Skill UI

This toolkit provides comprehensive offensive and administrative capabilities for Microsoft Entra ID, Azure AD, and AD FS. It allows authorized penetration testers to perform unauthenticated reconnaissance, acquire various access tokens, and critically, test for federation backdoors (Golden SAML). It is essential for validating identity-attack resilience and producing detailed hardening recommendations during red-team engagements.

This skill provides advanced threat hunting logic for Microsoft Sentinel/Log Analytics. It analyzes both AADGraphActivityLogs and MicrosoftGraphActivityLogs to detect the unique fingerprints and behavioral patterns left by offensive Entra ID tools (like ROADtools, AADInternals, and AzureHound). It detects specific User-Agent strings and characteristic endpoint-sweep patterns, even when tool authors attempt to spoof headers, helping SOC teams identify valid account-based adversary activity (MITRE T1078.004).