Stars
EAA is a curated catalog of techniques and real-world cases involving abuse of local AI agents through their runtime, configuration, state, tools, and inherited authority.
Production-ready KQL queries for Microsoft Defender XDR and Microsoft Sentinel. Focused on Threat Hunting, Detection Engineering, and MITRE ATT&CK mapping.
Azure Function that delivers secrets to managed endpoints using mutual TLS. Devices authenticate with their machine certificate, the function validates the cert chain against a trusted Root CA, the…
Microsoft Sentinel SIEM Log Source Analyzer
SOCAutomators Substack blog companion — threat research, DBIR analysis, and security operations content
Lab content for the ExpertsLive Denmark 2026 Identity Masterclass
Dump Azure AD Connect credentials for Azure AD and Active Directory
Collection of different Azure/Entra focused solutions (Deployable templates, Function Apps, etc)
M365/Azure adversary simulation tool that generates realistic attack telemetry to help blue teams improve their detection and response capabilities.
Research into Undocumented Behavior of Azure AD Refresh Tokens
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
TokenSmith generates Entra ID access & refresh tokens on offensive engagements. It is suitable for both covert adversary simulations and penetration tests with the tokens generated working out of t…
Simple pure PowerShell POC to bypass Entra / Intune Compliance Conditional Access Policy
Repository hosting a static list of Microsoft First party apps and Graph permissions that's updated daily
PowerShell framework to assess Azure security
A collection of Azure AD/Entra tools for offensive and defensive security purposes
A framework for developing alerting and detection strategies for incident response.
Cloud-native SIEM for intelligent security analytics for your entire enterprise.
Passkeys/FIDO2/WebAuthn .NET Library for Windows Desktop and CLI Applications
A curated list of awesome tools, research, papers and other projects related to password cracking and password security.
A code sample demonstrating how to use Entra Verified ID's functionality to issue and consume verifiable credentials in node.