PATT Migration - v0.3
parent
e04303cbfe
commit
9730a65811
|
@ -1,4 +1,4 @@
|
||||||
# Microsoft Entra ID / Azure Active Directory
|
# Azure AD Tokens
|
||||||
|
|
||||||
|
|
||||||
## Access Token
|
## Access Token
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
# IAM
|
# Azure AD IAM
|
||||||
|
|
||||||
> Root Management Group (Tenant) > Management Group > Subscription > Resource Group > Resource
|
> Root Management Group (Tenant) > Management Group > Subscription > Resource Group > Resource
|
||||||
|
|
||||||
|
|
|
@ -1,4 +1,6 @@
|
||||||
# OSINT AAD - Recon Domains
|
# Azure AD Enumerate
|
||||||
|
|
||||||
|
## OSINT AAD - Recon Domains
|
||||||
|
|
||||||
Extract openly available information for the given tenant: https://aadinternals.com/osint/
|
Extract openly available information for the given tenant: https://aadinternals.com/osint/
|
||||||
|
|
||||||
|
@ -7,7 +9,7 @@ Invoke-AADIntReconAsOutsider -Domain "company.com" | Format-Table
|
||||||
Invoke-AADIntReconAsOutsider -UserName "user@company.com" | Format-Table
|
Invoke-AADIntReconAsOutsider -UserName "user@company.com" | Format-Table
|
||||||
```
|
```
|
||||||
|
|
||||||
# Azure AD - Collectors
|
## Azure AD - Collectors
|
||||||
|
|
||||||
* roadrecon
|
* roadrecon
|
||||||
```ps1
|
```ps1
|
||||||
|
@ -20,11 +22,11 @@ Invoke-AADIntReconAsOutsider -UserName "user@company.com" | Format-Table
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
# Azure AD - Conditionnal Access
|
## Azure AD - Conditionnal Access
|
||||||
|
|
||||||
Enumerate Conditionnal Access Policies: `roadrecon plugin policies`
|
Enumerate Conditionnal Access Policies: `roadrecon plugin policies`
|
||||||
|
|
||||||
# Azure AD - MFA
|
## Azure AD - MFA
|
||||||
|
|
||||||
* [dafthack/MFASweep](https://github.com/dafthack/MFASweep) - A tool for checking if MFA is enabled on multiple Microsoft Services
|
* [dafthack/MFASweep](https://github.com/dafthack/MFASweep) - A tool for checking if MFA is enabled on multiple Microsoft Services
|
||||||
```ps1
|
```ps1
|
||||||
|
|
|
@ -1,4 +1,6 @@
|
||||||
# Illicit Consent Grant
|
# Azure AD Phishing
|
||||||
|
|
||||||
# Device Code Phishing
|
## Illicit Consent Grant
|
||||||
|
|
||||||
|
## Device Code Phishing
|
||||||
|
|
||||||
|
|
|
@ -1,13 +1,14 @@
|
||||||
# Azure Runbook
|
# Azure Services
|
||||||
|
|
||||||
|
## Azure Runbook
|
||||||
|
|
||||||
Runbook must be SAVED and PUBLISHED before running it.
|
Runbook must be SAVED and PUBLISHED before running it.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Office 365
|
||||||
|
|
||||||
# Office 365
|
### Extracting Microsoft Teams Messages
|
||||||
|
|
||||||
## Extracting Microsoft Teams Messages
|
|
||||||
|
|
||||||
```ps1
|
```ps1
|
||||||
TokenTacticsV2> RefreshTo-MSTeamsToken -domain domain.local
|
TokenTacticsV2> RefreshTo-MSTeamsToken -domain domain.local
|
||||||
|
|
Loading…
Reference in New Issue