tool

ROADTools S0684

Type: tool
Platform: Identity Provider
Created: 18 February 2022
Last modified: 16 September 2024

ROADTools is a framework for enumerating Azure Active Directory environments. The tool is written in Python and publicly available on GitHub.[1]

Techniques29th pct

Tactics53rd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0684

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects when an account is disabled or blocked for sign in but tried to log in	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Yochana Henderson, '@Yochana-H'	2022-06-17	—	4afac85c-224a-4dd7-b1af-8da40e1c60bd
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
Splunk	The following analytic detects unauthenticated requests to an Amazon EKS Kubernetes cluster, specifically identifying actions by the "system:anonymous" user. (...)	Hunting	experimental	cloud_audit	-	AWS	Discovery Cloud Service Discovery	-	medium	Rod Soto, Splunk	2020-04-29	2026-05-13	294c4686-63dd-4fe6-93a2-ca807626704a	-
Splunk	The following analytic detects unauthenticated requests made against the Kubernetes Pods API, indicating potential unauthorized access attempts. (...)	Hunting	experimental	cloud_audit	-	AWS	Discovery Cloud Service Discovery	-	medium	Rod Soto, Splunk	2020-04-29	2026-05-13	dbfca1dd-b8e5-4ba4-be0e-e565e5d62002	-
	Detects when a configuration change is made to an applications AppID URI.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Unsecured Credentials Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	1b45b0d1-773f-4f23-aedc-814b759563b1
	Detects when a configuration change is made to an applications URI. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Steal Application Access Token Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	0055ad1f-be85-4798-83cf-a6da17c993b3
Splunk	The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Patrick Bareiss, Splunk	2021-02-22	2026-05-13	22cc7a62-3884-48c4-82da-592b8199b72f
Splunk	The following analytic detects the successful deletion of a group within AWS IAM, leveraging CloudTrail IAM events. (...)	Hunting	stable	cloud_audit	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation Discovery Permission Groups Discovery Cloud Groups	-	medium	Patrick Bareiss, Splunk	2024-05-22	2026-05-13	1bbe54f1-93d7-4764-8a01-ddaa12ece7ac
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	ps_script	windows	PowerShell	Collection Automated Collection	-	medium	frack113	2021-07-28	2022-12-25	c1dda054-d638-4c16-afc8-53e007f3fbc5
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Automated Collection Credential Access Unsecured Credentials Credentials In Files	-	medium	frack113	2021-07-28	2022-11-11	f576a613-2392-4067-9d1a-9345fb58d8d1
	Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization. (...)	Placeholder	experimental	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Ivan Saakov	2025-10-19	—	313e72de-0c0d-4d65-8c95-87f4d546eceb
Splunk	The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. (...)	Generic	stable	account_management	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2021-02-22	2026-05-13	2a9b80d3-6340-4345-b5ad-212bf3d0dac4
Splunk	The following analytic identifies excessive security scanning activities in AWS by detecting a high number of Describe, List, or Get API calls from a single user. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Discovery Cloud Service Discovery	-	medium	Patrick Bareiss, Splunk	2021-04-13	2026-05-13	1fdd164a-def8-4762-83a9-9ffe24e74d5a
Splunk	The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-10	2026-05-13	e4384bbf-5835-4831-8d85-694de6ad2cc6
Splunk	The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. (...)	Generic	stable	scheduled_job	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-24	2026-05-13	04455dd3-ced7-480f-b8e6-5469b99e98e2
Splunk	The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. (...)	Generic	stable	scheduled_job	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-10	2026-05-13	05c4b09f-ea28-4c7c-a7aa-a246f665c8a2
	Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-b1d3-46bd-ba26-133337c0ffee
	Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-7375-4f4e-b83b-133337c0ffee
	Detects S3 Browser utility creating IAM User or AccessKey.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-d9d9-4792-91e5-133337c0ffee
Splunk	The following analytic identifies the successful deletion of an IAM group in AWS. (...)	Hunting	stable	account_management	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation Discovery Permission Groups Discovery Cloud Groups	-	medium	Michael Haag, Splunk	2021-04-06	2026-05-13	e776d06c-9267-11eb-819b-acde48001122
	Detects AWS root account usage	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	vitaliy0x1	2020-01-21	2022-10-09	8ad1600d-e9dc-4251-b0ee-a65268f29add
	Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Impact Account Access Removal Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Ivan Saakov	2024-12-19	—	ccd6a6c8-bb4e-4a91-9d2a-07e632819374
Splunk	The following analytic detects when a user sets a default policy version in AWS. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2021-03-02	2026-05-13	2a9b80d3-6340-4345-11ad-212bf3d0dac4
	Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Discovery Account Discovery Cloud Account	-	medium	Adan Alvarez @adanalvarez	2025-10-12	—	9b1b8e9b-0a5d-4af1-9d2f-4c4b6e7c2c9d
	Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Thuya@Hacktilizer, Ivan Saakov	2025-10-18	2025-10-21	77caf516-34e5-4df9-b4db-20744fea0a60
Splunk	The following analytic identifies a successful Console Login authentication event for an AWS IAM user account without Multi-Factor Authentication (MFA) enabled. (...)	Generic	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2022-10-04	2026-05-13	a520b1fe-cc9e-4f56-b762-18354594c52f
Splunk	The following analytic identifies failed authentication attempts against an Azure AD tenant during the Multi-Factor Authentication (MFA) challenge, specifically flagged by error code 500121. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Credential Access Multi-Factor Authentication Request Generation Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk, 0xC0FFEEEE	2022-07-14	2026-05-13	e62c9c2e-bf51-4719-906c-3074618fcc1c
Splunk	This detection identifies the presence of the default AzureHound user-agent string within Microsoft Graph Activity logs and NonInteractive SignIn Logs. (...)	Generic	stable	authentication	-	Microsoft 365	Discovery Account Discovery Cloud Account Discovery Cloud Service Discovery	-	medium	Dean Luxton	2025-01-05	2026-05-13	d62852db-a1f1-40db-a7fc-c3d56fa8bda3
Splunk	The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Azure AD tenant. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Credential Access Multi-Factor Authentication Request Generation Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-08-25	2026-05-13	264ea131-ab1f-41b8-90e0-33ad1a1888ea
	Detect when users are authenticating without MFA being required.	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Persistence, Defense Impairment, Credential Access Modify Authentication Process Multi-Factor Authentication Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	low	MikeDuddington, '@dudders1'	2022-07-27	—	28eea407-28d7-4e42-b0be-575d5ba60b2c
Splunk	The following analytic identifies authentication events of service principals in Azure Active Directory. (...)	Generic	stable	authentication	-	Microsoft 365	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Splunk	2024-02-14	2026-05-13	5a2ec401-60bb-474e-b936-1e66e7aa4060
Splunk	This detection leverages azure graph activity logs to identify when graph APIs have been used to identify 10 or more service principals. (...)	Generic	stable	authentication	-	Microsoft 365	Discovery Account Discovery Cloud Account Discovery Cloud Service Discovery	-	medium	Dean Luxton	2025-01-05	2026-05-13	3f0647ce-add5-4436-8039-cbd1abe74563
Splunk	The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell cmdlets. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-07-12	2026-05-13	62f10052-d7b3-4e48-b57b-56f8e3ac7ceb
Splunk	The following analytic identifies a successful single-factor authentication event against Azure Active Directory. (...)	Generic	stable	authentication	-	Microsoft 365	Resource Development Compromise Accounts Cloud Accounts Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-07-12	2026-05-13	a560e7f6-1711-4353-885b-40be53101fcd
Splunk	The following analytic detects the creation of a new Automation Runbook Webhook within an Azure tenant. (...)	Generic	stable	scheduled_job	-	Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Mauricio Velazco, Brian Serocki, Splunk	2022-08-23	2026-05-13	e98944a9-92e4-443c-81b8-a322e33ce75a
	Detects when a user has been elevated to manage all Azure Subscriptions. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Austin Songer @austinsonger	2021-11-26	2022-08-23	09438caa-07b1-4870-8405-1dbafe3dad95
	Detects user authentication failure events. (...)	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	70ed1d26-0050-4b38-a599-92c53d57d45a
	Monitor and alert for Bitlocker key retrieval.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Michael Epping, '@mepples21'	2022-06-28	—	a0413867-daf3-43dd-9245-734b3a787942
	Detects when changes are made to PIM roles	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'	2022-08-09	—	db6c06c4-bf3b-421c-aa88-15672b88c743
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
Splunk	The following analytic identifies the creation of cloud compute instances by users who have not previously created them. (...)	Anomaly	stable	configuration_change	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Rico Valdez, Splunk	2019-10-16	2026-09-22	37a0ec8d-827e-4d6d-8025-cedf31f3a149	-
Splunk	The following analytic identifies cloud instances being modified by users who have not previously modified them. (...)	Anomaly	stable	configuration_change	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Rico Valdez, Splunk	2020-11-16	2026-09-22	7fb15084-b14e-405a-bd61-a6de15a40722	-
	Monitor and alert for device registration or join events where MFA was not performed.	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Michael Epping, '@mepples21'	2022-06-28	—	5afa454e-030c-4ab4-9253-a90aa7fcc581
	Enumerates Active Directory to determine computers that are joined to the domain	Generic	test	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	frack113	2022-02-12	—	1f6399cf-2c80-4924-ace1-6fcff3393480
	Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Discovery Account Discovery Cloud Account Discovery Cloud Service Discovery	-	high	Janantha Marasinghe	2022-11-27	—	35b781cc-1a08-4a5a-80af-42fd7c315c6b
Splunk	The following analytic detects the execution of `nltest.exe` with command-line arguments `/dclist:` or `/dsgetdc:` to discover domain controllers. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-07-20	41243735-89a7-4c83-bcdd-570aa78f00a1

Title

Description

ROADTools S0684

ROADTools MITRE reference S0684

Standing S0684

Reach

Coverage

ROADTools detections S0684