Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-azure-lateral-movementnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-azure-lateral-movement -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-azure-lateral-movement -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-azure-lateral-movementgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-azure-lateral-movementgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-azure-lateral-movement ~/.claude/skills/detecting-azure-lateral-movement # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-azure-lateral-movement ~/.agents/skills/detecting-azure-lateral-movement # Codex, Cursor, Gemini CLI, Copilot, OpenCode