M365 Entra Attack
Microsoft 365 / Entra ID red-team attack chain, current 2026 reality.
Install
npx skills add Zyrexnn/Cybermes --skill m365-entra-attack -g -a claude-code -y- Repository
- Zyrexnn/Cybermes987
- Category
- Testing
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Microsoft 365 / Entra ID red-team attack chain, current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional Access bypass options, ROPC + SAML SSO browser flow, Burp/Playwright templates. Built from authorized red-team work where ROPC spray surfaced pre-existing lockouts and CA-blocked credentials, plus real-time external attacker activity correlation. Use for any M365/Entra credential attack, password spray, user enumeration, CA-bypass exploration, or active-attacker-detection scenario.
When to use this skill
Trigger when:
- Target uses M365 / Entra ID (autodiscover.* records, login.microsoftonline.com redirects, "Microsoft Office 365" in tech-stack notes)
- You have a list of corporate emails or stealer-leaked creds
- Engagement involves "credential spray", "password spray", "Entra attack", "ATO via M365"
- You see
*.onmicrosoft.com,*-my.sharepoint.com,enterpriseregistration.*,enterpriseenrollment.*in recon - Client mentions "Conditional Access", "MFA bypass", "compliant device"
DO NOT use for:
- On-prem-only Active Directory (use a separate AD-attack skill)
- Service-to-service token attacks (different threat model)
- Phishing-required attack chains (covered by phishing skills), but you can prep for the credential-validation step here
Tenant discovery (msftrecon)
# For each owned domain
msftrecon -d client.example
msftrecon -d clientltd.example
msftrecon -d sister-brand-school.example
Key fields in output:
- Tenant ID (different domains may share OR have separate tenants, always test all owned domains)
- Federation Information.Namespace Type =
Managed(cloud-only, ROPC works) |Federated(ADFS, different attack) - SharePoint Detected (Yes = OneDrive enum vector available)
- Communication Services Teams/Skype (post-auth lateral targets)
- Admin Consent Endpoint accessible (consent-phishing surface)
Red flag: if the org has multiple Entra tenants for sister domains, each is a separate attack surface with its own user list, lockout policy, and CA configuration. Don't assume one spray covers all.
