Skip to content

AADInternals

Software · ATTACK:enterprise:S0677

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0677",
  "title": "AADInternals",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0677",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--2c5281dd-b5fd-4531-8aea-c1bf8a0f8756",
  "external_id": "S0677",
  "domain": "enterprise",
  "created": "2022-02-01T15:08:45.007Z",
  "modified": "2025-04-16T20:38:50.579Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "AADInternals",
      "url": "https://o365blog.com/aadinternals/"
    },
    {
      "source_name": "AADInternals Documentation",
      "url": "https://o365blog.com/aadinternals"
    },
    {
      "source_name": "AADInternals Github",
      "url": "https://github.com/Gerenios/AADInternals"
    }
  ]
}

Explicit source assertions (26)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1526

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16c64146-61e6-4be5-bdc3-1fa97870a080

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1649

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--234867ce-57bb-41c6-beb5-af9cc00e1a39

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1556.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3691a1cd-c9d4-4492-b6c1-7ceb1b661758

AADInternals Azure AD On-Prem to Cloud

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1098.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5124a13e-f7a3-43ad-88e4-c73c380cb6f7

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1598.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--545efdec-5375-43e9-b369-0f6367b067dd

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cd4af07-d10e-4034-84fc-b8256f08b5cd

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1484.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ea91f17-6015-4339-9b86-2bf51977a7aa

AADInternals Documentation · Azure AD Federation Vulnerability

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0677

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70ceb05c-ed86-4b51-bde0-2455662c30b7

MSTIC Nobelium Oct 2021

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--731a7678-8b88-47c9-88a6-7bc897bb79bb

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1069.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73b54501-4907-45ec-b64a-4465a2f07a96

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1136.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a5c8052-723b-47e1-943f-0731b9177730

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1606.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a371d1a1-29aa-4d11-bad4-d11866171c6c

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1590.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3932823-51c8-402d-a7a7-ee31882fc48a

AADInternals Documentation · Azure AD Recon

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1589.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a43dfdcf-380a-43ae-877f-891a01ed1c53

AADInternals Documentation · Azure AD Recon

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1558.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae78b837-1698-44a4-a81a-8eece005ea9f

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bdf68d86-fce4-46ad-9421-afdaf14273fe

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1528

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c620753b-17ad-43bd-ace3-f572ebcac644

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1087.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce26fb61-137e-489c-8c69-d2ac5a9f59ce

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d101870c-304e-4597-a292-7d5e8c870f95

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1556.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5e008e5-28ff-4f0a-8e09-ab637c733646

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1651

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--deb5cfb8-d9e8-46bf-9f13-3f3dfca885d9

AADInternals Root Access to Azure VMs

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8747d32-65e4-4a55-a5c8-e87136cc44da

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee9a7f72-eac2-4ca4-b82a-5c5a50618d0d

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--faa657c6-e223-4b45-8f92-b35fbd76bd56

AADInternals Documentation

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1048

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc2c7ee8-31f1-49f6-afd5-69443db69ab7

AADInternals Documentation

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S0677

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff916215-e7dc-410a-919c-83a00eb95dc1

Microsoft Storm-501 Sabbath Ransomware Embargo September 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.