SharePointDumper

SharePointDumper SharePointDumper es una utilidad de extracción y auditoría basada en PowerShell que enumera los sitios de SharePoint a los que un usuario puede acceder a través de Microsoft Graph y descarga archivos a través de SharePoint. Está diseñado para pruebas de SOC / DLP, purple teaming ...

offensive-azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...

M365Pwned

M365Pwned Herramientas de Red Team para la explotación de Microsoft 365 mediante la API de Microsoft Graph. Dos herramientas GUI de WinForms para enumerar, buscar y extraer datos de entornos M365 utilizando tokens OAuth a nivel de aplicación — sin interacción del usuario. Herramienta| Objetivo| Q...

Azure-AccessPermissions

Azure-AccessPermissions Script de PowerShell fácil de usar para enumerar permisos de acceso en un entorno de Azure Active Directory. Los detalles de fondo se pueden encontrar en las publicaciones de blog adjuntas: Desenredando las Entidades de Seguridad y los Permisos de Acceso de Azure Active...

azureOutlookC2

Azure Outlook C2 Azure Outlook Comando y Control que utiliza Microsoft Graph API para comunicaciones C2 y exfiltración de datos. Controla de forma remota un dispositivo Windows comprometido desde tu buzón de Outlook. Creadores: Bobby Cooke @0xBoku & Paul Ungur @C5pider Actualización de amenazas C...

AzureRedOps

AzureRedOps Una herramienta navaja suiza para red teaming en Azure / Entra ID. Autor: Mr.Un1k0d3r TrueCyber Inc Versión: 0.1 Lenguaje: Python 3.12+ Resumen AzureRedOps es un conjunto de herramientas de seguridad ofensiva para evaluar la postura de seguridad de los inquilinos de Microsoft Entra ID...

o365-attack-toolkit

What is o365-attack-toolkit o365-attack-toolkit allows operators to perform oauth phishing attacks. We decided to move from the old model of static definitions to fully "interactive" with the account in real-time. Some of the changes Interactive E-mail Search - Allows you to search for user e-mai...

reportly

Reportly es una herramienta de informes de actividad de usuarios de EntraID. Acerca de la herramienta Esta es una herramienta que ayudará a los equipos azules durante un incidente en la nube. Al ejecutar la herramienta, el investigador ingresará como entrada un usuario sospechoso y un período de...

reportly

Reportly is an EntraID user activity report tool. About the tool This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following: 1. Information about t...

APEX

APEX anteriormente AzurePwn: Framework de Post-Explotación de Azure Un intento de facilitar las tareas de post-explotación una vez que tenemos acceso a algún tipo de credenciales de una cuenta relacionada con Azure. Para ser honesto, no es nada nuevo ni espectacular. Solo es mi viejo yo perezoso...

AzureGraph

AzureGraph AzureGraph es una herramienta de recopilación de información de Azure AD a través de Microsoft Graph. Gracias a la tecnología de Microsoft Graph, es posible obtener todo tipo de información de Azure AD, como usuarios, dispositivos, aplicaciones, dominios y mucho más. Esta aplicación...

msteams

msteams A Mythic C2 Profile that uses the Microsoft Graph API to communicate through a Microsoft Teams channel. How It Works Agent Microsoft Teams Channel C2 Server Mythic 1. The agent authenticates to Microsoft Entra ID via OAuth2 client credentials 2. Posts its Mythic message base64-encoded,...

GraphStrike

GraphStrike Publicación del lanzamiento: GraphStrike: Usando Microsoft Graph API para hacer que el tráfico Beacon desaparezca Blog del desarrollador: GraphStrike: Anatomía del desarrollo de herramientas ofensivas Introducción GraphStrike es un conjunto de herramientas que permite que el Beacon...

OneDrive-UDC2

OneDrive UDC2 A Cobalt Strike User-Defined C2 channel that uses OneDrive as the transport layer. What you need A Microsoft Entra ID tenant with a user that has OneDrive for Business. An app registration with the Files.ReadWrite.All application permission. Setup 1. Register an application In Azure...

Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the...

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as "Antino" in developer artifacts. Talos first observe...

MGASA-2026-0457 Updated erlang package fixes security vulnerabilities

SSH SFTP server denial of service via extended channel data infinite loop. CVE-2026-54886 Plaintext APPLICATIONDATA injected during TLS handshake delivered to client application post-handshake in ssl. CVE-2026-54891 Plug: quadratic-time decoding of nested query/body parameters enables denial of...

Updated erlang package fixes security vulnerabilities

SSH SFTP server denial of service via extended channel data infinite loop. CVE-2026-54886 Plaintext APPLICATIONDATA injected during TLS handshake delivered to client application post-handshake in ssl. CVE-2026-54891 Plug: quadratic-time decoding of nested query/body parameters enables denial of...

CVE-2026-63208

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...

EUVD-2026-87271

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...