EvilMist - EvilMist is a collection of scripts and utilities

项目说明

<di="center">
<img src="assets/E.png" alt="E Logo" width="400"/>
</div>

E

E is a collection of scripts and utilities designed to support cloud security configuration audit, cloud penetration testing & cloud red teaming. The toolkit helps identify misconfigurations, assess pri paths, and simulate attack techniques. E aims to streamline cloud-focused red-team workflows and improve the o security posture of cloud infrastructures

---

Tools

Unauthenticated Entra ID Enumeration

Unauthenticated Azure/Entra ID enumeration and reconnaissance tool. Performs passi enumeration using publicly accessible APIs and DNS queries without requiring any authentication tokens.

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraEnum-PS1.md | scripts/powershell/In.ps1 |

---

Enumerate-EntraUsers

Comprehensi Entra ID (Azure AD) user enumeration and security assessment tool, a in both PowerShell and Python .

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraRecon-PS1.md | scripts/powershell/In.ps1 |
| Python | EntraRecon-PY.md | scripts/python/entra_recon.py |

---

MFA Security Check

Focused security assessment tool to identify Azure Entra ID users without Multi-Factor Authentication (MFA) enabled. Includes ad features for shared mailbox detection and sign-in activity analysis..

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraMFACheck-PS1.md | scripts/powershell/In.ps1 |

---

Guest Account Enumeration

Comprehensi account analysis tool to identify, analyze, and assess the security posture of external users in Azure Entra ID. Essential for guest access go and security audits.

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraGuestCheck-PS1.md | scripts/powershell/In.ps1 |

---

Critical Administrati Check

Comprehensi assessment tool to identify Azure Entra ID users with access to 10 critical administrati including PowerShell tools, management portals, core Microsoft 365 services, and pri identity management. Essential for pri access go and administrative tool auditing.

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraAppAccess-PS1.md | scripts/powershell/In.ps1 |

---

Quick Start

Script Dispatcher (PowerShell)

Execute any script from the root directory without na to subfolders:

A scripts: EntraEnum, EntraRecon, EntraMFACheck, EntraGuestCheck, EntraAppAccess, EntraRoleCheck, EntraSer, EntraConditionalAccessCheck, EntraAdminUnitCheck, EntraStaleAccountCheck, EntraDe, EntraSSPRCheck, EntraPasswordPolicyCheck, EntraLegacyAuthCheck, EntraLicenseCheck, EntraDirectorySyncCheck, EntraPowerPlatformCheck, EntraGroupCheck, EntraApplicationCheck, EntraAttackPathCheck, EntraAzureRBACCheck, EntraOAuthConsentCheck, EntraSignInRiskCheck, EntraPIMCheck, EntraKey, EntraStorageAccountCheck, EntraNetworkSecurityCheck, EntraManagedIdentityCheck, EntraExchangeCheck, EntraSharePointCheck, EntraTeamsCheck, EntraAzureAttackPathCheck, EntraReport, EntraComplianceCheck, SharePointEnum

Unauthenticated Entra ID Enumeration (PowerShell)

Requirements: PowerShell 7+ (no additional modules needed)

📖 Full documentation: EntraEnum-PS1.md

Enumerate-EntraUsers (PowerShell)

Requirements: PowerShell 7+

📖 Full documentation: EntraRecon-PS1.md

Enumerate-EntraUsers (Python)

Requirements: Python 3.8+, msal, requests

📖 Full documentation: EntraRecon-PY.md

MFA Security Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraMFACheck-PS1.md

Guest Account Enumeration (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraGuestCheck-PS1.md

Critical Administrati Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraAppAccess-PS1.md

Pri Role Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraRoleCheck-PS1.md

Service Principal Security Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraSer.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraSer.md | scripts/powershell/InalCheck.ps1 |

---

Application Registration Security Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraApplicationCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraApplicationCheck-PS1.md | scripts/powershell/Inck.ps1 |

---

Conditional Access Policy Security Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraConditionalAccessCheck-PS1.md

Administrative Unit Security Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraAdminUnitCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraAdminUnitCheck-PS1.md | scripts/powershell/In.ps1 |

---

Stale Account Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraStaleAccountCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraStaleAccountCheck-PS1.md | scripts/powershell/Ineck.ps1 |

---

Device Trust and Compliance Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraDe.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraDe.md | scripts/powershell/In.ps1 |

---

Self-Service Password Reset Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraSSPRCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraSSPRCheck-PS1.md | scripts/powershell/In.ps1 |

---

Password Policy Security Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraPasswordPolicyCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraPasswordPolicyCheck-PS1.md | scripts/powershell/InCheck.ps1 |

---

Legacy Authentication Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraLegacyAuthCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraLegacyAuthCheck-PS1.md | scripts/powershell/Ink.ps1 |

---

License and SKU Analysis (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraLicenseCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraLicenseCheck-PS1.md | scripts/powershell/In.ps1 |

---

Directory Sync Status Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraDirectorySyncCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraDirectorySyncCheck-PS1.md | scripts/powershell/Inheck.ps1 |

---

Power Platform Enumeration (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules, Power Platform Admin or En Maker permissions

Authentication: The script automatically handles Power Platform API authentication:

📖 Full documentation: EntraPowerPlatformCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraPowerPlatformCheck-PS1.md | scripts/powershell/Inheck.ps1 |

---

Attack Path Analysis (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraAttackPathCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraAttackPathCheck-PS1.md | scripts/powershell/Ink.ps1 |

---

Azure RBAC Role Assignment Audit & Drift Detection (PowerShell)

Requirements: PowerShell 7+, Az.Accounts, Az.Resources, Microsoft.Graph.Authentication modules

📖 Full documentation: EntraAzureRBACCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraAzureRBACCheck-PS1.md | scripts/powershell/In.ps1 |

---

OAuth Consent Grant Audit (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules

📖 Full documentation: EntraOAuthConsentCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraOAuthConsentCheck-PS1.md | scripts/powershell/Ineck.ps1 |

---

Sign-In Risk Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules, Azure AD Premium P2

📖 Full documentation: EntraSignInRiskCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraSignInRiskCheck-PS1.md | scripts/powershell/Ink.ps1 |

---

Pri Identity Management (PIM) Check (PowerShell)

Requirements: PowerShell 7+, Microsoft.Graph modules, Azure AD Premium P2

📖 Full documentation: EntraPIMCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraPIMCheck-PS1.md | scripts/powershell/In.ps1 |

---

Azure Key Vault Security Check (PowerShell)

Requirements: PowerShell 7+, Az.Accounts, Az.KeyVault, Az.Resources, Az.Monitor modules

📖 Full documentation: EntraKey.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraKey.md | scripts/powershell/In.ps1 |

---

Azure Storage Account Security Audit

Comprehensi Storage Account security audit tool that detects exposed storage accounts and data exfiltration risks. Identifies public blob containers, network misconfigurations, and data protection gaps.

📖 Full documentation: EntraStorageAccountCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraStorageAccountCheck-PS1.md | scripts/powershell/InCheck.ps1 |

---

Network Security Check (PowerShell)

Requirements: PowerShell 7+, Azure PowerShell modules

📖 Full documentation: EntraNetworkSecurityCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraNetworkSecurityCheck-PS1.md | scripts/powershell/InyCheck.ps1 |

---

Managed Identity Security Audit

Comprehensi Managed Identity security audit tool that identifies excessi and security risks. Detects high-pri managed identities, cross-subscription access, and unused identities.

📖 Full documentation: EntraManagedIdentityCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraManagedIdentityCheck-PS1.md | scripts/powershell/InyCheck.ps1 |

---

Exchange Online Security Audit

Comprehensi Online security audit tool that detects mail-based attack and data exfiltration risks. Identifies inbox rules forwarding to external addresses, suspicious transport rules, mailbox delegations, and audit logging gaps.

📖 Full documentation: EntraExchangeCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraExchangeCheck-PS1.md | scripts/powershell/In.ps1 |

---

SharePoint Online Security Check

Comprehensi Online security assessment tool to identify o and external access risks. Audits tenant-level and site-le configurations to detect potential data exposure.

📖 Full documentation: EntraSharePointCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraSharePointCheck-PS1.md | scripts/powershell/Ink.ps1 |

---

SharePoint Online Enumeration

Authenticated SharePoint Online search and file download tool using the SharePoint REST API. Enables red-team operators to discover and exfiltrate sensiti during authorized penetration tests. PowerShell port of ElephantPoint (Nettitude).

📖 Full documentation: SharePointEnum-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | SharePointEnum-PS1.md | scripts/powershell/In.ps1 |

---

Teams Security Check

Comprehensi Teams security assessment tool to audit collaboration security settings. Identifies external access risks, guest policies, meeting security gaps, and app permission issues.

📖 Full documentation: EntraTeamsCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraTeamsCheck-PS1.md | scripts/powershell/In.ps1 |

---

Azure Cross-Service Attack Path Analysis

Comprehensi Azure attack path analysis tool that identifies multi-hop attack paths spanning multiple Azure services. Reveals how access to one resource can lead to compromise of other resources across the Azure en.

📖 Full documentation: EntraAzureAttackPathCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraAzureAttackPathCheck-PS1.md | scripts/powershell/InhCheck.ps1 |

---

Consolidated Security Report Generator

Unified HTML security report generator that runs multiple E security checks and produces a comprehensi dashboard with risk assessment, remediation priorities, and trend analysis.

📖 Full documentation: EntraReport-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraReport-PS1.md | scripts/powershell/In.ps1 |

---

Compliance Assessment (CIS/NIST/SOC2/ISO27001/GDPR)

Comprehensi assessment tool that e Azure Entra ID security configuration against industry-standard frameworks including CIS Microsoft Azure Foundations Benchmark, NIST 800-53, SOC 2, ISO 27001, and GDPR.

📖 Full documentation: EntraComplianceCheck-PS1.md

Key Features:

| | Documentation | File |
|---------|---------------|------|
| PowerShell | EntraComplianceCheck-PS1.md | scripts/powershell/Ink.ps1 |

---

Documentation

| Document | Description |
|----------|-------------|
| EntraRecon-PS1.md | Full PowerShell script documentation including all parameters, features, and usage examples |
| EntraRecon-PY.md | Full Python script documentation including authentication methods, stealth configuration, and examples |
| EntraMFACheck-PS1.md | MFA Security Check documentation including shared mailbox detection, sign-in tracking, and risk assessment |
| EntraGuestCheck-PS1.md | Guest Account Enumeration documentation including guest domain extraction, invite tracking, and security analysis |
| EntraAppAccess-PS1.md | PowerShell & Graph CLI Access Check documentation including app access tracking, assignment dates, and pri access analysis |
| EntraRoleCheck-PS1.md | Pri Role Check documentation including role enumeration, PIM assignment tracking, risk assessment, and security analysis |
| EntraSer.md | Service Principal Security Check documentation including credential enumeration, expiration tracking, permission analysis, owner security, and risk assessment |
| EntraConditionalAccessCheck-PS1.md | Conditional Access Policy Security Check documentation including policy enumeration, exclusion detection, MFA enforcement gaps, critical app co, and risk assessment |
| EntraStaleAccountCheck-PS1.md | Stale Account Check documentation including stale account detection, ne detection, license waste detection, password expiration tracking, and account hygiene analysis |
| EntraDe.md | Device Trust and Compliance Check documentation including device enumeration, compliance status detection, BYOD detection, stale sign-in tracking, Intune compliance policies, and risk assessment |
| EntraSSPRCheck-PS1.md | Self-Service Password Reset Check documentation including SSPR status detection, registration method analysis, backup method detection, strong method classification, MFA correlation, and risk assessment |
| EntraPasswordPolicyCheck-PS1.md | Password Policy Security Check documentation including password expiration analysis, ne detection, complexity requirements checking, weak policy identification, password age tracking, and risk assessment |
| EntraLegacyAuthCheck-PS1.md | Legacy Authentication Check documentation including legacy protocol detection, sign-in log analysis, last usage tracking, protocol statistics, MFA correlation, and risk assessment |
| EntraLicenseCheck-PS1.md | License and SKU Analysis documentation including tenant SKU enumeration, user license assignment tracking, pri license detection, unused license identification, and risk assessment |
| EntraAdminUnitCheck-PS1.md | Administrative Unit Security Check documentation including AU enumeration, scoped role assignment analysis, member enumeration, MFA status detection, risk assessment, and scoped admin access analysis |
| EntraDirectorySyncCheck-PS1.md | Directory Sync Status Check documentation including sync status analysis, sync error detection, stale sync detection, sync conflict identification, sync scope analysis, and risk assessment |
| EntraPowerPlatformCheck-PS1.md | Power Platform Enumeration documentation including Power Apps enumeration, Power Automate flow enumeration, sensiti detection, high-risk action identification, connector analysis, and risk assessment |
| EntraGroupCheck-PS1.md | Group Security Analysis documentation including group enumeration, owner analysis with MFA status, no owner detection, excessi detection, role-assignable group detection, and risk assessment |
| EntraApplicationCheck-PS1.md | Application Registration Security Check documentation including application enumeration, credential analysis, expiration tracking, API permission analysis, owner security assessment, and risk assessment |
| EntraAttackPathCheck-PS1.md | Attack Path Analysis documentation including pri escalation paths, password reset delegations, transiti memberships, shared mailbox access, risk assessment, and path complexity analysis |
| EntraAzureRBACCheck-PS1.md | Azure RBAC Role Assignment Audit & Drift Detection documentation including baseline export, drift detection, multi-subscription support, multi-tenant support, skip failed tenants, group member expansion, all users permissions matrix, PIM/JIT exclusion, ABAC condition mismatch detection, remediation instructions (Terraform/CLI/PowerShell), role assignment tracking, unauthorized change detection, and risk assessment |
| EntraOAuthConsentCheck-PS1.md | OAuth Consent Grant Audit documentation including OAuth2PermissionGrant enumeration, admin vs user consent detection, dangerous permission identification, stale consent detection, third-party app analysis, sign-in activity correlation, and risk assessment for illicit consent grant detection |
| EntraSignInRiskCheck-PS1.md | Identity Protection Analysis documentation including risky user enumeration, risk le tracking, risk detection analysis, impossible tra, anonymous IP detection, password spray detection, leaked credentials detection, pattern analysis, timing analysis, and remediation guidance |
| EntraPIMCheck-PS1.md | Pri Identity Management (PIM) Configuration Audit documentation including JIT access configuration gaps, appro analysis, MFA enforcement, justification requirements, notification configuration, permanent assignment detection, PIM for Groups, Access Reviews, and risk assessment |
| EntraKey.md | Azure Key Vault Security Audit documentation including access model analysis (RBAC policies), soft delete and purge protection status, network security audit (public access, firewall, VNet), private endpoint detection, overly permissi detection, diagnostic logging , secret/certificate/key expiration tracking, and risk assessment |
| EntraStorageAccountCheck-PS1.md | Azure Storage Account Security Audit documentation including public blob container detection, HTTPS enforcement , shared key access analysis, network security audit (public access, firewall, VNet, private endpoints), data protection analysis (soft delete, ), key rotation tracking, cross-tenant replication detection, TLS , infrastructure encryption check, diagnostic logging , and risk assessment |
| EntraNetworkSecurityCheck-PS1.md | Azure Network Security Audit documentation including NSG rules analysis, overly permissive rule detection (0.0.0.0/0, Any-Any), open management port detection (RDP, SSH, WinRM), Azure Bastion usage analysis, DDoS protection status, VNet peering security, subnet NSG co, NSG flow logs configuration, gateway analysis, traffic analytics status, and risk assessment |
| EntraManagedIdentityCheck-PS1.md | Azure Managed Identity Security Audit documentation including system-assigned identity in, role assignment analysis, high-pri identity detection (Owner, Contributor, UAA), critical role detection, cross-subscription access detection, unused identity identification, resource co (VMs, App Services, Function Apps), scope analysis, and risk assessment |
| EntraExchangeCheck-PS1.md | Exchange Online Security Audit documentation including inbox rule analysis, external forwarding detection, transport rules audit, mailbox delegation analysis, audit logging status, OWA policy analysis, client access rules, BEC indicator detection, suspicious rule detection, and risk assessment |
| EntraSharePointCheck-PS1.md | SharePoint Online Security Audit documentation including tenant sharing settings, anonymous link detection, site-le detection, guest access analysis, OneDri configuration, sensitivity label co, default link analysis, link expiration policies, and risk assessment |
| EntraTeamsCheck-PS1.md | Microsoft Teams Security Audit documentation including external access (federation) settings, guest access policies, meeting policy analysis (anonymous join, lobby bypass), app permission policies, messaging policies, Teams in analysis, and risk assessment |
| EntraAzureAttackPathCheck-PS1.md | Azure Cross-Service Attack Path Analysis documentation including VM to Key Vault paths, managed identity pri escalation, storage lateral mo, custom role , cross-subscription paths, management group inheritance, attack narratives, and risk assessment |
| EntraReport-PS1.md | Consolidated Security Report Generator documentation including multi-check execution, HTML executi, security score calculation, remediation priority matrix, trend analysis with baseline comparison, quick scan and comprehensive scan modes, and JSON baseline export |
| EntraComplianceCheck-PS1.md | Compliance Assessment documentation including CIS Azure Benchmark mapping, NIST 800-53 control mapping, SOC 2 Trust Service Criteria, ISO 27001 controls, GDPR indicators, compliance scoring, control family filtering, and executi |
| SharePointEnum-PS1.md | SharePoint Online Enumeration documentation including REST API search, FQL queries, refinement filters, file download (disk and Base64), auto-detection, smart auth fallback (session token , Azure CLI fallback, MSAL device code flow), stealth mode, and export options |

---

Feature Comparison

Enumerate-EntraUsers

Both provide the same core functionality:

| Feature | PowerShell | Python |
|---------|------------|--------|
| User Enumeration (15+ methods) | ✅ | ✅ |
| Security Assessment | ✅ | ✅ |
| Credential Attack Surface | ✅ | ✅ |
| Conditional Access Analysis | ✅ | ✅ |
| Device/Intune Enumeration | ✅ | ✅ |
| Attack Path Analysis | ✅ | ✅ |
| Power Platform Enumeration | ✅ | ✅ |
| Lateral Mo Analysis | ✅ | ✅ |
| BloodHound Export | ✅ | ✅ |
| HTML Report Generation | ✅ | ✅ |
| Stealth Mode | ✅ | ✅ |
| Interactive Menu | ✅ | ✅ |
| Azure CLI Token | ✅ | ✅ |
| Device Code Flow | ✅ | ✅ |
| Refresh Token Exchange | ❌ | ✅ |
| Extended App ID Database | ❌ | ✅ |
| Stealth Presets | ❌ | ✅ |

Toolkit Comparison

| Feature | Enumerate-EntraUsers | MFA Security Check | Guest Account Enumeration | Critical Admin Access Check | Pri Role Check | Service Principal Check | Application Registration Check | Conditional Access Check | Administrative Unit Check | Stale Account Check | Device Trust Check | SSPR Check | Password Policy Check | Legacy Auth Check | License Check | Directory Sync Check | Power Platform Check | Group Security Check | Attack Path Analysis | Azure RBAC Check | OAuth Consent Check |
|---------|---------------------|-------------------|---------------------------|----------------------------|----------------------|------------------------|--------------------------|--------------------------|------------------------|---------------------|-------------------|-------------|---------------------|-------------------|--------------|---------------------|-------------------|-------------------|-------------------|-------------------|-------------------|
| Purpose | Comprehensive user enumeration | Focused MFA security audit | Guest access go | Critical administrati audit | Pri role assignment audit | Service account security audit | Application registration security audit | Security policy gap analysis | Scoped admin access audit | Account hygiene audit | Device trust and compliance audit | SSPR configuration audit | Password policy security audit | Legacy authentication security audit | License and SKU analysis | Directory sync status and health audit | Power Platform enumeration and security audit | Group security analysis and go | Attack path analysis - pri escalation and lateral mo | Multi-tenant Azure RBAC baseline export and drift detection | OAuth consent grant audit - illicit consent detection |
| User Enumeration | 15+ methods | Standard method | Guest-focused | App assignment-based | Role assignment-based | Service principal-focused | | | | | | Legacy auth-focused | Sync-focused | ❌ |
| MFA Detection | Basic check | Ad with method types | Ad with method types | Ad with method types | Ad with method types | Owner MFA check | | | | | | Ad with method types | ❌ | ❌ |
| Shared Mailbox Detection | ❌ | ✅ Automatic | ❌ (N/A for guests) | ❌ (N/A for app access) | ❌ (N/A for roles) | ❌ (N/A for SPs) | | | | | | ❌ (N/A for legacy auth) | ❌ | ❌ |
| Guest Domain Extraction | ❌ | ❌ | ✅ Automatic | ❌ | ❌ | ❌ | | | | | | ❌ | ❌ | ❌ |
| Invite Status Tracking | ❌ | ❌ | ✅ With acceptance dates | ❌ | ❌ | ❌ | | | | | | ❌ | ❌ | ❌ |
| App Access Tracking | ❌ | ❌ | ❌ | ✅ Multi-app co | ❌ | ❌ | | | | | | ❌ | ❌ | ❌ |
| Role Assignment Tracking | ❌ | ❌ | ❌ | ❌ | ✅ All directory roles | ❌ | | | | | | ❌ | ❌ | ✅ All Azure RBAC roles |
| PIM Assignment Tracking | ❌ | ❌ | ❌ | ❌ | ✅ Eligible & Active | ❌ | | | | | | ❌ | ❌ | ❌ |
| Credential Enumeration | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Secrets & certificates | ✅ Secrets & certificates | | | | | | ❌ | ❌ | ❌ |
| Credential Expiration Tracking | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Expired & expiring soon | ✅ Expired & expiring soon | | | | | | ❌ | ❌ | ❌ |
| Permission Analysis | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ High-risk & critical | ✅ High-risk & critical (API permissions) | | | | | | ❌ | ❌ | ✅ RBAC role permissions |
| Owner Analysis | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ With MFA status | ✅ With MFA status | ❌ | | | | | ❌ | ❌ | ✅ Group owners with MFA status | ❌ |
| Application Registration Enumeration | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Comprehensive | | | | | | ❌ | ❌ | ❌ |
| API Permission Analysis | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Delegated & application | | | | | | ❌ | ❌ | ❌ |
| Assignment Date Tracking | ❌ | ❌ | ✅ Invite dates | ✅ Assignment dates | ✅ Assignment dates & duration | ❌ | ❌ | | | | | ❌ | ❌ | ✅ Role assignment creation dates |
| Policy Exclusion Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Users, groups, roles, apps | | | | | ❌ | ❌ | ❌ |
| MFA Enforcement Gaps | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Policy-le | | | | | ❌ | ❌ | ❌ |
| Critical App Co | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ 10 critical apps | | | | | ❌ | ❌ | ❌ |
| Legacy Auth Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Policy targeting | | | | | ✅ 10 protocols | ❌ | ❌ |
| Legacy Protocol Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | | | | ✅ IMAP/POP3/SMTP/EAS/etc | ❌ | ❌ |
| Last Legacy Auth Usage | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | | | | ✅ Date/time tracking | ❌ | ❌ |
| Protocol Statistics | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | | | | ✅ Success/failure counts | ❌ | ❌ |
| Policy Conflict Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Redundant/conflicting | ❌ | ❌ | ❌ | | | ❌ | ❌ | ❌ |
| Administrative Unit Enumeration | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Comprehensive | ❌ | ❌ | ❌ | | | ❌ | ❌ | ❌ |
| Scoped Role Assignment Analysis | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ All scoped assignments | ❌ | ❌ | ❌ | | | ❌ | ❌ | ❌ |
| AU Member Enumeration | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Members and roles | ❌ | ❌ | ❌ | | | ❌ | ❌ | ❌ |
| Stale Account Detection | Limited | Limited | Limited | Limited | Limited | ❌ | ❌ | Limited | ✅ >90 days inactive | ❌ | | | Limited | ❌ | ❌ |
| Ne Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Account age analysis | ❌ | | | ❌ | ❌ | ❌ |
| License Waste Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Disabled with licenses | ❌ | | | ❌ | ❌ | ❌ |
| Password Expiration Tracking | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Expired passwords | ❌ | ❌ | ✅ Expiration analysis | ❌ | ❌ | ❌ |
| SSPR Status Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Enabled/Registered/Capable | ❌ | ❌ | ❌ | ❌ |
| SSPR Method Analysis | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Registration methods | ❌ | ❌ | ❌ | ❌ |
| Backup Method Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ No backup methods | ❌ | ❌ | ❌ | ❌ |
| Strong Method Classification | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Strong vs weak methods | ❌ | ❌ | ❌ | ❌ |
| Device Enumeration | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Comprehensive | ❌ | ❌ | ❌ | ❌ | ❌ |
| Compliance Status Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | ✅ Compliant/Non-compliant/Unknown | | | ❌ | ❌ | ❌ |
| BYOD Detection | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | ✅ Automatic | | | ❌ | ❌ | ❌ |
| Stale Sign-In Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | ✅ >90 days | ✅ >90 days | | | Limited | ❌ | ❌ |
| Intune Compliance Policies | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Full enumeration | | | ❌ | ❌ | ❌ |
| Device Trust Analysis | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Join types | | | ❌ | ❌ | ❌ |
| Management Status | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Managed/Unmanaged | | | ❌ | ❌ | ❌ |
| Last Sign-In Tracking | ✅ | ✅ With analytics | ✅ With analytics | ✅ With analytics | ✅ With analytics | Limited (SP activity) | ❌ | ✅ With analytics | ✅ With analytics | ✅ With analytics | ✅ With analytics | ✅ With analytics | ✅ With analytics | ✅ With analytics | ✅ With analytics | ❌ |
| Sign-In Capability Check | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Sync Status Detection | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Synced | ❌ |
| Sync Error Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ All pro errors | ❌ |
| Stale Sync Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ >7 days since sync | ❌ |
| Sync Conflict Identification | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Duplicate attributes | ❌ |
| Sync Scope Analysis | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Basic configuration | ❌ |
| Tenant SKU Enumeration | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Full enumeration | ❌ | ❌ |
| License Assignment Tracking | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ All assignments | ❌ | ❌ |
| Pri License Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ E5, P2, etc. | ❌ | ❌ |
| Unused License Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Disabled with licenses | ❌ | ❌ | ❌ | ❌ | ✅ Ne in | ❌ | ❌ |
| License Usage Analytics | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Consumption stats | ❌ | ❌ | ❌ |
| Power Apps Enumeration | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Comprehensive | ❌ |
| Power Automate Flow Enumeration | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Comprehensive | ❌ |
| Sensiti Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ 30+ connectors | ❌ |
| High-Risk Action Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Delete/Create/Modify | ❌ |
| Connector Risk Analysis | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ CRITICAL/HIGH/MEDIUM/LOW | ❌ | ❌ |
| Group Enumeration | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Comprehensive (all types) | ❌ |
| No Owner Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Orphaned groups | ❌ |
| Excessi Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ >100 or >500 members | ❌ |
| Role-Assignable Group Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ CRITICAL risk groups | ❌ |
| Group Type Analysis | ✅ Basic | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Security/M365/Distribution/Dynamic | ❌ |
| OAuth Consent Grant Enumeration | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ All OAuth2PermissionGrants |
| Admin vs User Consent Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Tenant-wide |
| Dangerous Permission Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Mail/Files/Directory access |
| Stale Consent Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Configurable threshold |
| Third-Party App Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Microsoft |
| Publisher | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ publisher status |
| Multi-Tenant Scanning | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ All accessible tenants | ❌ |
| Skip Failed Tenants | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Continue on MFA/CA failures | ❌ |
| Azure RBAC Baseline Export | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ JSON baseline | ❌ |
| Azure RBAC Drift Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ New/Remo assignments | ❌ |
| Multi-Subscription Support | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ All subscriptions across tenants | ❌ |
| Group Member Expansion | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Expand groups to show users | ❌ |
| All Users Permissions Matrix | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ User-centric permission view | ❌ |
| Scope Hierarchy Analysis | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Sub/RG/Resource | ❌ |
| PIM/JIT Exclusion | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Exclude time-bounded assignments | ❌ |
| ABAC Condition Detection | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Condition mismatch drift | ❌ |
| Remediation Instructions | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Terraform/CLI/PowerShell | ❌ |
| Risk Le | Basic | Ad (HIGH/MEDIUM/LOW) | Ad (HIGH/MEDIUM/LOW) | Ad (HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM/LOW) | Ad (CRITICAL/HIGH/MEDIUM) | Ad (CRITICAL/HIGH/MEDIUM/LOW) |
| Activity Analytics | Limited | Detailed (stale/recent/never) | Detailed (stale/recent/never) | Detailed (stale/recent/never) | Detailed (stale/recent/never) | Basic (age-based) | Detailed (credential expiration/permission analysis) | Policy gap analysis | Detailed (scoped admin activity) | Detailed (stale indicators) | Detailed (stale/recent/never) | Detailed (stale/recent/never) | Detailed (password age/policy gaps) | Detailed (usage recency/protocol stats) | Detailed (license usage/unused tracking) | Detailed (sync health/error stats) | Detailed (resource/en/owner stats) | Detailed (group type/owner/membership stats) | Detailed (attack path type/complexity/risk stats) | Detailed (drift type/role/tenant/subscription stats) | Detailed (consent type/permission/stale stats) |
| Matrix View | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Department Analysis | ✅ | ✅ With statistics | ✅ With statistics | ✅ With statistics | ✅ With statistics | ❌ | ❌ | ✅ With statistics | ✅ With statistics | ❌ | ✅ With statistics | ✅ With statistics | ✅ With statistics | ✅ With statistics | ✅ With statistics | ❌ | ❌ | ❌ | ❌ | ❌ |
| BloodHound Export | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| HTML Report | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| CSV/JSON Export | ✅ | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ Enhanced fields | ✅ JSON baseline/drift report | ✅ Enhanced fields |
| Stealth Mode | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Best For | Red team reconnaissance | MFA compliance audits | External user security | Pri access audit | Pri role go | Service account security | Application registration security & credential management | Security policy gap analysis | Scoped admin access go | Account hygiene & cleanup | Device trust and compliance | Password reset security | Password policy compliance | Legacy auth migration & security | License go & cost optimization | Directory sync health & error tracking | Power Platform security & connector go | Group security & go | Attack path analysis & pri escalation detection | Multi-tenant Azure RBAC go & unauthorized access detection | OAuth consent security & illicit consent grant detection |

---

Installation

Python Dependencies

Or install manually:

PowerShell Dependencies

Enumerate-EntraUsers: The script will automatically install the required Microsoft.Graph.Users module on first run.

MFA Security Check, Guest Account Enumeration, Critical Admin Access Check, Pri Role Check, Service Principal Check, Application Registration Check, Conditional Access Check, Administrative Unit Check, Stale Account Check, Device Trust Check, SSPR Check, Password Policy Check, Legacy Auth Check, License Check, Directory Sync Check, Power Platform Check, and Group Security Check: Require Microsoft Graph PowerShell SDK:

Azure RBAC Check: Requires Azure PowerShell modules:

Or install indi modules:

Other tools:

Or install indi modules:

---

Authentication

Both scripts support multiple authentication methods:

The Python additionally supports:

---

Script Authentication & Permissions Reference

This section provides a comprehensi of authentication methods and API permissions required by each script in the toolkit.

Authentication Methods by Script Category

All scripts support the same core authentication methods, with slight based on the target API:

#### Microsoft Graph Scripts (Entra ID)

| Parameter | Method | Description |
|-----------|--------|-------------|
| *(default)* | Interactive | Connect-MgGraph with interacti browser prompt |
| -UseAzCliToken | Azure CLI Token | Uses az account get-access-token --resource |
| -UseAzPowerShellToken | Azure PowerShell Token | Uses Get-AzAccessToken -ResourceUrl " |

Scripts: EntraRecon, EntraMFACheck, EntraGuestCheck, EntraAppAccess, EntraRoleCheck, EntraSer, EntraConditionalAccessCheck, EntraAdminUnitCheck, EntraStaleAccountCheck, EntraDe, EntraSSPRCheck, EntraPasswordPolicyCheck, EntraLegacyAuthCheck, EntraLicenseCheck, EntraDirectorySyncCheck, EntraPowerPlatformCheck, EntraGroupCheck, EntraApplicationCheck, EntraAttackPathCheck, EntraOAuthConsentCheck, EntraSignInRiskCheck, EntraPIMCheck, EntraComplianceCheck

#### Azure Resource Scripts (ARM)

| Parameter | Method | Description |
|-----------|--------|-------------|
| *(default)* | Interactive | Connect-AzAccount with interacti prompt |
| -UseAzCliToken | Azure CLI Token | Uses existing az login session |
| -UseAzPowerShellToken | Azure PowerShell Token | Uses existing Connect-AzAccount session |
| -UseDe | Device Code Flow | Connect-AzAccount -UseDe for headless terminals |

Scripts: EntraAzureRBACCheck, EntraKey, EntraStorageAccountCheck, EntraManagedIdentityCheck, EntraNetworkSecurityCheck, EntraAzureAttackPathCheck

#### Microsoft 365 Service Scripts

| Script | Module | Authentication |
|--------|--------|----------------|
| EntraExchangeCheck | ExchangeOnlineManagement | Connect-ExchangeOnline (requires Exchange Administrator role) |
| EntraSharePointCheck | Microsoft.Online.SharePoint.PowerShell | Connect-SPOService to SharePoint Admin URL (requires SharePoint Administrator role) |
| SharePointEnum | Az.Accounts (optional) | Smart fallback: Azure session token → Azure CLI → MSAL device code flow (Microsoft Office client ID) |
| EntraTeamsCheck | MicrosoftTeams | Connect-MicrosoftTeams (requires Teams Administrator role) |

---

Microsoft Graph Permission Scopes by Script

The following table shows the required and fallback scopes for each Microsoft Graph-based script. Fallback scopes are used when the user doesn't ha for the full required scope set.

| Script | Required Scopes | Fallback Scopes |
|--------|-----------------|-----------------|
| Inck | Application.Read.All, Directory.Read.All, User.Read.All, UserAuthenticationMethod.Read.All, AuditLog.Read.All | Application.Read.All, Directory.Read.All, User.ReadBasic.All |
| In | Directory.Read.All, RoleManagement.Read.Directory, User.Read.All, UserAuthenticationMethod.Read.All, AuditLog.Read.All | Directory.Read.All, RoleManagement.Read.Directory, User.ReadBasic.All |
| In | User.Read.All, UserAuthenticationMethod.Read.All, AuditLog.Read.All | User.ReadBasic.All, UserAuthenticationMethod.Read.All |
| In | Directory.Read.All, Group.Read.All, User.Read.All, UserAuthenticationMethod.Read.All, AuditLog.Read.All | Directory.Read.All, Group.Read.All, User.ReadBasic.All |
| In | User.Read.All, UserAuthenticationMethod.Read.All, AuditLog.Read.All | User.ReadBasic.All, UserAuthenticationMethod.Read.All |
| In | Directory.Read.All, Administrati.Read.All, RoleManagement.Read.Directory, User.Read.All, UserAuthenticationMethod.Read.All | Directory.Read.All, Administrati.Read.All, User.ReadBasic.All |
| InessCheck | Policy.Read.All, Directory.Read.All, Application.Read.All, User.Read.All | Policy.Read.All, Directory.Read.All |
| In | Device.Read.All, Directory.Read.All, Deices.Read.All, Deion.Read.All | Device.Read.All, Directory.Read.All |
| Inheck | Directory.Read.All, User.Read.All, AuditLog.Read.All | Directory.Read.All, User.ReadBasic.All |
| Ink | Directory.Read.All, Group.Read.All, User.Read.All, UserAuthenticationMethod.Read.All, RoleManagement.Read.Directory, AuditLog.Read.All | Directory.Read.All, Group.Read.All, User.ReadBasic.All |
| InalCheck | Application.Read.All, Directory.Read.All, User.Read.All, UserAuthenticationMethod.Read.All, AuditLog.Read.All | Application.Read.All, Directory.Read.All, User.ReadBasic.All |
| InCheck | User.Read.All, Directory.Read.All, AuditLog.Read.All | User.ReadBasic.All, Directory.Read.All |
| In | Directory.Read.All, User.Read.All | User.ReadBasic.All |
| Ink | AuditLog.Read.All, Directory.Read.All, User.Read.All, UserAuthenticationMethod.Read.All | Directory.Read.All, User.ReadBasic.All |
| In | User.Read.All, UserAuthenticationMethod.Read.All, Reports.Read.All, AuditLog.Read.All | User.ReadBasic.All, Reports.Read.All |
| Ineck | User.Read.All, Directory.Read.All, AuditLog.Read.All | User.ReadBasic.All, Directory.Read.All |
| In | Application.Read.All, Directory.Read.All, User.Read.All, UserAuthenticationMethod.Read.All, AuditLog.Read.All | Application.Read.All, Directory.Read.All, User.ReadBasic.All |
| In | Directory.Read.All, User.Read.All, RoleManagement.Read.Directory, Pri.Read.AzureAD | Directory.Read.All, User.ReadBasic.All |
| Ineck | Application.Read.All, Directory.Read.All, User.Read.All, AuditLog.Read.All | Application.Read.All, Directory.Read.All, User.ReadBasic.All |
| Ink | IdentityRiskyUser.Read.All, IdentityRiskySignIn.Read.All, IdentityRiskDetection.Read.All, AuditLog.Read.All, User.Read.All, Directory.Read.All | IdentityRiskyUser.Read.All, IdentityRiskySignIn.Read.All, IdentityRiskDetection.Read.All |
| Inheck | User.Read.All, Directory.Read.All, Application.Read.All | *(Power Platform API permissions via user context)* |
| Ink | Directory.Read.All, Policy.Read.All, User.Read.All, Application.Read.All, AuditLog.Read.All, RoleManagement.Read.Directory, IdentityRiskyUser.Read.All, IdentityRiskEvent.Read.All, UserAuthenticationMethod.Read.All | Directory.Read.All, Policy.Read.All, User.ReadBasic.All |

---

Azure Resource Scripts - Required Permissions

These scripts use Azure PowerShell (Az module) and require Azure RBAC permissions rather than Microsoft Graph scopes:

| Script | Azure RBAC Permissions | Additional Graph Scopes |
|--------|------------------------|------------------------|
| In | Reader role across target subscriptions | User.Read, Directory.Read.All, GroupMember.Read.All |
| In | Reader on subscriptions, Key Vault Reader for secret enumeration | - |
| InCheck | Reader on subscriptions, Storage Blob Data Reader for container enumeration | - |
| InyCheck | Reader on subscriptions | Directory.Read.All for Graph queries |
| InyCheck | Reader on subscriptions for NSG/VNet enumeration | - |
| InhCheck | Reader on subscriptions, Key Vault Reader for access policy enumeration | - |

---

Microsoft 365 Service Scripts - Required Permissions

| Script | Module | Required Roles/Permissions |
|--------|--------|---------------------------|
| In | ExchangeOnlineManagement | Exchange Administrator or equi. Required for: Get-InboxRule, Get-TransportRule, Get-MailboxPermission, Get-Mailbox |
| Ink | Microsoft.Online.SharePoint.PowerShell | SharePoint Administrator or equi. Required for: Get-SPOTenant, Get-SPOSite, sharing configuration cmdlets |
| In | Az.Accounts (optional) | Any user with SharePoint access. Uses SharePoint REST Search API with delegated permissions session, Azure CLI, or MSAL device code flow |
| In | MicrosoftTeams | Teams Administrator or equi. Required for: Get-CsTenantFederationConfiguration, Get-CsTeamsMeetingPolicy, Get-CsTeamsClientConfiguration, Get-Team |

---

Most Commonly Required Scopes

The following Microsoft Graph scopes are most frequently required across the toolkit:

| Scope | Scripts Using | Purpose |
|-------|---------------|---------|
| Directory.Read.All | 21+ scripts | Read directory objects (users, groups, roles, settings) |
| User.Read.All | 19+ scripts | Read all user properties including sign-in activity |
| AuditLog.Read.All | 16+ scripts | Read sign-in logs, audit logs, activity reports |
| UserAuthenticationMethod.Read.All | 13+ scripts | Check MFA registration and authentication methods |
| Application.Read.All | 7 scripts | Read app registrations and service principals |
| Group.Read.All | 4 scripts | Read group memberships and properties |
| RoleManagement.Read.Directory | 5 scripts | Read directory role assignments and PIM configuration |
| Policy.Read.All | 3 scripts | Read Conditional Access policies and security defaults |
| Device.Read.All | 1 script | Read device registrations |
| Administrati.Read.All | 1 script | Read Administrati |
| Pri.Read.AzureAD | 1 script | Read PIM role settings and assignments |
| IdentityRiskyUser.Read.All | 2 scripts | Read Identity Protection risky users |
| IdentityRiskySignIn.Read.All | 1 script | Read Identity Protection risky sign-ins |
| IdentityRiskEvent.Read.All | 2 scripts | Read Identity Protection risk events and detections |
| Reports.Read.All | 1 script | Read usage reports (SSPR) |
| Deices.Read.All | 1 script | Read Intune managed devices |
| Deion.Read.All | 1 script | Read Intune compliance policies |

---

Minimum Permission Set for Full Toolkit

To run all scripts with full functionality, the following consolidated permission set is recommended:

Microsoft Graph (Delegated Permissions):

Azure RBAC:

Microsoft 365 Admin Roles:

---

Legal Disclaimer

This toolkit is intended for authorized security testing and research purposes only. Users are responsible for ensuring they ha authorization before using these tools against any systems. The authors assume no liability for misuse of this software.

---

License

GNU General Public License v3.0 - See LICENSE file for details.

Copyright (C) 2025 Logisek

---

Contributing

Contributions are welcome! Please feel free to submit pull requests or open issues for bugs and feature requests.

---

Acknowledgments

---

项目信息

开发语言：PowerShell

Star 数：168

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕EvilMist is a collection of scripts and utilities designed to support cloud penetration testing & red teaming. The toolkit helps identify misconfigurations, assess privilege-escalation paths, and simulate attack techniques. EvilMist aims to streamline cloud-focused red-team workflows and improve the overall security posture of cloud infrastructures展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。