Step 1: Say kiitos to @DrAzureAD then install AADInternals, set your phasers to stun and your POWAHSHELL to german to ensure MAXIMUM efficiency 
To import the modul you might have to set your execution pawliciy πΎ.
For maximum fun we can set this to
Set-ExecutionPolicy unrestricted
on our managed company super safe devices. Do some privesc first if needed π
For maximum fun we can set this to
Set-ExecutionPolicy unrestricted
on our managed company super safe devices. Do some privesc first if needed π
After importing this badboy you can check from an outsider perspective and get some infos, with no creds, on an org
with
Invoke-AADIntReconAsOutsider
with
Invoke-AADIntReconAsOutsider
Or you can use creds to perform some insider recon with
Get-AADIntAccessTokenForAzureCoreManagement -SaveToCache
Type in your creds and see results with
$results = Invoke-AADIntReconAsInsider
Get-AADIntAccessTokenForAzureCoreManagement -SaveToCache
Type in your creds and see results with
$results = Invoke-AADIntReconAsInsider
Or you can do it manually by interacting with the apis, like e.g
login.microsoftonline.com/GetUserRealm.sβ¦
provides login and auth-type infos. Also have a look at
microsoft.github.io/Azure-Threat-Rβ¦
login.microsoftonline.com/GetUserRealm.sβ¦
provides login and auth-type infos. Also have a look at
microsoft.github.io/Azure-Threat-Rβ¦
@threadreaderapp unroll
β’ β’ β’
Missing some Tweet in this thread? You can try to
force a refresh
γ
