ("Search for Starting Node"). After a short pause, matching entities are suggested with their type.

2. Select the starting entity, then select the ending entity in the To box ("Search for Ending Node") the same way.

3. When both are selected, the shortest paths between them are drawn on the graph.

Path Finder uses only the relations enabled on the Settings tab.

Path Finder requires a full licence. With a trial licence the tab is locked ("Path finding requires a full licence").

Path Finder Module