cve-2025-32711

CVE-2025-32711 EchoLeak Detection Tool 🔐 Overview CVE-2025-32711, nicknamed "EchoLeak," is a critical zero-click vulnerability in Microsoft 365 Copilot that allowed attackers to exfiltrate sensitive organizational data without any user interaction. This repository contains detection and remediati...

monkey365

Monkey365 is an open-source security assessment framework for Microsoft 365, Azure, and Microsoft Entra ID. It helps security professionals, consultants, administrators, and incident responders identify misconfigurations, review cloud security posture, and evaluate environments against industry...

M365-Assess

M365 Assess Comprehensive M365 Security Assessment Tool Read-only Microsoft 365 security assessment for IT consultants and administrators What is this? M365 Assess runs a single read-only command against a Microsoft 365 tenant and produces CSV data, a self-contained branded HTML report, and an XL...

DFIR-O365RC

Table of contents: 1. Module description 2. Installation and prerequisites 1. Using Docker 2. Manual Installation 3. Managing the DFIR-O365RC application 1. Creating the application 2. Updating the application 3. Removing the application 4. Permissions and license requirements 5. Functions includ...

ics-phishing-toolkit

ics-phishing-toolkit This toolkit for remediating malicious calendar invites is designed to help teams using email security solutions that don't natively remediate these attacks. If you're using Sublime, you don't need this toolkit because remediation is natively supported. Supported stacks...

Azure-Sentinel

Microsoft Sentinel and Microsoft 365 Defender Welcome to the unified Microsoft Sentinel and Microsoft 365 Defender repository! This repository contains out of the box detections, exploration queries, hunting queries, workbooks, playbooks and much more to help you get ramped up with Microsoft...

m365_groups_enum

Enumerate Microsoft 365 Groups in a tenant with their metadata Description The allgroups.py script allows to enumerate all Microsoft 365 Groups in a Azure AD tenant with their metadata: name visibility: public or private description email address owners members Teams enabled? SharePoint URL e.g...

check_mdi

checkmdi Python script to enumerate valid Microsoft 365 domains, retrieve tenant name, and check for a Microsoft Defender for Identity MDI instance. Based on: https://github.com/thalpius/Microsoft-Defender-for-Identity-Check-Instance. Usage ./checkmdi.py -d...

EasyTokens

EasyTokens A device-code phishing server for adversary emulation. Captures Microsoft 365 OAuth tokens via the Device Authorization Grant flow. Inspired by GraphSpy. Warning — Authorized Use Only. This tool is intended for penetration testers and red teamers operating under explicit written...

MAAD-AF

MAAD Attack Framework MAAD-AF is an open-source cloud attack tool for Microsoft 365 & Entra IDAzure AD environments. MAAD-AF offers simple, fast and effective security testing. Validate Microsoft cloud controls and test detection & response capabilities with a virutally zero-setup process, comple...

365Inspect

Purpose Further the state of Microsoft 365 security by authoring a PowerShell script that automates the security assessment of Microsoft 365 environments. Soteria Inspect Soteria Inspect is born from the 365Inspect project and is Soteria's SaaS solution to aid in assessing the security of a...

gundog

gundog gundog - PowerShell based guided hunting in Microsoft 365 Defender Gundog provides you with guided hunting in Microsoft 365 Defender. Especially if not only for Email and Endpoint Alerts at the moment. Functionality You provide an AlertID you might received via Email notification and gundo...

hawk

Hawk Documentation and Resources Visit hawkforensics.io for comprehensive documentation including: Detailed installation and permissions guides Step-by-step tutorials and "How to" videos Troubleshooting help Best practices and usage examples What is Hawk? Hawk is a free, open-source PowerShell...

Microsoft365_devicePhish

Microsoft365devicePhish Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack This is a simple proof-of-concept script that allows an attacker to conduct a phishing attack against Microsoft 365 OAuth Authorization Flow. Using this, one can connect to Microsoft's OAuth API endpoints t...

m365_groups_enum

माइक्रोसॉफ्ट 365 समूहों की एक टेनेंट में उनके मेटाडेटा के साथ गणना करें विवरण allgroups.py स्क्रिप्ट एक Azure AD टेनेंट में सभी Microsoft 365 Groups की उनके मेटाडेटा के साथ गणना करने की अनुमति देती है: नाम दृश्यता: सार्वजनिक या निजी विवरण ईमेल पता स्वामी सदस्य Teams सक्षम? SharePoint URL जैसे Tea...

gundog

gundog gundog - Microsoft 365 Defender में PowerShell आधारित निर्देशित हंटिंग Gundog आपको Microsoft 365 Defender में निर्देशित हंटिंग प्रदान करता है। खासकर यदि केवल नहीं फिलहाल ईमेल और एंडपॉइंट अलर्ट के लिए। कार्यक्षमता आप एक AlertID प्रदान करते हैं जो आपको ईमेल सूचना के माध्यम से प्राप्त हो सकता...

DefinitelyNotPhishing

⚠️ Disclaimer This repository is intended solely for educational and testing purposes. All tools, configurations, and resources included here such as phishing templates, red team utilities, or offensive security scripts are provided strictly for use in authorized environments , such as labs, demos...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise applications relates to the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise applications is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages relates to the use of an uninitialized resource, allowing a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to the use of an uninitialized resource. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise applications relates to the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise applications is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...