[bug] Problem with given cypher queries returning No results match your criteria

[moscowchill]

"No results match your criteria" from all queries Im running

I imported

[2025-11-04 17:04:37.371] [status] Processin… processed:8973 | skipped:0 | pending:0 | …
[2025-11-04 17:04:37.502] [info-] Exporting graph to "opengraph.json"
[2025-11-04 17:04:37.503] [info-]   │ Nodes: 21886
[2025-11-04 17:04:37.503] [info-]   │ Edges: 2632169
[2025-11-04 17:04:43.789] [info-]   │ Graph successfully exported to "opengraph.json" (506.47 MB)
[2025-11-04 17:04:43.789] [info-] Final Summary:
[2025-11-04 17:04:43.789] [info-]   │ Shares: 26 processed, 14 skipped (total: 40)
[2025-11-04 17:04:43.789] [info-]   │ Files: 102912 processed, 0 skipped (total: 102912)
[2025-11-04 17:04:43.789] [info-]   │ Directories: 8973 processed, 0 skipped (total: 8973)
[2025-11-04 17:04:43.789] [info-] ShareHound completed, time elapsed: 30 minutes 46 seconds 78 miliseconds.

Im running bloodhoundCE what am I doing wrong?

[p0dalirius]

Hey,

Can you give me more info? You have an opengraph generated by ShareHound already:

[2025-11-04 17:04:37.502] [info-] Exporting graph to "opengraph.json"
[2025-11-04 17:04:37.503] [info-]   │ Nodes: 21886
[2025-11-04 17:04:37.503] [info-]   │ Edges: 2632169
[2025-11-04 17:04:43.789] [info-]   │ Graph successfully exported to "opengraph.json" (506.47 MB)

Are you running the latest version of BloodHound Comunity Edition?

What cypher queries did not find any results?

Best regards,

[jsdhasfedssad]

I also have this issue. I used BHCE 8.3.1, SharpHound 2.8.0 and ShareHound 1.0.2.

1. Used set-custom-icons.py to prepare BHCE.
2. Configured a new share and granted a user account full rights on it.
3. Dumped the AD using SharpHound and imported that into BHCE.
4. Dumped share data using ShareHound and imported that into BHCE.

Queries that do not produce any results:

=== Find principals with full control on network shares ===

MATCH (p:Principal)-[r]->(s:NetworkShareSMB)
WHERE (p)-[:CanDelete]->(s)
  AND (p)-[:CanDsControlAccess]->(s)
  AND (p)-[:CanDsCreateChild]->(s)
  AND (p)-[:CanDsDeleteChild]->(s)
  AND (p)-[:CanDsDeleteTree]->(s)
  AND (p)-[:CanDsListContents]->(s)
  AND (p)-[:CanDsListObject]->(s)
  AND (p)-[:CanDsReadProperty]->(s)
  AND (p)-[:CanDsWriteExtendedProperties]->(s)
  AND (p)-[:CanDsWriteProperty]->(s)
  AND (p)-[:CanReadControl]->(s)
  AND (p)-[:CanWriteDacl]->(s)
  AND (p)-[:CanWriteOwner]->(s)
RETURN p,r

Or a subset of the above permissions.

=== Find principals with write access to a network share ===

MATCH x=(p)-[r:CanWriteDacl|CanWriteOwner|CanDsWriteProperty|CanDsWriteExtendedProperties]->(s:NetworkShareSMB)
RETURN x

A query that do produce results:

=== List all shares and their location ===

MATCH x=(s:NetworkShareSMB)
RETURN x

And other non-edge related queries.

[p0dalirius]

Hey,

You have to remove the :Principal from the MATCH (p:Principal)-[r]->(s:NetworkShareSMB) queries, this is a leftover of an old early beta of ShareHound. Node types are either User or Groups but not with the Principal kind.

I have updated the README.md file with the good cypher queries.

Sorry for this typo,

Best regards,