Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add EvilFreelancer/secs --skill investigating-azure-incidentsgit clone --depth 1 https://github.com/EvilFreelancer/secsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/evilfreelancer/secs/investigating-azure-incidents)<a href="https://agentmods.dev/skills/evilfreelancer/secs/investigating-azure-incidents"><img src="https://agentmods.dev/badge/skills/evilfreelancer/secs/investigating-azure-incidents/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/evilfreelancer/secs/investigating-azure-incidents"><img src="https://agentmods.dev/badge/skills/evilfreelancer/secs/investigating-azure-incidents.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00114 | $0.01503 |
| Opus 5 | $0.00057 | $0.00751 |
| Sonnet 5 | $0.00023 | $0.00301 |
| Haiku 4.5 | $0.00011 | $0.00150 |
Grade A, and why
investigating-azure-incidents scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Investigating Azure Incidents
Azure intrusions are usually identity intrusions. The attacker signs in as a user, consents an app, adds a credential to a service principal, or elevates a role — and each leaves a record in the Entra sign-in logs, the Entra audit log, the Azure Activity Log, or the Microsoft 365 unified audit log. The investigator's task is to correlate across those planes, because a single one rarely tells the whole story: the sign-in log shows the authentication, the audit log shows what identity changed, and the activity log shows what resources moved. Query them with KQL and build one timeline.
Confirm the tenant/subscription is in scope per AGENTS.md. Mind log retention: Entra sign-in/audit logs have short default retention unless exported to Log Analytics, so preserve early. This is read-only investigation; disabling accounts or revoking sessions is the operator's containment call.
When to Use
- A suspected Azure/Entra compromise where the evidence is cloud logs
- Tracing identity abuse: risky sign-ins, impossible travel, token/session theft
- Confirming MFA or conditional-access bypass
- Investigating service-principal credential additions and OAuth app-consent abuse
- Reconstructing role assignments (incl. PIM), resource tampering, and Key Vault access
When NOT to Use
- On-host artifacts of an Azure VM — use
investigating-windows-endpoints(or acquire the disk/memory) - AWS or GCP — use
investigating-aws-incidentsorinvestigating-gcp-incidents - Proactive search with no incident yet — use
hunting-threats - Offensive cloud testing — use
exploiting-cloud-platforms - Proactive hardening — use
hardening-cloud-posture - Running the whole incident — use
responding-to-incidents - Packaging IOCs into a product — use
producing-threat-intelligence
Reconstruct Across the Log Planes
Three Entra/Azure sources plus the M365 unified audit log, correlated:
- Entra sign-in logs — authentications: user, app, IP, device, MFA result, conditional-access result, and the risk state. Impossible travel, legacy-auth protocols, and token-replay show here.
- Entra audit logs — directory changes:
Add service principal credentials,Consent to application,Add member to role,Update conditional access policy, user/credential changes. - Azure Activity Log — resource control plane: role assignments (
Microsoft.Authorization/roleAssignments/write), resource and network-security-group changes, Key Vault operations. - M365 unified audit log — mailbox rules, sharing, and Exchange/SharePoint actions when the compromise touches M365.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 109 lines · 114 tokens per session scan A af01416efa36
investigating-azure-incidents is a skill published in the GitHub repository EvilFreelancer/secs (10 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 114 tokens to every session and 1,503 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
auditing-gcp-iam-permissions
Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.
configuring-identity-aware-proxy-with-google-iap
Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request identity verification for Compute Engine, App Engine, Cloud Run, and GKE services using access levels, context-aware policies, and programmatic access with service accounts.
building-red-team-c2-infrastructure-with-havoc
Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, redirectors, and Demon agents for authorized red team operations.
configuring-pfsense-firewall-rules
Configures pfSense firewall rules, NAT policies, VPN tunnels, and traffic shaping to enforce network segmentation, control traffic flow, and protect internal network zones in enterprise and small-to-medium business environments.
deploying-palo-alto-prisma-access-zero-trust
Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.
conducting-cloud-penetration-testing
This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understanding the shared responsibility model for testing scope, leveraging cloud-specific attack tools like Pacu and ScoutSuite, exploiting IAM misconfigurations, testing for SSRF…