Lists (15)
Stars
This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected.
Automation to assess the state of your M365 tenant against CISA's baselines
A collection of scripts for assessing Microsoft Azure security
Azure Security Resources and Notes
A tool for checking if MFA is enabled on multiple Microsoft Services
A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.
A Post-exploitation Toolset for Interacting with the Microsoft Graph API
Monkey365 provides a tool for security consultants to easily conduct not only Microsoft 365, but also Azure subscriptions and Microsoft Entra ID security configuration reviews.
Understand adversary tradecraft and improve detection strategies
A deliberately vulnerable Microsoft Entra ID environment. Learn identity security through hands-on, realistic attack challenges.
ScriptSentry finds misconfigured and dangerous logon scripts.
Red Team Attack Lab for TTP testing & research
Simulates common user behaviour on local and remote Windows hosts.
A lightweight PowerShell tool for assessing the security posture of Microsoft Entra ID environments. It helps identify privileged objects, risky assignments, and potential misconfigurations.
Find potential DLL Sideloads on your windows computer
A Powershell module that helps you identify AppLocker weaknesses
Simple pure PowerShell POC to bypass Entra / Intune Compliance Conditional Access Policy
Monitor your PingCastle scans to highlight the rule diff between two scans
Completely Risky Active-Directory Simulation Hub
Repo containing various intel-based resources such as threat research, adversary emulation/simulation plan and so on
Ping-based Information Lookup and Outbound Transfer
An HTA Application which builds Azure (Entra) Scenarios for Red Team Simulations
Custom Amsi Bypass by patching AmsiOpenSession function in amsi.dll
POCs for CVE-2025-50154 and CVE-2025-59214, zero day vulnerabilities on windows file explorer disclosing NTLMv2-SSP without user interaction. It is a bypass for the CVE-2025-24054 Security Patch