skills.rest
n4igme
n4igmeCOMMUNITY
Explore all skills by this author →
Website𝕏@nevrectlGitHub

m365-entra-attack

Identify valid M365/Entra credentials and test defense mechanisms against credential spraying.

Updated Jun 23, 2024
Search Tags:#red-team#saml#conditional-access#m365#entra#ropc#credential-spray
One-click install
npx skills add https://github.com/n4igme/randscript --skill m365-entra-attack-n4igme
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: m365-entra-attack
Source: https://github.com/n4igme/randscript/tree/main/llm/skills/claude-hunter/skills/m365-entra-attack
Command: npx skills add https://github.com/n4igme/randscript --skill m365-entra-attack-n4igme

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams need to simulate credential-based attacks against M365/Entra to assess defenses and identify misconfigurations in CA policies and lockout settings.

Core Features & Use Cases

  • AADSTS code mapping, user-enumeration vectors with hardening status, and Smart Lockout math to plan safe, repeatable tests.
  • ROPC and SAML SSO browser flow templates to validate credential usage, CA bypass options, and active-attacker-detection signals.
  • Burp/Playwright templates to reproduce attacker workflows and generate SOC-ready evidence for remediation.

Quick Start

Run a targeted Entra/M365 credential-attack scenario against a test tenant using the ROPC flow and SAML templates to collect CA-validated evidence.

Frequently Asked Questions about m365-entra-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test M365 conditional access policies during a red team engagement?▼

Testing M365 conditional access policies involves mapping CA configurations and validating credential usage against Entra tenants to identify bypass options and misconfigurations. This skill applies SAML SSO and ROPC flow templates to capture CA-validated evidence for defense testing.

Can I use ROPC flow to validate Entra credentials without triggering smart lockout?▼

Validating Entra credentials via ROPC requires calculating Smart Lockout math and mapping AADSTS codes to plan safe, repeatable tests. This skill applies user-enumeration vectors and hardening status checks to avoid triggering lockouts during credential spray simulations.

What is the best way to map AADSTS codes and user enumeration vectors in Entra ID?▼

Mapping AADSTS codes and user enumeration vectors in Entra ID identifies valid credentials and tenant discovery endpoints. This skill applies AADSTS code mapping across M365 tenants to determine user-enumeration vectors and hardening status for red-team engagements.

How do I capture SAML flow screenshots and converged CA pages for SOC reporting?▼

Capturing SAML flow screenshots and converged CA pages uses Burp and Playwright templates to reproduce attacker workflows. This skill applies these browser flow templates to generate SOC-ready evidence and structured reports for remediation.

Does this approach support tenant discovery and MFA prompt testing across multiple Office 365 tenants?▼

Tenant discovery and MFA prompt testing across Office 365 tenants is supported through end-to-end credential validation workflows. This skill applies AADSTS code mapping and CA policy mapping to assess MFA prompts and smart lockout behavior across Entra tenants.

Why do I need to simulate credential spraying against Entra ID rather than just reviewing configurations?▼

Simulating credential spraying against Entra ID reveals active-attacker-detection signals and CA bypass options that static configuration reviews miss. This skill applies ROPC and SAML SSO browser flow templates to test defense mechanisms and capture evidence for remediation.

Related Skills

Explore More Education & Research Skills→
cmndcntrlcybercmndcntrlcyber
3

m365-entra-attack

Execute Microsoft 365/Entra ID credential attacks and Conditional Access bypass.

Community
Advanced
elementalsoulselementalsouls
3.3k

m365-entra-attack

Test M365/Entra credentials and map CA policy outcomes via ROPC and SAML SSO flows.

Community
Advanced
bpnrockstarbpnrockstar

mid-engagement-ir-detection

Detect SOC patches, attacker activity, and security-state changes during red-team engagements.

Community
Advanced
uphiagouphiago
1.1k

m365-entra-attack

Validate credentials and enumerate users in Microsoft 365 and Entra ID environments.

Community
Advanced