m365-entra-attack

When to use this skill

Trigger when:

• Target uses M365 / Entra ID (autodiscover.* records, login.microsoftonline.com redirects, "Microsoft Office 365" in tech-stack notes)
• You have a list of corporate emails or stealer-leaked creds
• Engagement involves "credential spray", "password spray", "Entra attack", "ATO via M365"
• You see *.onmicrosoft.com, *-my.sharepoint.com, enterpriseregistration.*, enterpriseenrollment.* in recon
• Client mentions "Conditional Access", "MFA bypass", "compliant device"

DO NOT use for:

• On-prem-only Active Directory (use a separate AD-attack skill)
• Service-to-service token attacks (different threat model)
• Phishing-required attack chains (covered by phishing skills) — but you can prep for the credential-validation step here

---

Tenant discovery (msftrecon)

# For each owned domain
msftrecon -d client.example
msftrecon -d clientltd.example
msftrecon -d sister-brand-school.example

Key fields in output:

• Tenant ID (different domains may share OR have separate tenants — always test all owned domains)
• Federation Information.Namespace Type = Managed (cloud-only, ROPC works) | Federated (ADFS, different attack)
• SharePoint Detected (Yes = OneDrive enum vector available)
• Communication Services Teams/Skype (post-auth lateral targets)
• Admin Consent Endpoint accessible (consent-phishing surface)

Red flag: if the org has multiple Entra tenants for sister domains, each is a separate attack surface with its own user list, lockout policy, and CA configuration. Don't assume one spray covers all.

---

AADSTS code reference (memorize)

AADSTS	Meaning	Lockout impact	What to do
50034	User does not exist	None	Skip; remove from spray list
50126	Invalid username/password	+1 attempt counter	User exists — try alternate password later (within cap)
50053	Account locked (Smart Lockout)	None (already locked)	Pre-existing → flag to SOC; don't retry
53003	CA blocked token issuance	+1 attempt counter	PASSWORD VALID — STOP, password is correct
50076	MFA required	+1 attempt counter	PASSWORD VALID — second factor needed
50079	Strong auth required	+1 attempt counter	PASSWORD VALID — same as 50076
50158	External auth required	+1 attempt counter	PASSWORD VALID — federated MFA
530003	Device-state required	+1 attempt counter	PASSWORD VALID — needs compliant device
65001	Consent required	+1 attempt counter	App-consent issue, not auth
700016	App not in tenant	None	User in different tenant — adjust target
90002	Tenant does not exist	None	Tenant typo / dead tenant