Detects and analyzes lateral movement within Azure AD and Entra ID environments using Microsoft Graph API and KQL hunting queries.
This skill empowers security analysts and developers to identify complex attack patterns in Azure cloud environments, such as service principal abuse, OAuth consent grants, and token theft. By leveraging Microsoft Sentinel and Kusto Query Language (KQL), it correlates disparate logs from sign-in events and audit trails to uncover hidden lateral movement paths that traditional on-premises tools might miss. It is particularly valuable for building robust threat detection pipelines and incident response workflows within Entra ID.
主要功能
01Microsoft Graph API audit log correlation
02Mapping of detections to MITRE ATT&CK techniques
03Advanced KQL hunting queries for Microsoft Sentinel
04Detection of cross-tenant pivoting and token theft
05OAuth application consent grant auditing
064,120 GitHub stars
使用场景
01Building automated response playbooks for identity-based threats
02Investigating potential token replay attacks and session hijacking
03Identifying unauthorized service principal credential additions
