This repository was archived by the owner on Sep 2, 2022. It is now read-only.
This repository was archived by the owner on Sep 2, 2022. It is now read-only.
Suggestion: keep SID attribute for MappedPrincipals #91
Description
Several well-known SIDs are converted to MappedPrincipal objects, see: https://github.com/BloodHoundAD/SharpHound/blob/9d71fb7e3033a7da07cf2ba6daaebd11c09bbd7b/Sharphound2/Enumeration/MappedPrincipal.cs
This is nice as it allows to perform queries using common names, like "Anonymous" without caring about the local AD language. However, the original SID (like "S-1-5-7" for "Anonymous") is lost in the process and is missing from the Group object in neo4j (objectsid attribute).
Groups with missing objectsid attributes can be found with:
MATCH (n:Group) where n.objectsid IS NULL RETURN n
I suggest keeping the SID information to have it in the Group object in neo4j to be able to perform Cypher queries based on SID