EasyTokens

EasyTokens Un servidor de phishing mediante código de dispositivo para emulación de adversarios. Captura tokens OAuth de Microsoft 365 a través del flujo de Concesión de Autorización de Dispositivo. Inspirado en GraphSpy. Advertencia — Solo uso autorizado. Esta herramienta está destinada a tester...

Azure-Sentinel

Microsoft Sentinel and Microsoft 365 Defender Welcome to the unified Microsoft Sentinel and Microsoft 365 Defender repository! This repository contains out of the box detections, exploration queries, hunting queries, workbooks, playbooks and much more to help you get ramped up with Microsoft...

hawk

Documentación y Recursos de Hawk Visita hawkforensics.io para obtener documentación completa que incluye: Guías detalladas de instalación y permisos Tutoriales paso a paso y videos de "Cómo hacer" Ayuda para resolución de problemas Buenas prácticas y ejemplos de uso ¿Qué es Hawk? Hawk es un módul...

ics-phishing-toolkit

ics-phishing-toolkit This toolkit for remediating malicious calendar invites is designed to help teams using email security solutions that don't natively remediate these attacks. If you're using Sublime, you don't need this toolkit because remediation is natively supported. Supported stacks...

MAAD-AF

MAAD Attack Framework MAAD-AF es una herramienta de ataque en la nube de código abierto para entornos de Microsoft 365 y Entra ID Azure AD. MAAD-AF ofrece pruebas de seguridad simples, rápidas y efectivas. Valide los controles en la nube de Microsoft y pruebe las capacidades de detección y...

cve-2025-32711

CVE-2025-32711 EchoLeak 检测工具 🔐 概述 CVE-2025-32711（代号“EchoLeak”）是 Microsoft 365 Copilot 中的一个严重的零点击漏洞，允许攻击者在无需任何用户交互的情况下窃取敏感的组织数据。此仓库包含检测和修复工具，帮助组织评估其暴露面并实施保护措施。 演示 基于 PowerShell 的检测与修复工具演示 漏洞详情 CVE ID : CVE-2025-32711 代号 : EchoLeak CVSS 评分 : 9.3（严重） 类型 : 大模型作用域违规 / AI 命令注入 受影响产品 : Microsoft 365...

M365-Assess

M365 Assess Comprehensive M365 Security Assessment Tool Read-only Microsoft 365 security assessment for IT consultants and administrators What is this? M365 Assess runs a single read-only command against a Microsoft 365 tenant and produces CSV data, a self-contained branded HTML report, and an XL...

365Inspect

Propósito Avanzar el estado de la seguridad de Microsoft 365 mediante la creación de un script de PowerShell que automatice la evaluación de seguridad de los entornos de Microsoft 365. Soteria Inspect Soteria Inspect nace del proyecto 365Inspect y es la solución SaaS de Soteria para ayudar a...

TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords

Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNKCondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It...

Microsoft365_devicePhish

Microsoft365devicePhish Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack This is a simple proof-of-concept script that allows an attacker to conduct a phishing attack against Microsoft 365 OAuth Authorization Flow. Using this, one can connect to Microsoft's OAuth API endpoints t...

m365_groups_enum

Enumerate Microsoft 365 Groups in a tenant with their metadata Description The allgroups.py script allows to enumerate all Microsoft 365 Groups in a Azure AD tenant with their metadata: name visibility: public or private description email address owners members Teams enabled? SharePoint URL e.g...

m365_groups_enum

Enumerar grupos de Microsoft 365 en un inquilino con sus metadatos Descripción El script allgroups.py permite enumerar todos los grupos de Microsoft 365 en un inquilino de Azure AD con sus metadatos: nombre visibilidad: público o privado descripción dirección de correo electrónico propietarios...

gundog

gundog gundog - 基于 PowerShell 的 Microsoft 365 Defender 引导式狩猎 Gundog 为您提供 Microsoft 365 Defender 中的引导式狩猎。目前尤其（即便不是唯一）适用于电子邮件和终结点警报。 功能 您提供一个 AlertID（您可能通过电子邮件通知收到），gundog 将尽可能多地搜索相关数据。它不会像门户中的高级搜寻那样提供灵活性，但会为您提供警报、所有相关实体以及一些丰富信息的快速初步概览。 它执行的所有搜索都基于警报时间戳——因此我们只关心警报前后不久的事件。 它还会为您搜索到的每个实体提供 PowerShell...

gundog

gundog gundog - PowerShell based guided hunting in Microsoft 365 Defender Gundog provides you with guided hunting in Microsoft 365 Defender. Especially if not only for Email and Endpoint Alerts at the moment. Functionality You provide an AlertID you might received via Email notification and gundo...

DFIR-O365RC

Tabla de contenidos: 1. Descripción del módulo 2. Instalación y requisitos 1. Usando Docker 2. Instalación manual 3. Gestión de la aplicación DFIR-O365RC 1. Creación de la aplicación 2. Actualización de la aplicación 3. Eliminación de la aplicación 4. Requisitos de permisos y licencias 5. Funcion...

monkey365

...

aisecplus-week01-danielossai

🔐 AISec Plus — Week 1: Map the Threat Researcher: Daniel Ossai Repo: aisecplus-week01-danielossai Submitted: Week 1 · AISec Plus Bootcamp 📌 Incident Name & Date EchoLeak CVE-2025-32711 Discovered: January 2025 · Disclosed: June 2025 · Patched: June 2025 📝 What Happened Researchers at Aim Security...

CVE-2026-54998-exp

DISCLAIMER This repository is for educational and research purposes only. The author is not responsible for any misuse, damage, or illegal activities caused by the use of this material. Use at your own risk. Respect applicable laws and ethical guidelines. Overview CVE-2026-54998 is an Incorrect...

check_mdi

checkmdi Python script to enumerate valid Microsoft 365 domains, retrieve tenant name, and check for a Microsoft Defender for Identity MDI instance. Based on: https://github.com/thalpius/Microsoft-Defender-for-Identity-Check-Instance. Usage ./checkmdi.py -d...

EUVD-2026-82590

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...