npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Lateral movement in Azure AD/Entra ID differs from on-premises environments. Attackers pivot through OAuth application consent grants, service principal abuse, cross-tenant access policies, and stolen refresh tokens rather than SMB/RDP connections. Detection requires correlating Microsoft Graph API audit logs, Azure AD sign-in logs, and Entra ID protection risk events using KQL queries in Micro...
Detects lateral movement in Azure AD/Entra ID using Graph API audit logs, Sentinel KQL queries, and sign-in correlations for privilege escalation, token theft, and pivoting.
Detects lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL queries, and login anomaly correlations. Identifies privilege escalation, token theft, and cross-tenant transfers for threat hunting.
Queries Azure Monitor activity and sign-in logs via azure-monitor-query to detect suspicious admin operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments.
Share bugs, ideas, or general feedback.
Lateral movement in Azure AD/Entra ID differs from on-premises environments. Attackers pivot through OAuth application consent grants, service principal abuse, cross-tenant access policies, and stolen refresh tokens rather than SMB/RDP connections. Detection requires correlating Microsoft Graph API audit logs, Azure AD sign-in logs, and Entra ID protection risk events using KQL queries in Microsoft Sentinel. This skill covers building detection analytics for common Azure lateral movement techniques including application impersonation, mailbox delegation abuse, and conditional access policy bypasses.
Enable diagnostic settings to stream Azure AD logs to Log Analytics:
Create KQL analytics rules in Sentinel for:
Chain multiple low-confidence indicators into high-confidence lateral movement detections by correlating sign-in anomalies with directory changes within time windows.
Create Sentinel playbooks (Logic Apps) to automatically revoke suspicious OAuth grants, disable compromised service principals, and enforce step-up authentication.
JSON report containing detected lateral movement indicators, correlated event chains, affected identities, and recommended containment actions with MITRE ATT&CK technique mappings.