AADInternals
- ID
- S0677
- Type
- Tool
- Platforms
- Windows, Office Suite, Identity Provider
- Source
- attack.mitre.org
- MITRE last modified
- 17 Apr 2025
AADInternals is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.[1][2]
Techniques used (24)
- T1003.004 LSA Secrets
- T1048 Exfiltration Over Alternative Protocol
- T1059.001 PowerShell
- T1069.003 Cloud Groups
- T1087.004 Cloud Account
- T1098.005 Device Registration
- T1112 Modify Registry
- T1136.003 Cloud Account
- T1484.002 Trust Modification
- T1526 Cloud Service Discovery
- T1528 Steal Application Access Token
- T1530 Data from Cloud Storage
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1556.006 Multi-Factor Authentication
- T1556.007 Hybrid Identity
- T1558.002 Silver Ticket
- T1566.002 Spearphishing Link
- T1589.002 Email Addresses
- T1590.001 Domain Properties
- T1598.003 Spearphishing Link
- T1606.002 SAML Tokens
- T1649 Steal or Forge Authentication Certificates
- T1651 Cloud Administration Command