Advanced Azure attacks — cross-tenant, hybrid AD, PIM abuse.
Official PageComprehensive Azure AD attack toolkit
Install-Module AADInternalsInvoke-AADIntPhishing; ConvertTo-AADIntBackdoor; Get-AADIntSAMLTokenBloodHound data collector
go install github.com/BloodHoundAD/AzureHound@latestazurehound list -t tenantidMicrosoft Graph API automation
git clone https://github.com/dafthack/GraphRunnerInvoke-GraphRunner; Get-AzureADUsersAzure/M365 security auditing
pip3 install monkey365monkey365 --provider azure --subscriptions allAzure AD token and graph exploration
pip3 install roadreconroadrecon gather; roadrecon plugin policiesAzure token theft and manipulation
git clone https://github.com/rvrsh3ll/TokenTacticsInvoke-RefreshToEXOToken; Get-AzureToken