bert-janp/entratraceDefensive research tool that documents observable API endpoints and user agents of offensive tooling targeting Microsoft Entra ID, supporting detection engineering and incident response.
EntraTrace is a defensive security research tool for documenting and identifying the observable behavior of offensive tooling targeting Microsoft Entra ID.
The project builds a automatic knowledge base around tools such as AzureHound, AADInternals, O365Enum, PingCastle, and others, with a focus on the UserAgent and API artifacts they generate.
🚧 Development
The project is actively being developed. Data, tooling coverage, and functionality will evolve over time.
Contributions, research, corrections, and additional tool analysis are welcome.
EntraTrace focuses on information that can be useful to defenders, including:
The goal is to make offensive tooling behavior easier for defensive teams to understand and turn into actionable information.
| Tool | Unique APIs | Unique API calls | UserAgents |
|---|---|---|---|
| aadinternals | 4 | 110 | 18 |
| AzureHound | 2 | 28 | 0 |
| Graphpython | 3 | 119 | 17 |
| GraphRunner | 4 | 67 | 21 |
| GraphSpy | 2 | 38 | 2 |
| MFASweep | 4 | 17 | 11 |
| MicroBurst | 3 | 78 | 0 |
| MSOLSpray | 1 | 1 | 0 |
| o365enum | 1 | 1 | 2 |
| o365spray | 1 | 1 | 2 |
| pingcastle | 3 | 14 | 1 |
| PowerZure | 3 | 29 | 0 |
| ROADtools | 4 | 434 | 7 |
| ropci | 3 | 15 | 0 |
| Stormspotter | 3 | 4 | 0 |
| TeamFiltration | 3 | 62 | 2 |
| TokenSmith | 2 | 8 | 0 |
| TokenTactics | 4 | 8 | 16 |
| TokenTacticsV2 | 4 | 30 | 23 |
Offensive security tools are frequently used to assess and attack identity environments. Understanding how those tools interact with Entra ID can help defenders identify their use, investigate suspicious activity, and improve detection coverage.
EntraTrace aims to bridge the gap between offensive tooling research and defensive security operations.
EntraTrace can be used to:
The following KQL hunting queries can be used to perform IOC sweeping on your log data:
The repository is updated daily, but local deployment is supported. To run locally from the repository root with Python. Use the built-in help output to confirm the available options before running them.
⚠️ - Running the script locally may result in security alerts as repos containing offensive tools are downloaded locally to extract the information needed to create a profile.
# Extract API behavior from a repo or refresh all profile entries
python .\Scripts\ExtractToolBehavior.py --all-profiles --output-dir .\Profiles
# Export tool user agents from YAML profiles into a CSV
python .\Scripts\SummarizeUserAgents.py --profiles-dir .\Profiles --output .\Indicator Lists\UserAgents.csv
SummarizeUserAgents.py exports user-agent data from profile YAML files into a hunting CSV.ExtractToolBehavior.py reads repository URLs from Profiles\Tools.txt when present, and otherwise falls back to every repository_url found in the YAML profile files in the output directory.-h or --help to view the full parameter set and behavior.🤖 EntraTrace is developed with the assistance of AI. AI is used throughout the development and research process, with human review and validation of the resulting work.
See LICENSE for licensing information.