Suggestions for new Queries

I haven't found these in the database, but since we always check them in a customers environment, I though I suggest including them. They're both kinda related, to I only created a single issue.

name: Check for Objects not owned by Tier Zero
guid: b67b5d95-fe53-40f0-b0c5-a874abb086a5
prebuilt: false
platform: Active Directory 
category: Dangerous Privileges
description: In most Active Directory environments, objects should usually be owned only by privileged 
administrative groups (e.g., Domain Administrators or Enterprise Administrators). Assigned ownership to other 
users or groups introduce potential privilege escalation risks, as object owners can always modify permissions and
regain full control. Therefore, object ownership should be regularly reviewed and corrected.
query:
  MATCH p = (n)-[:Owns*1..]->(o)
  WHERE NOT ((n:Tag_Tier_Zero) OR COALESCE(n.system_tags, '') CONTAINS 'admin_tier_0')
  RETURN p 
  LIMIT 1000
revision: 1
resources: https://rdr-it.com/en/active-directory-change-object-owner-in-bulk/
acknowledgements: @kaasimir

The following query was created, since I often got false positives out of Bloodhound -> often a user was the owner of an object, but beside the Owns edge, other like WriteDacl, WriteOwner or GenericWrite where shown as well. With this query I check for implicit assigned permissions, which has been kinda handy in the past:

name: Check for Object Takeover Permissions
guid: 465e5364-3976-474e-b666-6e6d2ac573bf
prebuilt: false
platform: Active Directory 
category: Dangerous Privileges
description: Object ownership implicitly grants the ability to modify an object's permissions, which can result in 
additional effective rights. As a result, BloodHound may display multiple privilege edges even though ownership is 
the underlying cause, making remediation more complex. This query identifies explicitly assigned critical 
permissions, allowing them to be reviewed independently and removed where appropriate.
query:
  MATCH p = (o)<-[:GenericWrite|GenericAll|WriteOwner|WriteDacl]-(n)
  WHERE NOT (o)<-[:Owns]-(n)
  AND NOT ((n:Tag_Tier_Zero) OR COALESCE(n.system_tags, '') CONTAINS 'admin_tier_0')
  AND NOT n.name STARTS WITH 'MSOL'
  RETURN p
  LIMIT 1000
revision: 1
resources: -
acknowledgements: @kaasimir

Thx a ton guys, hope those are helpful and keep up the great work!
Cheers, kaasimir