AzureHound

Use this skill for AzureHound / Entra ID BloodHound query design and attack-path triage.

Required context

• Authorized Azure tenants/subscriptions and whether AzureHound/Entra collection is present.
• Known object IDs, tenant names, privileged roles, subscriptions, or resource scopes.
• Hybrid collection availability when paths cross AD, GitHub, Okta, or SCIM.

Workflow

1. Read ../../references/docs/bloodhound-query-methodology.md and ../../references/docs/azurehound-methodology.md.
2. Search ../../references/query-indexes/azurehound.md for a matching Query Library pattern.
3. Inspect the snapshot and confirm AZ* labels/edges before adapting.
4. Use exact objectid filters when possible and bound broad tenant paths.
5. Explain each path segment by platform and collector source.

Common pivots