'entra-id' 검색 결과

Assess Microsoft Entra ID with AADInternals during authorized security testing. Examine publicly exposed tenant information, API access, and federation weaknesses, including Golden SAML, a token forgery technique, then document evidence and recommendations for stronger identity protection.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping publicly exposed Entra ID tenant information
• Checking API access available through acquired tokens
• Validating AD FS signing certificate protection

Use ROADrecon and roadtx during authorized Microsoft Entra ID testing to inspect directory objects and authentication tokens, which represent access permissions. Explore collected configuration offline, test token exchanges, and assess conditional access and device controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping tenant users, groups, roles, and applications
• Reviewing conditional access policies
• Testing token exchanges and device-based single sign-on

Run Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate identity-attack resilience.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Enumerate Entra ID with ROADrecon and acquire and exchange tokens with roadtx.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Investigate stolen OAuth tokens and their reuse in Microsoft Entra ID through sign-in log analysis. Follow response procedures for revoking sessions and reviewing app permissions, and configure device-bound token protection and session monitoring for Azure and M365 environments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating anomalous token usage alerts
• Responding to suspected session hijacking
• Finding token reuse in sign-in logs

Review application permissions and consent audit logs in Microsoft Entra ID using Microsoft Graph API. Identify overly broad access, unverified publishers, and suspicious consent patterns, then produce a JSON risk report with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious application consent
• Reviewing apps with broad mail or file access
• Tracing consent events through audit logs

Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious additions of application credentials
• Reviewing privileged roles assigned to application identities
• Building detection rules for Entra ID identity abuse

Investigate lateral movement, where attackers expand access across Azure identities and tenants. Correlate audit logs and unusual sign-ins, build Microsoft Sentinel detection queries, and report affected identities with recommended containment actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious Azure sign-ins
• Building Microsoft Sentinel detection rules
• Reviewing suspicious OAuth app consent

Investigate Entra ID reconnaissance by searching Graph API logs for tool signatures and unusual directory queries. Use KQL, a log query language, to correlate suspicious requests with sign-ins and turn useful searches into Sentinel detection rules.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating Graph API activity after suspected credential theft
• Checking whether offensive tool activity is visible in logs
• Creating and tuning scheduled Sentinel detection rules

Configure SAML identity federation, a way to share authentication between systems, linking on-premises Active Directory with Microsoft Entra ID. Cover single sign-on for cloud applications, user attribute mapping, authentication model choices, and signing certificate management.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Extending on-premises authentication to cloud resources
• Comparing authentication models for hybrid identity
• Setting up SAML single sign-on for SaaS applications

Simulate device-code and app-consent phishing in an explicitly authorized Microsoft Entra ID environment. Assess whether authentication and consent controls prevent token misuse, map reachable Microsoft 365 resources, and document findings with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Run authorized Microsoft 365 phishing exercises
• Validate Conditional Access and MFA controls
• Test restrictions on app consent

Audit Microsoft Entra ID identity settings to uncover weak authentication policies, excessive administrator privileges, inactive accounts, and guest access risks. Review conditional access rules and sign-in logs, then organize findings into a prioritized security report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing authentication and administrator access in an Azure tenant
• Assessing identity settings before integrating an acquired tenant
• Finding inactive accounts and privileged guest users

Design, review, and validate Azure cloud architectures. Use when choosing Azure compute, storage, networking, or identity services, or applying the Azure Well-Architected Framework to a workload.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit Illicit Consent Grants in Azure Active Directory (Entra ID). This skill covers crafting a malicious OAuth application to trick victims into granting broad permissions (like reading emails, modifying files) without requiring their password or MFA.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute lateral movement within Microsoft Entra ID (formerly Azure AD) and Microsoft 365 environments. Use this skill to traverse cloud resources using compromised user tokens, managed identities, Primary Refresh Tokens (PRT), and application permissions (Service Principals) to achieve Global Administrator access.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics for fingerprints of offensive Entra ID tools such as ROADtools, AADInternals, and AzureHound.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly detection. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft detection, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Establish SAML 2.0 identity federation between on-premises Active Directory and Azure AD (Microsoft Entra ID) for seamless cross-domain authentication and SSO to cloud applications.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Run OAuth 2.0 device-code and illicit-consent phishing against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

tespit etme
risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.