The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides instructions for extracting and decrypting sensitive credentials from local storage.
Evidence: Methodology to extract browser cookies from SQLite databases located at %LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies and %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cookies.
Evidence: Instructions for reading Azure CLI token caches in plain text from ~/.azure/msal_token_cache.json.
Evidence: Use of Mimikatz to extract Primary Refresh Tokens (PRT) from the Windows Local Security Authority (LSA) process memory.
[COMMAND_EXECUTION]: Extensive use of shell commands to execute third-party offensive security tools for reconnaissance and exploitation.
Evidence: Execution of specialized tools like MSOLSpray.py, ruler, trevorspray, and roadrecon for password spraying and tenant enumeration.
Evidence: Commands for mapping attack paths using AzureHound and interacting with Microsoft Graph API using GraphRunner.
[DATA_EXFILTRATION]: Outlines techniques for capturing and replaying authentication tokens to gain unauthorized access to Microsoft 365 and Azure resources.
Evidence: Workflow for extracting Access Tokens (AT), Refresh Tokens (RT), and PRTs for unauthorized API calls to graph.microsoft.com and management.azure.com.
Evidence: Hijacking sessions by injecting stolen ESTSAUTH cookies into a browser to bypass Multi-Factor Authentication (MFA).
[PRIVILEGE_ESCALATION]: Describes methods to elevate permissions within an Azure tenant by exploiting application and role configuration flaws.
Evidence: Adding unauthorized password or certificate credentials to existing Application objects using addPassword and addKey endpoints to assume the identity of a Service Principal.
Evidence: Instructions to assign the 'Global Administrator' role to an attacker-controlled identity if the current context possesses the RoleManagement.ReadWrite.Directory permission.
[PERSISTENCE]: Details methods for maintaining long-term access to target tenants.
Evidence: Implementation of a shell loop script that continuously refreshes tokens to prevent expiration.
Evidence: Creating secondary credentials on highly privileged Application registrations for persistent backdoors.
[EXTERNAL_DOWNLOADS]: Recommends the installation and use of various third-party offensive security tools from external GitHub repositories.
Evidence: References to external tools such as ROADtools, AADInternals, TokenTactics, and GraphRunner which are not part of the standard environment.

azure-ad-attack