EntraTrace - EntraTrace is a defensive security research tool f

项目说明

EntraTrace

EntraTrace is a defensi research tool for documenting and identifying the observable behavior of offensi targeting Microsoft Entra ID.

The project builds a automatic knowledge base around tools such as AzureHound, AADInternals, O365Enum, PingCastle, and others, with a focus on the UserAgent and API artifacts they generate.

Project Status

🚧 De

The project is actively being de. Data, tooling co, and functionality will evolve over time.

Contributions, research, corrections, and additional tool analysis are welcome.

What does it track?

EntraTrace focuses on information that can be useful to defenders, including:

* 🔎 API endpoints — Microsoft Graph, Azure AD Graph and other API endpoints accessed by tooling
* 🕵️ User agents — HTTP user agents associated with offensi
* 🛡️ Detection opportunities — Data that can support detection engineering, hunting, and incident response

The goal is to make offensi behavior easier for defensi to understand and turn into actionable information.

Tool Profiles

<!-- TOOL_PROFILE_TABLE_START -->
| Tool | Unique APIs | Unique API calls | UserAgents |
| --- | --- | --- | --- |
| aadinternals | 4 | 110 | 18 |
| AzureHound | 2 | 28 | 0 |
| Graphpython | 3 | 119 | 17 |
| GraphRunner | 4 | 67 | 21 |
| GraphSpy | 2 | 38 | 2 |
| MFASweep | 4 | 17 | 11 |
| MicroBurst | 3 | 78 | 0 |
| MSOLSpray | 1 | 1 | 0 |
| o365enum | 1 | 1 | 2 |
| o365spray | 1 | 1 | 2 |
| pingcastle | 3 | 14 | 1 |
| PowerZure | 3 | 29 | 0 |
| ROADtools | 4 | 434 | 7 |
| ropci | 3 | 15 | 0 |
| Stormspotter | 3 | 4 | 0 |
| TeamFiltration | 3 | 62 | 2 |
| TokenSmith | 2 | 8 | 0 |
| TokenTactics | 4 | 8 | 16 |
| TokenTacticsV2 | 4 | 30 | 23 |
<!-- TOOL_PROFILE_TABLE_END -->

Why?

Offensi tools are frequently used to assess and attack identity en. Understanding how those tools interact with Entra ID can help defenders identify their use, in suspicious activity, and impro co.

EntraTrace aims to bridge the gap between offensi research and defensi operations.

Use Cases

EntraTrace can be used to:

* Build detections for known offensi tools
* Develop Microsoft Sentinel / SIEM hunting queries
* In suspicious Entra ID and Microsoft Graph activity
* Identify tooling during incident response
* Research the behavior of offensi tooling
* Impro into identity attack techniques

Hunting Queries

Local Deployment

The repository is updated daily, but local deployment is supported. To run locally from the repository root with Python. Use the built-in help output to confirm the a options before running them.

⚠️ - Running the script locally may result in security alerts as repos containing offensi are downloaded locally to extract the information needed to create a profile.

AI-Assisted De

> 🤖 EntraTrace is de with the assistance of AI. AI is used throughout the de and research process, with human review and of the resulting work.

Related Content

License

See LICENSE for licensing information.

项目信息

开发语言：Python

Star 数：106

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕EntraTrace is a defensive security research tool for tracking and identifying the behavior of offensive tooling targeting Microsoft Entra ID.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。