Stats
Actions
Tags
From cybersec-toolkit
Detects lateral movement in Azure AD/Entra ID using Microsoft Graph API audit logs, Azure Sentinel KQL queries, and sign-in anomaly correlations to identify privilege escalation, token theft, and pivoting.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:detecting-azure-lateral-movementThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Lateral movement in Azure AD/Entra ID differs from on-premises environments. Attackers pivot through OAuth application consent grants, service principal abuse, cross-tenant access policies, and stolen refresh tokens rather than SMB/RDP connections. Detection requires correlating Microsoft Graph API audit logs, Azure AD sign-in logs, and Entra ID protection risk events using KQL queries in Micro...
Lateral movement in Azure AD/Entra ID differs from on-premises environments. Attackers pivot through OAuth application consent grants, service principal abuse, cross-tenant access policies, and stolen refresh tokens rather than SMB/RDP connections. Detection requires correlating Microsoft Graph API audit logs, Azure AD sign-in logs, and Entra ID protection risk events using KQL queries in Microsoft Sentinel. This skill covers building detection analytics for common Azure lateral movement techniques including application impersonation, mailbox delegation abuse, and conditional access policy bypasses.
Enable diagnostic settings to stream Azure AD logs to Log Analytics:
Create KQL analytics rules in Sentinel for:
Chain multiple low-confidence indicators into high-confidence lateral movement detections by correlating sign-in anomalies with directory changes within time windows.
Create Sentinel playbooks (Logic Apps) to automatically revoke suspicious OAuth grants, disable compromised service principals, and enforce step-up authentication.
JSON report containing detected lateral movement indicators, correlated event chains, affected identities, and recommended containment actions with MITRE ATT&CK technique mappings.
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitDetects lateral movement in Azure AD/Entra ID using Microsoft Graph API audit logs, Azure Sentinel KQL queries, and sign-in anomaly correlations to identify privilege escalation, token theft, and pivoting.
Detect lateral movement in Azure AD/Entra ID using Graph API audit logs, Sentinel KQL queries, and sign-in anomaly correlation to identify privilege escalation and token theft.
Detects lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL queries, and login anomaly correlations. Identifies privilege escalation, token theft, and cross-tenant transfers for threat hunting.