Neo4j Attack Path Analysis

I found Neo4j through BloodHound, a security tool that maps out who-can-access-what in corporate networks. BloodHound runs a dual-database architecture: PostgreSQL for application state, Neo4j for all the graph data. Every user, group, computer, and the millions of permission relationships between them live in Neo4j.

The first time I ran shortestPath() in Cypher and watched it trace a six-hop privilege escalation chain I had spent hours finding manually, something clicked. The query read like the diagram I had drawn on my whiteboard.

This notebook walks through that experience.

What is in the notebook

It builds a small Active Directory graph on AuraDB Free and runs four Cypher queries against it:

• shortestPath() traces a six-hop chain from a low-privilege user to Domain Admin, filtering by relationship types using pipe syntax
• Property filters with optional path matching find service accounts whose credentials can be cracked offline, and checks if they have a path to admin
• Multi-hop group membership traversal tracks where admin users are currently logged in
• String matching across node properties surfaces passwords stored in plaintext description fields

Each query includes the Cypher, the output, and a short explanation of the pattern it uses.

The notebook also includes screenshots from a live BloodHound CE instance running against a real Active Directory lab, showing what these same patterns look like at production scale.

What I learned

Graph Academy for structured learning. The Cypher Manual as a reference, especially the sections on path patterns and variable-length relationships. And reading BloodHound's source code to see how a production tool constructs its queries.

The graph patterns in this notebook (entities connected by typed, directed relationships, queried for paths) show up everywhere: fraud detection, identity and access management, knowledge graphs for AI/RAG, supply chain analysis. Security is just the domain where it clicked for me.

Quick start

Just read it. All output cells are pre-rendered. Open attack_path_analysis.ipynb and scroll through.

Run it yourself. You need a Neo4j instance. AuraDB Free works and takes two minutes to set up, no credit card required.

pip install -r requirements.txt
cp .env.example .env        # add your AuraDB credentials
jupyter notebook attack_path_analysis.ipynb

Credentials are loaded from environment variables via python-dotenv. Nothing is hardcoded.

Author

Maharshi Mishra