m365-entra-attack

## When to use this skill Trigger when: - Target uses M365 / Entra ID (autodiscover.* records, login.microsoftonline.com redirects, "Microsoft Office 365" in tech-stack notes) - You have a list of corporate emails or stealer-leaked creds - Engagement involves "credential spray", "password spray", "Entra attack", "ATO via M365" - You see `*.onmicrosoft.com`, `*-my.sharepoint.com`, `enterpriseregistration.*`, `enterpriseenrollment.*` in recon - Client mentions "Conditional Access", "MFA bypass", "compliant device" DO NOT use for: - On-prem-only Active Directory (use a separate AD-attack skill) - Service-to-service token attacks (different threat model) - Phishing-required attack chains (covered by phishing skills) — but you can prep for the credential-validation step here --- ## Tenant discovery (msftrecon) ```bash # For each owned domain msftrecon -d client.example msftrecon -d clientltd.example msftrecon -d sister-brand-school.example ``` Key fields in output: - **Tenant ID** (different domains may share OR have separate tenants — always test all owned domains) - **Federation Information.Namespace Type** = `Managed` (cloud-only, ROPC works) | `Federated` (ADFS, different attack) - **SharePoint Detected** (Yes = OneDrive enum vector available) - **Communication Services Teams/Skype** (post-auth lateral targets) - **Admin Consent Endpoint accessible** (consent-phishing surface) **Red flag:** if the org has multiple Entra tenants for sister domains, each is a separate att...