skills.rest
bpnrockstar
bpnrockstarCOMMUNITY
Explore all skills by this author →
GitHub

m365-entra-attack

Automate Microsoft 365 and Entra ID red-team attack chains.

Updated Jul 1, 2026
Search Tags:#red-team#credential attack#user enumeration#password spray#Microsoft 365
One-click install
npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill m365-entra-attack-bpnrockstar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: m365-entra-attack
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/m365-entra-attack
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill m365-entra-attack-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires msftrecon, o365spray, playwright, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates a red-team attack chain for Microsoft 365 / Entra ID, enabling efficient credential attacks, password spraying, user enumeration, CA-bypass exploration, and active-attacker detection.

Core Features & Use Cases

  • Credential Attacks: Automates the process of credential testing and validation against M365/Entra ID using ROPC and SAML SSO.
  • Password Spraying: Identifies users and their password change policies, enabling targeted password spraying.
  • User Enumeration: Enumerates users through different vectors, including SharePoint and OneDrive, with hardening status checks.
  • CA Bypass Exploration: Explores various Conditional Access bypass options to assess the security posture of the tenant.
  • Active-Attacker Detection: Identifies signs of active attacker presence by detecting Smart Lockout responses.

Quick Start

Use the m365-entra-attack skill to perform a password spray on the target tenant 'client.example'.

Frequently Asked Questions about m365-entra-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate user enumeration against Microsoft 365?▼

Password spraying for Microsoft 365 is executed by identifying users and their password change policies, then applying targeted password spray attempts. This method tests common passwords against multiple accounts to avoid lockouts.

Can I explore Conditional Access bypass options in Entra ID?▼

You can explore Conditional Access bypass options in Entra ID to assess the security posture of the tenant. This exploration identifies misconfigurations or gaps in access controls that allow unauthorized authentication.

Does this attack chain use ROPC and SAML SO for credential validation?▼

The attack chain uses ROPC and SAML SSO for credential testing and validation against M365 and Entra ID. These protocols automate the process of verifying compromised credentials programmatically.

Do I need msftrecon and o365spray to run M365 red-team operations?▼

You need msftrecon, o365spray, and playwright libraries installed to execute these M365 red-team operations. These dependencies provide the necessary reconnaissance and automation frameworks for the attack chain.

What is active-attacker detection via Smart Lockout responses?▼

Active-attacker detection via Smart Lockout responses identifies signs of ongoing attacker presence in the tenant. It analyzes authentication lockout patterns to detect if another threat actor is actively spraying passwords.

Related Skills

cmndcntrlcybercmndcntrlcyber
3

m365-entra-attack

Execute Microsoft 365/Entra ID credential attacks and Conditional Access bypass.

Community
Advanced
cameronapakcameronapak
1

bknd-protect-endpoint

Enforce authentication and authorization checks on BKND API endpoints.

Community
Advanced
EntroVyxEntroVyx
3

m365-entra-attack

Validate Microsoft 365 and Entra ID credentials via ROPC and SAML flows.

Community
Advanced
Kisilev13Kisilev13

m365-entra-attack

Enumerate users and bypass conditional access in M365/Entra ID environments.

Community
Advanced