MITRE ATT&CKsoftware (tool)

S0677 AADInternals

Published 2022-02-01 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows, Office Suite, Identity Provider
Version
1.2
Created
2022-02-01

Description

AADInternals is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.

Related

Uses · MITRE ATT&CK (24)

  • T1651 Cloud Administration Command technique
  • T1556.007 Hybrid Identity sub-technique
  • T1649 Steal or Forge Authentication Certificates technique
  • T1556.006 Multi-Factor Authentication sub-technique
  • T1098.005 Device Registration sub-technique
  • T1484.002 Trust Modification sub-technique
  • T1606.002 SAML Tokens sub-technique
  • T1589.002 Email Addresses sub-technique
  • T1590.001 Domain Properties sub-technique
  • T1598.003 Spearphishing Link sub-technique
  • T1059.001 PowerShell sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1003.004 LSA Secrets sub-technique
  • T1069.003 Cloud Groups sub-technique
  • T1087.004 Cloud Account sub-technique
  • T1558.002 Silver Ticket sub-technique
  • T1552.001 Credentials In Files sub-technique
  • T1552.004 Private Keys sub-technique
  • T1136.003 Cloud Account sub-technique
  • T1528 Steal Application Access Token technique
  • T1526 Cloud Service Discovery technique
  • T1530 Data from Cloud Storage technique
  • T1048 Exfiltration Over Alternative Protocol technique
  • T1112 Modify Registry technique

Referenced by MITRE ATT&CK · uses (2)

References