36 skills · sorted by relevance
Use ROADrecon and roadtx during authorized Microsoft Entra ID testing to inspect directory objects and authentication tokens, which represent access permissions. Explore collected configuration offline, test token exchanges, and assess conditional access and device controls.
Assess Microsoft Entra ID with AADInternals during authorized security testing. Examine publicly exposed tenant information, API access, and federation weaknesses, including Golden SAML, a token forgery technique, then document evidence and recommendations for stronger identity protection.
Run Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate identity-attack resilience.
The English summary is being prepared. Showing the original description.
Enumerate Entra ID with ROADrecon and acquire and exchange tokens with roadtx.
The English summary is being prepared. Showing the original description.
Investigate stolen OAuth tokens and their reuse in Microsoft Entra ID through sign-in log analysis. Follow response procedures for revoking sessions and reviewing app permissions, and configure device-bound token protection and session monitoring for Azure and M365 environments.
Review application permissions and consent audit logs in Microsoft Entra ID using Microsoft Graph API. Identify overly broad access, unverified publishers, and suspicious consent patterns, then produce a JSON risk report with remediation recommendations.
Investigate Entra ID reconnaissance by searching Graph API logs for tool signatures and unusual directory queries. Use KQL, a log query language, to correlate suspicious requests with sign-ins and turn useful searches into Sentinel detection rules.
Investigate lateral movement, where attackers expand access across Azure identities and tenants. Correlate audit logs and unusual sign-ins, build Microsoft Sentinel detection queries, and report affected identities with recommended containment actions.
Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.
Configure SAML identity federation, a way to share authentication between systems, linking on-premises Active Directory with Microsoft Entra ID. Cover single sign-on for cloud applications, user attribute mapping, authentication model choices, and signing certificate management.
Audit Microsoft Entra ID identity settings to uncover weak authentication policies, excessive administrator privileges, inactive accounts, and guest access risks. Review conditional access rules and sign-in logs, then organize findings into a prioritized security report.
Simulate device-code and app-consent phishing in an explicitly authorized Microsoft Entra ID environment. Assess whether authentication and consent controls prevent token misuse, map reachable Microsoft 365 resources, and document findings with remediation recommendations.
Design, review, and validate Azure cloud architectures. Use when choosing Azure compute, storage, networking, or identity services, or applying the Azure Well-Architected Framework to a workload.
The English summary is being prepared. Showing the original description.
Execute lateral movement within Microsoft Entra ID (formerly Azure AD) and Microsoft 365 environments. Use this skill to traverse cloud resources using compromised user tokens, managed identities, Primary Refresh Tokens (PRT), and application permissions (Service Principals) to achieve Global Administrator access.
The English summary is being prepared. Showing the original description.
Exploit Illicit Consent Grants in Azure Active Directory (Entra ID). This skill covers crafting a malicious OAuth application to trick victims into granting broad permissions (like reading emails, modifying files) without requiring their password or MFA.
The English summary is being prepared. Showing the original description.
Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics for fingerprints of offensive Entra ID tools such as ROADtools, AADInternals, and AzureHound.
The English summary is being prepared. Showing the original description.
Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly detection. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft detection, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.
The English summary is being prepared. Showing the original description.
Detect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.
The English summary is being prepared. Showing the original description.
Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.
The English summary is being prepared. Showing the original description.
Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.
The English summary is being prepared. Showing the original description.
Establish SAML 2.0 identity federation between on-premises Active Directory and Azure AD (Microsoft Entra ID) for seamless cross-domain authentication and SSO to cloud applications.
The English summary is being prepared. Showing the original description.
Run OAuth 2.0 device-code and illicit-consent phishing against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services.
The English summary is being prepared. Showing the original description.
tespit etmerisky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.
The English summary is being prepared. Showing the original description.
tespit etme (s) and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly Tespit. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft Tespit, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.
The English summary is being prepared. Showing the original description.