# Azure Postexploit

> Azure/Entra ID post-exploitation — 154 programs for tenant compromise, CIS compliance, identity attacks, data exfiltration, and M365 abuse

- Skill: `cyberstrikeus/azure-postexploit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/azure-postexploit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/azure-postexploit/raw
- Safety review: CAUTION (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/azure-postexploit

---


# Azure/Entra ID Post-Exploitation Methodology

154 programs across 13 categories — from basic enumeration to advanced Entra ID attacks, CIS compliance auditing, and M365 exploitation. All operations use az CLI and Microsoft Graph API.

## Prerequisites

1. **Valid Azure credentials** — service principal, user credentials, managed identity, or access token
2. **az CLI installed** — `az version`
3. **Current identity** — verify access via `az account show`

```bash
# Quick prerequisite check
az account show    # verify Azure CLI credentials
az version         # verify CLI
```

## Kill Chain Phases

### Phase 1 — Situational Awareness (Recon: 47 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Subscription enum | `azurehook subscription_enum` | Subscription details, quotas, spending |
| Resource graph | `azurehook resource_graph` | Cross-subscription resource queries |
| Entra ID enum | `azurehook entra_enum` | Users, groups, apps, SPs, conditional access |
| VM enum | `azurehook vm_enum` | VMs, public IPs, disks, extensions |
| Network enum | `azurehook vnet_enum` | VNets, subnets, peering, NSGs |
| NSG audit | `azurehook nsg_audit` | Overly permissive network rules |
| RBAC audit | `azurehook rbac_audit` | Role assignments, custom roles |
| SQL enum | `azurehook sql_enum` | SQL servers, databases, firewall rules |
| App Service | `azurehook app_service_enum` | App Service apps, auth, config |
| AKS | `azurehook aks_enum` | AKS clusters, nodegroups, RBAC |
| DNS | `azurehook dns_enum` | DNS zones, records, DNSSEC |
| Subdomain takeover | `azurehook subdomain_takeover` | Dangling CNAME detection |
| Public exposure | `azurehook public_exposure_scan` | Public IPs, storage, databases |
| Managed identity | `azurehook managed_identity` | Managed identity token harvest |
| Plus 33 more | `acr_enum`, `redis_enum`, `data_factory_enum`, `front_door_enum`, `apim_enum`, `databricks_enum`, `app_insights_enum`, `monitor_enum`, `sentinel_enum`, `vpn_gateway_enum`, etc. | Service-specific enumerators |

### Phase 2 — Credential Harvesting (14 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Key Vault dump | `azurehook keyvault_dump` | Secrets, keys, certificates |
| Token abuse | `azurehook azuread_token --action foci` | FOCI token swap, PRT abuse |
| IMDS harvest | `azurehook imds_harvest` | Instance metadata credentials |
| Device code phish | `azurehook device_code_phish` | Device code phishing flow |
| Graph tokens | `azurehook graph_token_harvest` | Multi-resource token harvest |
| Storage keys | `azurehook storage_key_dump` | Storage account access keys |
| Automation creds | `azurehook automation_cred_dump` | Automation Account credentials |
| Kubeconfig | `azurehook kubeconfig_dump` | AKS admin kubeconfig |
| Webapp env | `azurehook webapp_env_dump` | App Service env variables |
| Plus 5 more | `token_theft`, `certificate_abuse`, `refresh_token_replay`, `runbook_cred_extract`, `webapp_env_dump` | Additional credential sources |

### Phase 3 — Privilege Escalation (11 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Consent grant | `azurehook entra_privesc --method consent_grant` | Illicit consent grant |
| PIM activation | `azurehook pim_abuse` | Activate eligible admin roles |
| Global Admin | `azurehook global_admin_elevate` | Global Admin elevation |
| Custom role | `azurehook custom_role_exploit` | Exploit custom role definitions |
| CA bypass | `azurehook conditional_access_audit` | Find MFA gaps in CA policies |
| Managed identity | `azurehook managed_identity_privesc` | Over-privileged managed identities |
| App admin | `azurehook app_admin_privesc` | High-privilege app permissions |
| Plus 4 more | `deployment_privesc`, `resource_hierarchy_abuse`, `group_membership_abuse`, `partner_admin_abuse` | Additional escalation paths |

### Phase 4 — Identity Attacks (Entra ID: 10 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Federation backdoor | `azurehook federation_backdoor --domain D --idp-url URL` | Golden SAML via federation trust |
| PTA abuse | `azurehook pta_abuse` | Pass-Through Authentication interception |
| AADConnect | `azurehook aadconnect_dump` | Sync account enumeration (DCSync) |
| Seamless SSO | `azurehook seamless_sso_abuse` | Silver ticket via AZUREADSSOACC |
| SAML forge | `azurehook saml_forge --domain D` | SAML config for token forging |
| MFA manipulation | `azurehook mfa_manipulation` | MFA method enum/manipulation |
| Password spray | `azurehook password_spray` | Entra ID password spraying |
| Consent phish | `azurehook consent_phish` | OAuth consent phishing |
| Plus 2 more | `user_creation`, `tenant_recon_insider` | Account creation, insider recon |

### Phase 5 — Lateral Movement (10 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| VM Run Command | `azurehook vm_run_command --vm NAME --command CMD` | Execute on VM via Run Command |
| Bastion tunnel | `azurehook bastion_tunnel` | Azure Bastion tunneling |
| Arc exec | `azurehook arc_exec` | Arc connected machine execution |
| Intune deploy | `azurehook intune_deploy` | Deploy scripts via Intune |
| Cross-tenant | `azurehook cross_tenant_enum` | B2B cross-tenant enumeration |
| DevOps | `azurehook devops_service_conn` | DevOps service connection abuse |
| Plus 4 more | `custom_script_ext`, `userdata_command`, `msbuild_exec`, `shared_image_inject` | Additional lateral paths |

### Phase 6 — Persistence (11 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Runbook backdoor | `azurehook runbook_backdoor --automation-account NAME --resource-group RG` | Automation runbook backdoor |
| Logic App | `azurehook logic_app_backdoor --resource-group RG --name NAME --callback-url URL` | HTTP-triggered callback |
| Function App | `azurehook function_app_backdoor --resource-group RG --name NAME --callback-url URL` | Function App with exfil |
| SP persist | `azurehook sp_persist` | Service principal credentials |
| VM extension | `azurehook vm_extension_backdoor` | Custom script extension |
| Lighthouse | `azurehook lighthouse_persist` | Cross-tenant Lighthouse persist |
| Plus 5 more | `webhook_persist`, `devops_pipeline_backdoor`, `acr_image_backdoor`, `scheduled_task_persist`, `oauth_app_persist` | Additional persistence |

### Phase 7 — Data Exfiltration (12 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Storage dump | `azurehook storage_dump` | Blob Storage data exfil |
| Cosmos DB | `azurehook cosmos_dump --account NAME` | Cosmos DB keys and data |
| Disk snapshot | `azurehook disk_snapshot` | Managed disk offline analysis |
| Graph mail | `azurehook graph_mail_dump` | Exchange Online mail via Graph |
| SharePoint | `azurehook sharepoint_dump` | SharePoint document exfil |
| Teams dump | `azurehook teams_dump` | Teams channel messages |
| Plus 6 more | `table_queue_dump`, `file_share_dump`, `data_lake_dump`, `service_bus_sniff`, `event_hub_tap`, `vm_disk_download` | Additional data sources |

### Phase 8 — M365 Exploitation (4 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Exchange abuse | `azurehook exchange_abuse` | Mailbox rules, forwarding, delegation |
| SharePoint enum | `azurehook sharepoint_enum` | SharePoint sites, document libraries |
| Teams enum | `azurehook teams_enum` | Teams channels, messages |
| OneDrive access | `azurehook onedrive_access` | OneDrive files and shared items |

### Phase 9 — Defense Evasion (11 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Diagnostic tamper | `azurehook diagnostic_tamper` | Disable diagnostic settings |
| Sentinel suppress | `azurehook sentinel_suppress` | Suppress analytics rules |
| Defender disable | `azurehook defender_disable` | Disable Defender plans |
| Activity log | `azurehook activity_log_tamper` | Tamper activity log settings |
| Policy exempt | `azurehook policy_exempt` | Create policy exemptions |
| WAF bypass | `azurehook waf_bypass` | Modify/disable WAF rules |
| Plus 5 more | `alert_suppress`, `log_analytics_tamper`, `nsg_flow_log_disable`, `resource_move`, `tag_manipulation` | Additional evasion |

### Phase 10 — Compliance Audit (CIS Azure v3.0: 18 programs)

| Action | Command | CIS Control |
|--------|---------|-------------|
| Defender plans | `azurehook defender_plan_audit` | CIS 2.1 |
| Security contacts | `azurehook defender_contact_audit` | CIS 2.1.x |
| Storage security | `azurehook storage_security_audit` | CIS 4.1-4.17 |
| SQL audit | `azurehook sql_audit_config` | CIS 5.1.1-5.1.7 |
| PostgreSQL | `azurehook postgres_audit` | CIS 4.3.x |
| MySQL | `azurehook mysql_audit` | CIS 4.4.x |
| Cosmos DB | `azurehook cosmos_security_audit` | CIS 4.5.x |
| Diagnostics | `azurehook diagnostic_audit` | CIS 5.1 |
| Activity alerts | `azurehook activity_alert_audit` | CIS 5.2 |
| Network Watcher | `azurehook network_watcher_audit` | CIS 6.5 |
| VM security | `azurehook vm_security_audit` | CIS 7.x |
| App Service | `azurehook appservice_security_audit` | CIS 9.x |
| Key Vault | `azurehook keyvault_security_audit` | CIS 8.x |
| Identity MFA | `azurehook identity_mfa_audit` | CIS 1.1-1.3 |
| Guest access | `azurehook guest_access_audit` | CIS 1.5 |
| Password policy | `azurehook password_policy_audit` | CIS 1.8-1.11 |
| Resource locks | `azurehook resource_lock_audit` | CIS 8.5 |
| Policy compliance | `azurehook policy_compliance_audit` | Azure Policy |

### Phase 11 — Impact Assessment (5 programs)

| Action | Command | MITRE |
|--------|---------|-------|
| Resource hijack | `azurehook resource_hijack` | T1496 |
| Data destroy | `azurehook data_destroy` | T1485 |
| Ransomware sim | `azurehook ransomware_sim` | T1486 |
| Account lockout | `azurehook account_lockout` | T1531 |
| Service disruption | `azurehook service_disruption` | T1489 |

### Phase 12 — Cleanup (MANDATORY)

```
azurehook cleanup_azure
```

## Detection Considerations

- **Azure Activity Log** — All ARM API calls, role assignments, resource creation
- **Entra ID Audit Logs** — App consent grants, credential additions, role activations
- **Microsoft Defender for Cloud** — Anomalous resource access, privilege escalation
- **Conditional Access** — Untrusted location/device blocks
- **Azure Sentinel** — UEBA, anomalous sign-in patterns, bulk data access
- **Microsoft Graph Activity Logs** — Graph API access to mail, files, teams

## Program Reference

| Program | Technique | MITRE ATT&CK |
|---------|-----------|---------------|
| entra_enum | Entra ID tenant enumeration | T1087.004 |
| subscription_enum | Subscription discovery | T1580 |
| resource_graph | Cross-subscription queries | T1580 |
| keyvault_dump | Key Vault secret extraction | T1555.006 |
| storage_dump | Azure Storage data exfiltration | T1530 |
| managed_identity | Managed identity token harvest | T1552.005 |
| azuread_token | Token manipulation and FOCI abuse | T1550.001 |
| entra_privesc | Privilege escalation via consent/PIM | T1098.001 |
| federation_backdoor | Federation trust manipulation | T1484.002 |
| pta_abuse | PTA credential interception | T1556.007 |
| aadconnect_dump | AADConnect sync account abuse | T1003.006 |
| runbook_backdoor | Automation Account persistence | T1525 |
| vm_run_command | VM Run Command execution | T1059.006 |
| diagnostic_tamper | Disable diagnostic settings | T1562.008 |
| sentinel_suppress | Suppress Sentinel analytics | T1562.001 |
| resource_hijack | Resource hijacking/cryptomining | T1496 |
| exchange_abuse | Exchange Online abuse | T1114.002 |
| cleanup_azure | Resource removal and restoration | T1070 |