---
name: Azure Post-Exploitation
slug: azure-post-exploitation
category: AI Engineering
description: Azure Post-Exploitation provides Azure and Entra ID attack commands for enumeration, credential harvesting, privilege escalation, lateral movement, and persistence. Use it when assessing tenant compromise paths or abuse of M365 and identity controls.
github: "https://github.com/CyberStrikeus/CyberStrike/tree/main/.cyberstrike/skill/azure-postexploit"
language: TypeScript
stars: 1746
forks: 269
install: "npx degit https://github.com/CyberStrikeus/CyberStrike/tree/main/.cyberstrike/skill/azure-postexploit ~/.claude/skills/azure-postexploit"
installs_to: ~/.claude/skills/azure-postexploit
source_path: .cyberstrike/skill/azure-postexploit/SKILL.md
collection_size: 51
category_size: 2451
collection_url: "https://dirskills.com/collections/CyberStrikeus/CyberStrike"
added: 2026-08-12T04:43:15.821Z
last_synced: 2026-08-12T04:43:15.821Z
canonical_url: "https://dirskills.com/skills/azure-post-exploitation"
---

# Azure Post-Exploitation

Azure Post-Exploitation provides Azure and Entra ID attack commands for enumeration, credential harvesting, privilege escalation, lateral movement, and persistence. Use it when assessing tenant compromise paths or abuse of M365 and identity controls.

**Install:**

```bash
npx degit https://github.com/CyberStrikeus/CyberStrike/tree/main/.cyberstrike/skill/azure-postexploit ~/.claude/skills/azure-postexploit
```

## README

# Azure/Entra ID Post-Exploitation Methodology

154 programs across 13 categories — from basic enumeration to advanced Entra ID attacks, CIS compliance auditing, and M365 exploitation. All operations use az CLI and Microsoft Graph API.

## Prerequisites

1. **Valid Azure credentials** — service principal, user credentials, managed identity, or access token
2. **az CLI installed** — `az version`
3. **Current identity** — verify access via `az account show`

```bash
# Quick prerequisite check
az account show    # verify Azure CLI credentials
az version         # verify CLI
```

## Kill Chain Phases

### Phase 1 — Situational Awareness (Recon: 47 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Subscription enum | `azurehook subscription_enum` | Subscription details, quotas, spending |
| Resource graph | `azurehook resource_graph` | Cross-subscription resource queries |
| Entra ID enum | `azurehook entra_enum` | Users, groups, apps, SPs, conditional access |
| VM enum | `azurehook vm_enum` | VMs, public IPs, disks, extensions |
| Network enum | `azurehook vnet_enum` | VNets, subnets, peering, NSGs |
| NSG audit | `azurehook nsg_audit` | Overly permissive network rules |
| RBAC audit | `azurehook rbac_audit` | Role assignments, custom roles |
| SQL enum | `azurehook sql_enum` | SQL servers, databases, firewall rules |
| App Service | `azurehook app_service_enum` | App Service apps, auth, config |
| AKS | `azurehook aks_enum` | AKS clusters, nodegroups, RBAC |
| DNS | `azurehook dns_enum` | DNS zones, records, DNSSEC |
| Subdomain takeover | `azurehook subdomain_takeover` | Dangling CNAME detection |
| Public exposure | `azurehook public_exposure_scan` | Public IPs, storage, databases |
| Managed identity | `azurehook managed_identity` | Managed identity token harvest |
| Plus 33 more | `acr_enum`, `redis_enum`, `data_factory_enum`, `front_door_enum`, `apim_enum`, `databricks_enum`, `app_insights_enum`, `monitor_enum`, `sentinel_enum`, `vpn_gateway_enum`, etc. | Service-specific enumerators |

### Phase 2 — Credential Harvesting (14 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Key Vault dump | `azurehook keyvault_dump` | Secrets, keys, certificates |
| Token abuse | `azurehook azuread_token --action foci` | FOCI token swap, PRT abuse |
| IMDS harvest | `azurehook imds_harvest` | Instance metadata credentials |
| Device code phish | `azurehook device_code_phish` | Device code phishing flow |
| Graph tokens | `azurehook graph_token_harvest` | Multi-resource token harvest |
| Storage keys | `azurehook storage_key_dump` | Storage account access keys |
| Automation creds | `azurehook automation_cred_dump` | Automation Account credentials |
| Kubeconfig | `azurehook kubeconfig_dump` | AKS admin kubeconfig |
| Webapp env | `azurehook webapp_env_dump` | App Service env variables |
| Plus 5 more | `token_theft`, `certificate_abuse`, `refresh_token_replay`, `runbook_cred_extract`, `webapp_env_dump` | Additional credential sources |

### Phase 3 — Privilege Escalation (11 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Consent grant | `azurehook entra_privesc --method consent_grant` | Illicit consent grant |
| PIM activation | `azurehook pim_abuse` | Activate eligible admin roles |
| Global Admin | `azurehook global_admin_elevate` | Global Admin elevation |
| Custom role | `azurehook custom_role_exploit` | Exploit custom role definitions |
| CA bypass | `azurehook conditional_access_audit` | Find MFA gaps in CA policies |
| Managed identity | `azurehook managed_identity_privesc` | Over-privileged managed identities |
| App admin | `azurehook app_admin_privesc` | High-privilege app permissions |
| Plus 4 more | `deployment_privesc`, `resource_hierarchy_abuse`, `group_membership_abuse`, `partner_admin_abuse` | Additional escalation paths |

### Phase 4 — Identity Attacks (Entra ID: 10 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Federation backdoor | `azurehook federation_backdoor --domain D --idp-url URL` | Golden SAML via federation trust |
| PTA abuse | `azurehook pta_abuse` | Pass-Through Authentication interception |
| AADConnect | `azurehook aadconnect_dump` | Sync account enumeration (DCSync) |
| Seamless SSO | `azurehook seamless_sso_abuse` | Silver ticket via AZUREADSSOACC |
| SAML forge | `azurehook saml_forge --domain D` | SAML config for token forging |
| MFA manipulation | `azurehook mfa_manipulation` | MFA method enum/manipulation |
| Password spray | `azurehook password_spray` | Entra ID password spraying |
| Consent phish | `azurehook consent_phish` | OAuth consent phishing |
| Plus 2 more | `user_creation`, `tenant_recon_insider` | Account creation, insider recon |

### Phase 5 — Lateral Movement (10 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| VM Run Command | `azurehook vm_run_command --vm NAME --command CMD` | Execute on VM via Run Command |
| Bastion tunnel | `azurehook bastion_tunnel` | Azure Bastion tunneling |
| Arc exec | `azurehook arc_exec` | Arc connected machine execution |
| Intune deploy | `azurehook intune_deploy` | Deploy scripts via Intune |
| Cross-tenant | `azurehook cross_tenant_enum` | B2B cross-tenant enumeration |
| DevOps | `azurehook devops_service_conn` | DevOps service connection abuse |
| Plus 4 more | `custom_script_ext`, `userdata_command`, `msbuild_exec`, `shared_image_inject` | Additional lateral paths |

### Phase 6 — Persistence (11 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Runbook backdoor | `azurehook runbook_backdoor --automation-account NAME --resource-group RG` | Automation runbook backdoor |
| Logic App | `azurehook logic_app_backdoor --resource-group RG --name NAME --callback-url URL` | HTTP-triggered callback |
| Function App | `azurehook function_app_backdoor --resource-group RG --name NAME --callback-url URL` | Function App with exfil |
| SP persist | `azurehook sp_persist` | Service principal credentials |
| VM extension | `azurehook vm_extension_backdoor` | Custom script extension |
| Lighthouse | `azurehook lighthouse_persist` | Cross-tenant Lighthouse persist |
| Plus 5 more | `webhook_persist`, `devops_pipeline_backdoor`, `acr_image_backdoor`, `scheduled_task_persist`, `oauth_app_persist` | Additional persistence |

### Phase 7 — Data Exfiltration (12 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Storage dump | `azurehook storage_dump` | Blob Storage data exfil |
| Cosmos DB | `azurehook cosmos_dump --account NAME` | Cosmos DB keys and data |
| Disk snapshot | `azurehook disk_snapshot` | Managed disk offline analysis |
| Graph mail | `azurehook graph_mail_dump` | Exchange Online mail via Graph |
| SharePoint | `azurehook sharepoint_dump` | SharePoint document exfil |
| Teams dump | `azurehook teams_dump` | Teams channel messages |
| Plus 6 more | `table_queue_dump`, `file_share_dump`, `data_lake_dump`, `service_bus_sniff`, `event_hub_tap`, `vm_disk_download` | Additional data sources |

### Phase 8 — M365 Exploitation (4 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Exchange abuse | `azurehook exchange_abuse` | Mailbox rules, forwarding, delegation |
| SharePoint enum | `azurehook sharepoint_enum` | SharePoint sites, document libraries |
| Teams enum | `azurehook teams_enum` | Teams channels, messages |
| OneDrive access | `azurehook onedrive_access` | OneDrive files and shared items |

### Phase 9 — Defense Evasion (11 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Diagnostic tamper | `azurehook diagnostic_tamper` | Disable diagnostic settings |
| Sentinel suppress | `azurehook sentinel_suppress` | Suppress analytics rules |
| Defender disable | `azurehook defender_disable` | Disable Defender plans |
| Activity log | `azurehook activity_log_tamper` | Tamper activity log settings |
| Policy exempt | `azurehook policy_exempt` | Create policy exemptions |
| WAF bypass | `azurehook waf_bypass` | Modify/disable WAF rules |
| Plus 5 more | `alert_suppress`, `log_analytics_tamper`, `nsg_flow_log_disable`, `resource_move`, `tag_manipulation` | Additional evasion |

### Phase 10 — Compliance Audit (CIS Azure v3.0: 18 programs)

| Action | Command | CIS Control |
|--------|---------|-------------|
| Defender plans | `azurehook defender_plan_audit` | CIS 2.1 |
| Security contacts | `azurehook defender_contact_audit` | CIS 2.1.x |
| Storage security | `azurehook storage_security_audit` | CIS 4.1-4.17 |
| SQL audit | `azurehook sql_audit_config` | CIS 5.1.1-5.1.7 |
| PostgreSQL | `azurehook postgres_audit` | CIS 4.3.x |
| MySQL | `azurehook mysql_audit` | CIS 4.4.x |
| Cosmos DB | `azurehook cosmos_security_audit` | CIS 4.5.x |
| Diagnostics | `azurehook diagnostic_audit` | CIS 5.1 |
| Activity alerts | `azurehook activity_alert_audit` | CIS 5.2 |
| Network Watcher | `azurehook network_watcher_audit` | CIS 6.5 |
| VM security | `azurehook vm_security_audit` | CIS 7.x |
| App Service | `azurehook appservice_security_audit` | CIS 9.x |
| Key Vault | `azurehook keyvault_security_audit` | CIS 8.x |
| Identity MFA | `azurehook identity_mfa_audit` | CIS 1.1-1.3 |
| Guest access | `azurehook guest_access_audit` | CIS 1.5 |
| Password policy | `azurehook password_policy_audit` | CIS 1.8-1.11 |
| Resource locks | `azurehook resource_lock_audit` | CIS 8.5 |
| Policy compliance | `azurehook policy_compliance_audit` | Azure Policy |

### Phase 11 — Impact Assessment (5 programs)

| Action | Command | MITRE |
|--------|---------|-------|
| Resource hijack | `azurehook resource_hijack` | T1496 |
| Data destroy | `azurehook data_destroy` | T1485 |
| Ransomware sim | `azurehook ransomware_sim` | T1486 |
| Account lockout | `azurehook account_lockout` | T1531 |
| Service disruption | `azurehook service_disruption` | T1489 |

### Phase 12 — Cleanup (MANDATORY)

```
azurehook cleanup_azure
```

## Detection Considerations

- **Azure Activity Log** — All ARM API calls, role assignments, resource creation
- **Entra ID Audit Logs** — App consent grants, credential additions, role activations
- **Microsoft Defender for Cloud** — Anomalous resource access, privilege escalation
- **Conditional Access** — Untrusted location/device blocks
- **Azure Sentinel** — UEBA, anomalous sign-in patterns, bulk data access
- **Microsoft Graph Activity Logs** — Graph API access to mail, files, teams

## Program Reference

| Program | Technique | MITRE ATT&CK |
|---------|-----------|---------------|
| entra_enum | Entra ID tenant enumeration | T1087.004 |
| subscription_enum | Subscription discovery | T1580 |
| resource_graph | Cross-subscription queries | T1580 |
| keyvault_dump | Key Vault secret extraction | T1555.006 |
| storage_dump | Azure Storage data exfiltration | T1530 |
| managed_identity | Managed identity token harvest | T1552.005 |
| azuread_token | Token manipulation and FOCI abuse | T1550.001 |
| entra_privesc | Privilege escalation via consent/PIM | T1098.001 |
| federation_backdoor | Federation trust manipulation | T1484.002 |
| pta_abuse | PTA credential interception | T1556.007 |
| aadconnect_dump | AADConnect sync account abuse | T1003.006 |
| runbook_backdoor | Automation Account persistence | T1525 |
| vm_run_command | VM Run Command execution | T1059.006 |
| diagnostic_tamper | Disable diagnostic settings | T1562.008 |
| sentinel_suppress | Suppress Sentinel analytics | T1562.001 |
| resource_hijack | Resource hijacking/cryptomining | T1496 |
| exchange_abuse | Exchange Online abuse | T1114.002 |
| cleanup_azure | Resource removal and restoration | T1070 |