ctrlINT What the industry said about every indicator, with the quote

ROADToolsTool

ROADTools is a framework for enumerating Azure Active Directory environments. The tool is written in Python and publicly available on GitHub.From MITRE ATT&CK

Last reported 1 month ago, by Elastic Security Labs2 reports

ATT&CK techniques

3 techniques · each with the sentence it comes from
  1. T1556.009Conditional Access Policies

    “No Conditional Access policies are broken.”

    Elastic Security LabsVendor
  2. T1098.005Device Registration

    “OAuth Phishing and the Device Registration Service”

    VolexityVendor
  3. T1684Social Engineering

    “Since early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) accounts of targeted individuals.”

    VolexityVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “Stratus Red Team, Atomic Red Team, CloudGoat, ROADTools, Splunk ATT&CK Range, and a pile of homegrown scripts all get used that way.”

    Elastic Security LabsVendor
    Cloud Threat Emulation on Autopilot: Context is Everything

  2. “Volexity was able to use the ROADTools project to replicate these steps, and followed this guide to create a new token with full permissions for Microsoft Graph API access.”

    VolexityVendor
    Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows

Indicators in its reports

named in the reports above
Copy these 12 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with ROADTools here?
No account needed. We do not store your IP address.