[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AECQDTPRZAZ7CGPK7DAGFW":3,"skill-same:01M6AECQDTPRZAZ7CGPK7DAGFW":128},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AECQDTPRZAZ7CGPK7DAGFW","detecting-entra-offensive-tools-in-graph-logs",null,"Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel\u002FLog Analytics using KQL to fingerprint offensive Entra ID enumeration tools such as ROADtools, AADInternals, and AzureHound, including User-Agent signatures, roadrecon endpoint sweeps, and sign-in correlation. Use when investigating suspicious Microsoft Graph API activity, Entra ID reconnaissance, or building Sentinel analytics rules to detect these tools.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-entra-offensive-tools-in-graph-logs\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"detecting entra offensive tools in graph logs","graph","logs","Microsoft-Graph","enumeration","detection","correlation","reconnaissance","detection-engineering","aadinternals","roadtools","entra-id","suspicious","soc","threat-hunting","kql","entra id","analytics","microsoft","cybersecurity","2026-11-10 10:12:30",false,"---\nname: detecting-entra-offensive-tools-in-graph-logs\ndescription: Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel\u002FLog Analytics using KQL to fingerprint offensive Entra ID enumeration tools such as ROADtools, AADInternals, and AzureHound, including User-Agent signatures, roadrecon endpoint sweeps, and sign-in correlation. Use when investigating suspicious Microsoft Graph API activity, Entra ID reconnaissance, or building Sentinel analytics rules to detect these tools.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- threat-hunting\n- entra-id\n- microsoft-graph\n- kql\n- sentinel\n- roadtools\n- aadinternals\n- detection-engineering\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-09\nmitre_attack:\n- T1078.004\n---\n# Detecting Entra Offensive Tools in Graph Logs\n\n## Overview\n\nFor nearly a decade the legacy **Azure AD Graph API** (`graph.windows.net`) was a defender blind spot: requests to it produced no first-class activity log, so tools like ROADtools (`roadrecon`) and AADInternals — which lean heavily on AAD Graph — could enumerate an entire tenant with little trace. That changed when Microsoft shipped **AADGraphActivityLogs** (general availability in 2026), the counterpart to the already-available **MicrosoftGraphActivityLogs** (`graph.microsoft.com`). Together these two tables give SOCs request-level visibility into directory API traffic: the caller identity, app, source IP, HTTP method, request URI, and crucially the **User-Agent**.\n\nThis skill is the defensive complement to offensive Entra tooling. It hunts the two Graph activity tables for the behavioral and string fingerprints those tools leave behind. Many operators forget to spoof the User-Agent, so ROADtools (built on Python's `aiohttp`) emits a User-Agent like `Python\u002F3.12 aiohttp\u002F3.10.4`, and AADInternals frequently leaves `AADInternals` or library strings in the agent. Even when the agent is spoofed, the tools betray themselves through a characteristic **endpoint-sweep pattern**: `roadrecon gather` pulls `users`, `groups`, `applications`, `serviceprincipals`, `devices`, `directoryroles`, `roledefinitions`, `oauth2permissiongrants`, and more within a tight time window — a signature that survives header spoofing.\n\nThe activity being detected maps to MITRE ATT&CK **T1078.004 – Valid Accounts: Cloud Accounts**: an adversary using legitimate (often phished or token-stolen) cloud credentials to enumerate and operate against the tenant via the Graph APIs. These detections both surface live intrusions and validate that the offensive techniques in the companion red-team skills are observable.\n\n## When to Use\n\n- Building or tuning detections for Microsoft Sentinel \u002F Log Analytics covering Entra ID\n- Threat hunting after suspected credential theft, device-code phishing, or OAuth consent abuse\n- Purple-team exercises validating that ROADtools\u002FAADInternals\u002FAzureHound activity is detectable\n- Investigating an alert and needing to correlate Graph API calls back to a sign-in\u002Fsession\n- Closing the legacy Azure AD Graph visibility gap after enabling AADGraphActivityLogs\n\n## Prerequisites\n\n- A Microsoft Sentinel workspace (or Log Analytics) ingesting:\n  - **MicrosoftGraphActivityLogs** (diagnostic setting on Microsoft Entra ID -> graph.microsoft.com)\n  - **AADGraphActivityLogs** (diagnostic setting on Microsoft Entra ID -> legacy Azure AD Graph)\n- `SigninLogs` and `AADNonInteractiveUserSignInLogs` for correlation\n- Microsoft Sentinel Reader\u002FResponder (or Log Analytics Reader) RBAC to run KQL\n- Familiarity with Kusto Query Language (KQL)\n- Enable the diagnostic settings (Azure Portal -> Microsoft Entra ID -> Diagnostic settings -> send `MicrosoftGraphActivityLogs` and `AADGraphActivityLogs` to your workspace), or via CLI:\n  ```bash\n  az monitor diagnostic-settings create \\\n    --name \"entra-graph-logs\" \\\n    --resource \"\u002Fproviders\u002Fmicrosoft.aadiam\u002FdiagnosticSettings\" \\\n    --logs '[{\"category\":\"MicrosoftGraphActivityLogs\",\"enabled\":true},{\"category\":\"AADGraphActivityLogs\",\"enabled\":true}]' \\\n    --workspace \"\u003Clog-analytics-workspace-id>\"\n  ```\n\n## Objectives\n\n- Confirm both Graph activity tables are flowing into the workspace\n- Detect User-Agent string fingerprints of ROADtools, AADInternals, and AzureHound\n- Detect the endpoint-sweep behavioral fingerprint that survives User-Agent spoofing\n- Correlate suspicious Graph activity back to a sign-in\u002Fsession and source identity\n- Operationalize the best queries as scheduled analytics rules\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Application in this skill |\n|----|-----------|---------------------------|\n| T1078.004 | Valid Accounts: Cloud Accounts | Detecting adversaries using valid cloud credentials\u002Ftokens to enumerate the tenant via the Microsoft Graph and legacy Azure AD Graph APIs |\n\nRelated techniques surfaced by these hunts: **T1087.004** Account Discovery: Cloud Account, **T1069.003** Permission Groups Discovery: Cloud Groups, **T1526** Cloud Service Discovery.\n\n## Workflow\n\n### Step 1: Confirm both tables are ingesting\nBefore hunting, verify the data exists and inspect the schema fields you will pivot on.\n\n```kusto\nunion withsource=Tbl MicrosoftGraphActivityLogs, AADGraphActivityLogs\n| where TimeGenerated > ago(1d)\n| summarize Records=count(), LastSeen=max(TimeGenerated) by Tbl\n```\n\n### Step 2: Hunt User-Agent fingerprints (ROADtools \u002F aiohttp)\nROADtools uses `aiohttp`; an un-spoofed run shows `python` + `aiohttp` in the User-Agent.\n\n```kusto\nAADGraphActivityLogs\n| where TimeGenerated > ago(7d)\n| where RequestMethod == \"GET\"\n| where UserAgent contains \"python\" and UserAgent contains \"aiohttp\"\n| summarize RequestCount = count() by CallerIpAddress, AppId, UserAgent, UserId\n| sort by RequestCount desc\n```\n\n### Step 3: Hunt AADInternals and AzureHound agents\nAADInternals leaves toolkit\u002Flibrary strings; AzureHound's Go HTTP client and BloodHound tooling have distinctive agents.\n\n```kusto\nunion MicrosoftGraphActivityLogs, AADGraphActivityLogs\n| where TimeGenerated > ago(7d)\n| where UserAgent has_any (\"AADInternals\", \"aad-internals\", \"azurehound\",\n                           \"BloodHound\", \"python-requests\", \"Go-http-client\")\n| project TimeGenerated, UserAgent, CallerIpAddress, AppId, UserId, RequestUri\n| sort by TimeGenerated desc\n```\n\n### Step 4: Behavioral hunt — the roadrecon endpoint sweep (spoof-resistant)\nEven with a spoofed agent, `roadrecon gather` touches a recognizable set of directory resources in a short window. Bucket by user and 5 minutes; alert when one identity hits the full sweep.\n\n```kusto\nAADGraphActivityLogs\n| where TimeGenerated > ago(1d)\n| where RequestMethod == \"GET\"\n| extend TopLevelResource = tolower(tostring(split(split(RequestUri, \"?\")[0], \"\u002F\")[3]))\n| summarize\n    TopLevelResources = make_set(TopLevelResource),\n    AppIds = make_set(AppId),\n    CallerIPs = make_set(CallerIpAddress),\n    UserAgents = make_set(UserAgent),\n    StartTime = min(TimeGenerated),\n    EndTime = max(TimeGenerated)\n    by UserId, bin(TimeGenerated, 5m)\n| where TopLevelResources has_all (\"users\", \"tenantdetails\", \"groups\", \"applications\",\n    \"serviceprincipals\", \"devices\", \"directoryroles\", \"roledefinitions\", \"contacts\",\n    \"oauth2permissiongrants\", \"authorizationpolicy\")\n| project StartTime, EndTime, UserId, AppIds, CallerIPs, UserAgents\n```\n\n### Step 5: High-volume enumeration outliers\nCatch tooling that simply makes far more directory reads than a human in a short window.\n\n```kusto\nMicrosoftGraphActivityLogs\n| where TimeGenerated > ago(1d)\n| where RequestMethod == \"GET\"\n| where RequestUri has_any (\"\u002Fusers\", \"\u002Fgroups\", \"\u002FservicePrincipals\", \"\u002Fapplications\",\n                            \"\u002FdirectoryRoles\", \"\u002FroleManagement\")\n| summarize Reads=count(), Resources=dcount(RequestUri) by UserId, AppId, CallerIpAddress, bin(TimeGenerated, 10m)\n| where Reads > 200\n| sort by Reads desc\n```\n\n### Step 6: Correlate Graph activity to the originating sign-in\nPivot a suspicious Graph caller back to the sign-in to recover device, location, MFA, and conditional-access result. Note the `SignInActivityId` in AADGraphActivityLogs may carry `==` padding versus `SigninLogs.UniqueTokenIdentifier`.\n\n```kusto\nAADGraphActivityLogs\n| where TimeGenerated > ago(1d)\n| where UserAgent contains \"aiohttp\"\n| extend TokenId = trim_end(\"=\", tostring(SignInActivityId))\n| join kind=leftouter (\n    SigninLogs\n    | extend TokenId = tostring(UniqueTokenIdentifier)\n    | project TokenId, UserPrincipalName, IPAddress, AppDisplayName, ConditionalAccessStatus, DeviceDetail\n) on TokenId\n| project TimeGenerated, UserId, UserPrincipalName, CallerIpAddress, IPAddress,\n          AppDisplayName, ConditionalAccessStatus, UserAgent\n```\n\n### Step 7: Operationalize as analytics rules\nPromote the highest-fidelity queries (Steps 2-4) to scheduled analytics rules. Set a query period\u002Ffrequency (e.g., run every 1h over 1d), map the rule to T1078.004, and configure entity mappings (Account = UserId, IP = CallerIpAddress, Host\u002FApp = AppId) so incidents enrich automatically. Tune out known automation\u002Fservice-principal App IDs and approved scanner IPs via a watchlist before enabling.\n\n## Tools and Resources\n\n| Resource | Purpose | Source |\n|----------|---------|--------|\n| AADGraphActivityLogs reference | Schema and field meaning | https:\u002F\u002Flearn.microsoft.com\u002Fentra\u002Fidentity\u002Fmonitoring-health\u002Fconcept-aad-graph-activity-logs |\n| MicrosoftGraphActivityLogs | Graph API activity schema | https:\u002F\u002Flearn.microsoft.com\u002Fgraph\u002Fmicrosoft-graph-activity-logs-overview |\n| Invictus-IR writeup | AADGraphActivityLogs hunting queries | https:\u002F\u002Fwww.invictus-ir.com\u002Fnews\u002Fthe-missing-link-aadgraphactivitylogs-finally-arrives |\n| Cloudbrothers analysis | Behavioral fingerprinting of ROADtools | https:\u002F\u002Fcloudbrothers.info\u002Fen\u002Faadgraphactivitylogs\u002F |\n| ROADtools | The offensive tool being detected | https:\u002F\u002Fgithub.com\u002Fdirkjanm\u002FROADtools |\n| MITRE T1078.004 | Valid Accounts: Cloud Accounts | https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1078\u002F004\u002F |\n\n## Detection Fingerprint Reference\n\n| Tool | Primary fingerprint | Table |\n|------|---------------------|-------|\n| ROADtools (roadrecon) | `python` + `aiohttp` UA; full directory endpoint sweep in 5 min | AADGraphActivityLogs |\n| AADInternals | `AADInternals` \u002F toolkit strings in UA; AAD Graph reads | AADGraphActivityLogs |\n| AzureHound | Go HTTP client UA; broad MS Graph enumeration | MicrosoftGraphActivityLogs |\n| Generic recon | High GET volume across users\u002Fgroups\u002Fapps\u002FSPs in short window | both |\n\n## Validation Criteria\n\n- [ ] Both MicrosoftGraphActivityLogs and AADGraphActivityLogs confirmed ingesting\n- [ ] User-Agent fingerprint hunt for ROADtools\u002Faiohttp executed\n- [ ] AADInternals\u002FAzureHound agent hunt executed\n- [ ] Behavioral endpoint-sweep hunt executed and tuned for false positives\n- [ ] High-volume enumeration outlier query executed\n- [ ] At least one finding correlated back to a sign-in\u002Fsession and source identity\n- [ ] Best queries promoted to scheduled analytics rules with T1078.004 mapping and entity mappings\n- [ ] Known-good service principals\u002FIPs excluded via watchlist to control false positives\n","# Detecting Entra Offensive Tools in Graph Logs\n\n## Overview\n\nFor nearly a decade the legacy **Azure AD Graph API** (`graph.windows.net`) was a defender blind spot: requests to it produced no first-class activity log, so tools like ROADtools (`roadrecon`) and AADInternals — which lean heavily on AAD Graph — could enumerate an entire tenant with little trace. That changed when Microsoft shipped **AADGraphActivityLogs** (general availability in 2026), the counterpart to the already-available **MicrosoftGraphActivityLogs** (`graph.microsoft.com`). Together these two tables give SOCs request-level visibility into directory API traffic: the caller identity, app, source IP, HTTP method, request URI, and crucially the **User-Agent**.\n\nThis skill is the defensive complement to offensive Entra tooling. It hunts the two Graph activity tables for the behavioral and string fingerprints those tools leave behind. Many operators forget to spoof the User-Agent, so ROADtools (built on Python's `aiohttp`) emits a User-Agent like `Python\u002F3.12 aiohttp\u002F3.10.4`, and AADInternals frequently leaves `AADInternals` or library strings in the agent. Even when the agent is spoofed, the tools betray themselves through a characteristic **endpoint-sweep pattern**: `roadrecon gather` pulls `users`, `groups`, `applications`, `serviceprincipals`, `devices`, `directoryroles`, `roledefinitions`, `oauth2permissiongrants`, and more within a tight time window — a signature that survives header spoofing.\n\nThe activity being detected maps to MITRE ATT&CK **T1078.004 – Valid Accounts: Cloud Accounts**: an adversary using legitimate (often phished or token-stolen) cloud credentials to enumerate and operate against the tenant via the Graph APIs. These detections both surface live intrusions and validate that the offensive techniques in the companion red-team skills are observable.\n\n## When to Use\n\n- Building or tuning detections for Microsoft Sentinel \u002F Log Analytics covering Entra ID\n- Threat hunting after suspected credential theft, device-code phishing, or OAuth consent abuse\n- Purple-team exercises validating that ROADtools\u002FAADInternals\u002FAzureHound activity is detectable\n- Investigating an alert and needing to correlate Graph API calls back to a sign-in\u002Fsession\n- Closing the legacy Azure AD Graph visibility gap after enabling AADGraphActivityLogs\n\n## Prerequisites\n\n- A Microsoft Sentinel workspace (or Log Analytics) ingesting:\n  - **MicrosoftGraphActivityLogs** (diagnostic setting on Microsoft Entra ID -> graph.microsoft.com)\n  - **AADGraphActivityLogs** (diagnostic setting on Microsoft Entra ID -> legacy Azure AD Graph)\n- `SigninLogs` and `AADNonInteractiveUserSignInLogs` for correlation\n- Microsoft Sentinel Reader\u002FResponder (or Log Analytics Reader) RBAC to run KQL\n- Familiarity with Kusto Query Language (KQL)\n- Enable the diagnostic settings (Azure Portal -> Microsoft Entra ID -> Diagnostic settings -> send `MicrosoftGraphActivityLogs` and `AADGraphActivityLogs` to your workspace), or via CLI:\n  ```bash\n  az monitor diagnostic-settings create \\\n    --name \"entra-graph-logs\" \\\n    --resource \"\u002Fproviders\u002Fmicrosoft.aadiam\u002FdiagnosticSettings\" \\\n    --logs '[{\"category\":\"MicrosoftGraphActivityLogs\",\"enabled\":true},{\"category\":\"AADGraphActivityLogs\",\"enabled\":true}]' \\\n    --workspace \"\u003Clog-analytics-workspace-id>\"\n  ```\n\n## Objectives\n\n- Confirm both Graph activity tables are flowing into the workspace\n- Detect User-Agent string fingerprints of ROADtools, AADInternals, and AzureHound\n- Detect the endpoint-sweep behavioral fingerprint that survives User-Agent spoofing\n- Correlate suspicious Graph activity back to a sign-in\u002Fsession and source identity\n- Operationalize the best queries as scheduled analytics rules\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Application in this skill |\n|----|-----------|---------------------------|\n| T1078.004 | Valid Accounts: Cloud Accounts | Detecting adversaries using valid cloud credentials\u002Ftokens to enumerate the tenant via the Microsoft Graph and legacy Azure AD Graph APIs |\n\nRelated techniques surfaced by these hunts: **T1087.004** Account Discovery: Cloud Account, **T1069.003** Permission Groups Discovery: Cloud Groups, **T1526** Cloud Service Discovery.\n\n## Workflow\n\n### Step 1: Confirm both tables are ingesting\nBefore hunting, verify the data exists and inspect the schema fields you will pivot on.\n\n```kusto\nunion withsource=Tbl MicrosoftGraphActivityLogs, AADGraphActivityLogs\n| where TimeGenerated > ago(1d)\n| summarize Records=count(), LastSeen=max(TimeGenerated) by Tbl\n```\n\n### Step 2: Hunt User-Agent fingerprints (ROADtools \u002F aiohttp)\nROADtools uses `aiohttp`; an un-spoofed run shows `python` + `aiohttp` in the User-Agent.\n\n```kusto\nAADGraphActivityLogs\n| where TimeGenerated > ago(7d)\n| where RequestMethod == \"GET\"\n| where UserAgent contains \"python\" and UserAgent contains \"aiohttp\"\n| summarize RequestCount = count() by CallerIpAddress, AppId, UserAgent, UserId\n| sort by RequestCount desc\n```\n\n### Step 3: Hunt AADInternals and AzureHound agents\nAADInternals leaves toolkit\u002Flibrary strings; AzureHound's Go HTTP client and BloodHound tooling have distinctive agents.\n\n```kusto\nunion MicrosoftGraphActivityLogs, AADGraphActivityLogs\n| where TimeGenerated > ago(7d)\n| where UserAgent has_any (\"AADInternals\", \"aad-internals\", \"azurehound\",\n                           \"BloodHound\", \"python-requests\", \"Go-http-client\")\n| project TimeGenerated, UserAgent, CallerIpAddress, AppId, UserId, RequestUri\n| sort by TimeGenerated desc\n```\n\n### Step 4: Behavioral hunt — the roadrecon endpoint sweep (spoof-resistant)\nEven with a spoofed agent, `roadrecon gather` touches a recognizable set of directory resources in a short window. Bucket by user and 5 minutes; alert when one identity hits the full sweep.\n\n```kusto\nAADGraphActivityLogs\n| where TimeGenerated > ago(1d)\n| where RequestMethod == \"GET\"\n| extend TopLevelResource = tolower(tostring(split(split(RequestUri, \"?\")[0], \"\u002F\")[3]))\n| summarize\n    TopLevelResources = make_set(TopLevelResource),\n    AppIds = make_set(AppId),\n    CallerIPs = make_set(CallerIpAddress),\n    UserAgents = make_set(UserAgent),\n    StartTime = min(TimeGenerated),\n    EndTime = max(TimeGenerated)\n    by UserId, bin(TimeGenerated, 5m)\n| where TopLevelResources has_all (\"users\", \"tenantdetails\", \"groups\", \"applications\",\n    \"serviceprincipals\", \"devices\", \"directoryroles\", \"roledefinitions\", \"contacts\",\n    \"oauth2permissiongrants\", \"authorizationpolicy\")\n| project StartTime, EndTime, UserId, AppIds, CallerIPs, UserAgents\n```\n\n### Step 5: High-volume enumeration outliers\nCatch tooling that simply makes far more directory reads than a human in a short window.\n\n```kusto\nMicrosoftGraphActivityLogs\n| where TimeGenerated > ago(1d)\n| where RequestMethod == \"GET\"\n| where RequestUri has_any (\"\u002Fusers\", \"\u002Fgroups\", \"\u002FservicePrincipals\", \"\u002Fapplications\",\n                            \"\u002FdirectoryRoles\", \"\u002FroleManagement\")\n| summarize Reads=count(), Resources=dcount(RequestUri) by UserId, AppId, CallerIpAddress, bin(TimeGenerated, 10m)\n| where Reads > 200\n| sort by Reads desc\n```\n\n### Step 6: Correlate Graph activity to the originating sign-in\nPivot a suspicious Graph caller back to the sign-in to recover device, location, MFA, and conditional-access result. Note the `SignInActivityId` in AADGraphActivityLogs may carry `==` padding versus `SigninLogs.UniqueTokenIdentifier`.\n\n```kusto\nAADGraphActivityLogs\n| where TimeGenerated > ago(1d)\n| where UserAgent contains \"aiohttp\"\n| extend TokenId = trim_end(\"=\", tostring(SignInActivityId))\n| join kind=leftouter (\n    SigninLogs\n    | extend TokenId = tostring(UniqueTokenIdentifier)\n    | project TokenId, UserPrincipalName, IPAddress, AppDisplayName, ConditionalAccessStatus, DeviceDetail\n) on TokenId\n| project TimeGenerated, UserId, UserPrincipalName, CallerIpAddress, IPAddress,\n          AppDisplayName, ConditionalAccessStatus, UserAgent\n```\n\n### Step 7: Operationalize as analytics rules\nPromote the highest-fidelity queries (Steps 2-4) to scheduled analytics rules. Set a query period\u002Ffrequency (e.g., run every 1h over 1d), map the rule to T1078.004, and configure entity mappings (Account = UserId, IP = CallerIpAddress, Host\u002FApp = AppId) so incidents enrich automatically. Tune out known automation\u002Fservice-principal App IDs and approved scanner IPs via a watchlist before enabling.\n\n## Tools and Resources\n\n| Resource | Purpose | Source |\n|----------|---------|--------|\n| AADGraphActivityLogs reference | Schema and field meaning | https:\u002F\u002Flearn.microsoft.com\u002Fentra\u002Fidentity\u002Fmonitoring-health\u002Fconcept-aad-graph-activity-logs |\n| MicrosoftGraphActivityLogs | Graph API activity schema | https:\u002F\u002Flearn.microsoft.com\u002Fgraph\u002Fmicrosoft-graph-activity-logs-overview |\n| Invictus-IR writeup | AADGraphActivityLogs hunting queries | https:\u002F\u002Fwww.invictus-ir.com\u002Fnews\u002Fthe-missing-link-aadgraphactivitylogs-finally-arrives |\n| Cloudbrothers analysis | Behavioral fingerprinting of ROADtools | https:\u002F\u002Fcloudbrothers.info\u002Fen\u002Faadgraphactivitylogs\u002F |\n| ROADtools | The offensive tool being detected | https:\u002F\u002Fgithub.com\u002Fdirkjanm\u002FROADtools |\n| MITRE T1078.004 | Valid Accounts: Cloud Accounts | https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1078\u002F004\u002F |\n\n## Detection Fingerprint Reference\n\n| Tool | Primary fingerprint | Table |\n|------|---------------------|-------|\n| ROADtools (roadrecon) | `python` + `aiohttp` UA; full directory endpoint sweep in 5 min | AADGraphActivityLogs |\n| AADInternals | `AADInternals` \u002F toolkit strings in UA; AAD Graph reads | AADGraphActivityLogs |\n| AzureHound | Go HTTP client UA; broad MS Graph enumeration | MicrosoftGraphActivityLogs |\n| Generic recon | High GET volume across users\u002Fgroups\u002Fapps\u002FSPs in short window | both |\n\n## Validation Criteria\n\n- [ ] Both MicrosoftGraphActivityLogs and AADGraphActivityLogs confirmed ingesting\n- [ ] User-Agent fingerprint hunt for ROADtools\u002Faiohttp executed\n- [ ] AADInternals\u002FAzureHound agent hunt executed\n- [ ] Behavioral endpoint-sweep hunt executed and tuned for false positives\n- [ ] High-volume enumeration outlier query executed\n- [ ] At least one finding correlated back to a sign-in\u002Fsession and source identity\n- [ ] Best queries promoted to scheduled analytics rules with T1078.004 mapping and entity mappings\n- [ ] Known-good service principals\u002FIPs excluded via watchlist to control false positives\n",{"name":5,"tags":57,"author":60,"domain":51,"license":15,"version":61,"nist_csf":62,"subdomain":64,"description":7,"mitre_attack":65},[46,43,58,47,59,42,41,40],"microsoft-graph","sentinel","mahipal","1.0",[63],"DE.CM-09","soc-operations",[66],"T1078.004","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-entra-offensive-tools-in-graph-logs",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-entra-offensive-tools-in-graph-logs",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-entra-offensive-tools-in-graph-logs",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-entra-offensive-tools-in-graph-logs","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-entra-offensive-tools-in-graph-logs\u002FSKILL.md",true,[91,96,102,106,110,114,118,122],{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-entra-offensive-tools-in-graph-logs\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",2525,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-entra-offensive-tools-in-graph-logs\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fgetting_started.md",10145,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fdatacommons-client\u002Freferences\u002Fgetting_started.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fnode.md",6126,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fdatacommons-client\u002Freferences\u002Fnode.md",{"path":111,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fobservation.md",5498,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fdatacommons-client\u002Freferences\u002Fobservation.md",{"path":115,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fresolve.md",7204,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fdatacommons-client\u002Freferences\u002Fresolve.md",{"path":119,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fstandards.md",1353,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-entra-offensive-tools-in-graph-logs\u002Freferences\u002Fstandards.md",{"path":123,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fagent.py","SCRIPT","脚本",5349,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-entra-offensive-tools-in-graph-logs\u002Fscripts\u002Fagent.py",[129,156,180,207,232,259],{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":52},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[135],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[137,138,139,140,141,51,142,143,144,145,146,147,148,149,150,151,152,153,154,155],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":52},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[162],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[164,152,165,166,141,167,51,144,168,169,170,171,172,173,174,175,176,177,178,179],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":190,"publishedAt":52},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[186,189],{"categoryNo":187,"categoryName":188,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[174,191,192,193,194,51,195,196,168,197,198,199,200,201,37,202,203,204,205,206],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":52},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[213],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,51,218,219,34,220,221,222,223,224,225,226,227,228,171,229,230,231],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":52},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[238],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[240,241,242,51,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":260,"name":261,"nameZh":6,"description":262,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":263,"categories":264,"keywords":266,"publishedAt":52},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[265],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[141,267,51,268,269,270,45,271,272,273,274,202,275,203,276,277,278,279,280,281],"triaging security incident","siem","file","ioc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]