saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/detecting-azure-lateral-movement/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.8 KiB
Raw Blame History

API Reference: Detecting Azure Lateral Movement

Microsoft Graph API Endpoints

Endpoint Method Description
/v1.0/auditLogs/directoryAudits GET Azure AD audit events
/v1.0/auditLogs/signIns GET Interactive sign-in logs
/beta/auditLogs/signIns GET Non-interactive + SP sign-ins
/v1.0/identityProtection/riskDetections GET Risk detections
/v1.0/servicePrincipals GET List service principals
/v1.0/oauth2PermissionGrants GET Delegated permission grants

Authentication (Client Credentials Flow)

curl -X POST "https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token" \
  -d "grant_type=client_credentials" \
  -d "client_id={app_id}" \
  -d "client_secret={secret}" \
  -d "scope=https://graph.microsoft.com/.default"

Sentinel KQL - Lateral Movement Detections

OAuth Consent Grant (T1550.001)

AuditLogs
| where OperationName == "Consent to application"
| extend InitiatedBy = tostring(InitiatedBy.user.userPrincipalName)
| extend AppName = tostring(TargetResources[0].displayName)
| project TimeGenerated, InitiatedBy, AppName, Result

Service Principal Credential Addition (T1098.001)

AuditLogs
| where OperationName has_any ("Add service principal credentials", "Update application")
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| extend Target = tostring(TargetResources[0].displayName)
| project TimeGenerated, Actor, Target, OperationName

Token Replay Detection (T1528)

SigninLogs
| summarize IPCount=dcount(IPAddress), IPs=make_set(IPAddress) by UserPrincipalName, bin(TimeGenerated, 1h)
| where IPCount >= 5
| sort by IPCount desc

Cross-Tenant Access (T1078.004)

SigninLogs
| where ResourceTenantId != HomeTenantId
| project TimeGenerated, UserPrincipalName, IPAddress, ResourceTenantId, AppDisplayName

Required Graph API Permissions

Permission Type Use
AuditLog.Read.All Application Read audit logs
Directory.Read.All Application Read directory data
SecurityEvents.Read.All Application Read risk detections
Policy.Read.All Application Read conditional access

MITRE ATT&CK Azure Techniques

Technique ID Azure Indicator
Application Access Token T1550.001 OAuth consent grant
Account Manipulation T1098.001 SP credential addition
Cloud Accounts T1078.004 Cross-tenant sign-in
Steal Application Access Token T1528 Token from multiple IPs

References