About

Imported from mukul975/anthropic-cybersecurity-skills (skills/detecting-azure-lateral-movement/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill detecting-azure-lateral-movement. Copyright stays with the author (Apache-2.0).

Detecting Azure Lateral Movement

Name: detecting-azure-lateral-movement
Author: mukul975

Overview

Lateral movement in Azure AD/Entra ID differs from on-premises environments. Attackers pivot through OAuth application consent grants, service principal abuse, cross-tenant access policies, and stolen refresh tokens rather than SMB/RDP connections. Detection requires correlating Microsoft Graph API audit logs, Azure AD sign-in logs, and Entra ID protection risk events using KQL queries in Microsoft Sentinel. This skill covers building detection analytics for common Azure lateral movement techniques including application impersonation, mailbox delegation abuse, and conditional access policy bypasses.

When to Use

When investigating security incidents that require detecting azure lateral movement
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Azure subscription with Microsoft Sentinel workspace configured
Azure AD P2 or Entra ID P2 license for risk-based sign-in detection
Microsoft Graph API permissions: AuditLog.Read.All, Directory.Read.All, SecurityEvents.Read.All
Log Analytics workspace ingesting AuditLogs, SigninLogs, and AADServicePrincipalSignInLogs
Familiarity with KQL (Kusto Query Language)

Steps

Step 1: Configure Log Ingestion

Enable diagnostic settings to stream Azure AD logs to Log Analytics:

Sign-in logs (interactive and non-interactive)
Audit logs (directory changes, app consent)
Service principal sign-in logs
Provisioning logs
Risky users and risk detections

Step 2: Build Detection Queries

Create KQL analytics rules in Sentinel for:

Unusual service principal credential additions
OAuth application consent grants to unknown apps
Cross-tenant sign-ins from new tenants
Token replay from different IP/user-agent combinations
Mailbox delegation changes (FullAccess, SendAs)

Step 3: Correlate Events

Chain multiple low-confidence indicators into high-confidence lateral movement detections by correlating sign-in anomalies with directory changes within time windows.

Step 4: Automate Response

Create Sentinel playbooks (Logic Apps) to automatically revoke suspicious OAuth grants, disable compromised service principals, and enforce step-up authentication.

Expected Output

JSON report containing detected lateral movement indicators, correlated event chains, affected identities, and recommended containment actions with MITRE ATT&CK technique mappings.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-detecting-azure-846129/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-detecting-azure-846129.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-detecting-azure-846129",
  "kind": "skill",
  "name": "detecting-azure-lateral-movement",
  "description": "Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding",
      "data_analysis"
    ],
    "tags": [
      "skill-md",
      "azure",
      "entra-id",
      "lateral-movement",
      "sentinel",
      "kql",
      "graph-api",
      "cloud-security",
      "threat-hunting",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/detecting-azure-lateral-movement/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/detecting-azure-lateral-movement/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/detecting-azure-lateral-movement/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Detecting Azure Lateral Movement\n\n## Overview\n\nLateral movement in Azure AD/Entra ID differs from on-premises environments. Attackers pivot through OAuth application consent grants, service principal abuse, cross-tenant access policies, and stolen refresh tokens rather than SMB/RDP connections. Detection requires correlating Microsoft Graph API audit logs, Azure AD sign-in logs, and Entra ID protection risk events using KQL queries in Microsoft Sentinel. This skill covers building detection analytics for common Azure lateral movement techniques including application impersonation, mailbox de",
  "cost": {
    "context_tokens": 649
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-detecting-azure-846129/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.