AADInternals

MITRE ATT&CK: S0677 View on attack.mitre.org

Aliases: AADInternals

First seen
2020-10-01 00:00:00
Malware type
exploit-kit
Operating systems
windows, office-suite, identity-provider
Profile updated
2026-07-07 15:33:26

Targeted industries: government-and-public-sector technology-and-telecommunications financial-services

Context

AADInternals is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.

Detection coverage

  • 342 Sigma rules

Malware & tools used

  • Cloud Service Discovery (attack-pattern)
  • Steal or Forge Authentication Certificates (attack-pattern)
  • Hybrid Identity (attack-pattern)
  • Device Registration (attack-pattern)
  • Spearphishing Link (attack-pattern)
  • Credentials In Files (attack-pattern)
  • Trust Modification (attack-pattern)
  • Spearphishing Link (attack-pattern)
  • Cloud Groups (attack-pattern)
  • Cloud Account (attack-pattern)
  • SAML Tokens (attack-pattern)
  • Domain Properties (attack-pattern)
  • Email Addresses (attack-pattern)
  • Silver Ticket (attack-pattern)
  • Private Keys (attack-pattern)
  • Steal Application Access Token (attack-pattern)
  • Cloud Account (attack-pattern)
  • LSA Secrets (attack-pattern)
  • Multi-Factor Authentication (attack-pattern)
  • Cloud Administration Command (attack-pattern)
  • Data from Cloud Storage (attack-pattern)
  • PowerShell (attack-pattern)
  • Modify Registry (attack-pattern)
  • Exfiltration Over Alternative Protocol (attack-pattern)

Used by threat actors

Reports & references

  • MITRE ATT&CK — S0677 (report)
  • github.com — Aadinternals (report)
  • o365blog.com — Aadinternals (report)

External references