AADInternals is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.[1][2]
24
TechniquesTop 13%
10
TacticsTop 6%
2
Threat groupsunranked
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques24Top 13%
87th percentile · 87% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
Tactics10Top 6%
94th percentile · 94% of 825 ATT&CK software entries have this many tactics spanned or fewer.
Threat groups261% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaigns085% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique10.5medBottom 16%
16th percentile · 84% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique1med
AADInternals detections S0677
688 distinct rules cover the 24 techniques recorded for this tool. 431 Sigma · 257 Splunk.
20 covered by at least one rule4 with no coverage688 distinct rules in total
Showing 1-50 of 600+ rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.
The following analytic detects unauthenticated requests to an Amazon EKS Kubernetes cluster, specifically identifying actions by the "system:anonymous" user. (...)
Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.
Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
2022-06-02
—
0055ad1f-be85-4798-83cf-a6da17c993b3
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
The following analytic identifies the registration of a new Multi-Factor Authentication (MFA) method for an AWS account, as logged through Amazon Security Lake (ASL). (...)
The following analytic identifies the creation of a login profile for one AWS user by another, followed by a console login from the same source IP. (...)
The following analytic identifies excessive security scanning activities in AWS by detecting a high number of Describe, List, or Get API calls from a single user. (...)
This detection identifies the presence of the default AzureHound user-agent string within Microsoft Graph Activity logs and NonInteractive SignIn Logs. (...)
The following analytic detects when a single service principal in Azure AD creates more than three unique OAuth applications within a 10-minute span. (...)
The following analytic identifies instances where a single user creates more than three unique OAuth applications within a 10-minute timeframe in Azure AD. (...)
The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. (...)
The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Azure AD environment. (...)