Why submit? 🤷

#SOCON2026 speakers receive complimentary conference and training passes, professional exposure to top operators & researchers, and a platform to shape the future of Attack Path Management.

Get your proposal in before the Nov. 15 deadline! ghst.ly/socon26-cfp

Your selector is evaluated at each ingest, tagging any node matching its conditions—even future ones. It applies to Owned & Tier0 zones in BHCE or any custom zone in BHE.

Sharing an OpenGraph model? Include Tier0 Cypher selectors to make it complete. Happy Graphing!

🧵: 3/3

Go to the Privilege Zone page & click “Create Selector.” Name it, add a description, and set the selector type to Cypher.

Enter your Cypher query & preview nodes via “Update Sample Results.” Happy with it? Click “Save” — done!

🧵: 2/3

Save the JSON file and upload to BloodHound via the Quick Upload and wait a couple of minutes for the data to ingest and update. Search or query for the objects with cypher (8) that you just updated and view the new property (9).

🧵 5/5

Using the OpenGraph schema reference, we’ll make the simplest example we can. All we need are the object SID (5), the kind of object to update (6), and the new property to add to the object (7). ghst.ly/3IQlgbb

🧵 4/5

Enumerate the objects that this policy applies to. The information we need is the object SID (3).

The linked Gist contains a PowerShell script to gather this information and is stored in the variable $results (4). ghst.ly/4hpdHFa

🧵 3/5

A fine grained password policy called tierZeroPasswordPolicy (1) is currently enabled in this domain and applies to the Domain Admins group (2).

🧵 2/5