AADInternals

Adversary Tools · AADInternals

· ToolS0677 · Dual-use Araç

Type

Tool

Techniques

Used By

2 groups

Platforms

Windows, Office Suite, Identity Provider

Description

AADInternals is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.(Citation: AADInternals Github)(Citation: AADInternals Documentation)

Used By (2 threat groups)

G0016APT29 G1053Storm-0501

Techniques (24)

T1003.004LSA Secrets

credential access

T1048Exfiltration Over Alternative Protocol

exfiltration

T1059.001PowerShell

execution

T1069.003Cloud Groups

discovery

T1087.004Cloud Account

discovery

T1098.005Device Registration

persistenceprivilege escalation

References

https://attack.mitre.org/software/S0677 https://o365blog.com/aadinternals/https://o365blog.com/aadinternals https://github.com/Gerenios/AADInternals

defense impairmentpersistence

T1136.003Cloud Account

persistence

T1484.002Trust Modification

defense impairmentprivilege escalation

T1526Cloud Service Discovery

discovery

T1528Steal Application Access Token

credential access

T1530Data from Cloud Storage

collection

T1552.001Credentials In Files

credential access

T1552.004Private Keys

credential access

T1556.006Multi-Factor Authentication

defense impairmentpersistence

T1556.007Hybrid Identity

defense impairmentpersistence

T1558.002Silver Ticket

credential access

T1566.002Spearphishing Link

initial access

T1589.002Email Addresses

reconnaissance

T1590.001Domain Properties

reconnaissance

T1598.003Spearphishing Link

reconnaissance

T1606.002SAML Tokens

credential access

T1649Steal or Forge Authentication Certificates

credential access

T1651Cloud Administration Command

execution