AADInternalsTool
AADInternals is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.From MITRE ATT&CK
Last reported 4 months ago, by Huntress3 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1556.009Conditional Access Policies
“Multi-factor authentication (MFA) and complex conditional access policies are your friends.”
- T1078.004Cloud Accounts
“Initial Access, T1078.004, valid cloud accounts”
- T1098.005Device Registration
“… released in 2025 – although one important caveat is that blocking device code flow via Conditional Access can interfere with the Device Registration Service (DRS), so users should plan for that exception carefully.”
- T1110Brute Force
“Recon and brute-force token usage leave a tail of 403s and 404s as tools walk endpoints they don't have permission for, ask for object IDs they don't have, or use a client ID unauthorized for AAD Graph.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
We Need to Talk About Device Code Phishing“Nestori Syynimaa (an Azure AD/M365 expert and creator of the AADInternals toolkit) introduced a phishing technique abusing this very flow.”
-
Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap“ROADtools, AADInternals, and friends have been operating in a visibility gap for years.”
-
BEC Threat Hunting: How to Detect Microsoft 365 Compromises“Even the most prized Microsoft 365/Azure Offensive Security suite of tools, AADInternals, does not leave behind unique user agents and facilitates the minor effort to change the user agent.”
Indicators in its reports
named in the reports above- railway[.]comin 1 report
- 213.154.80[.]21in 1 report
- 203.251.62[.]51in 1 report
- 91.158.221[.]9in 1 report
- 118.98.90[.]2in 1 report
- azure.aadgraphactivitylogs[.]propertiesin 1 report
- ado[.]netin 1 report
- zure.aadgraphactivitylogs[.]propertiesin 1 report
- hxxps://graph.windows[.]net/$TID/$obj?api-version=1.6&in 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.