Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint offensive Entra ID enumeration tools such as ROADtools, AADInternals, and AzureHound, including User-Agent signatures, roadrecon endpoint sweeps, and sign-in correlation.
安装
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-entra-offensive-tools-in-graph-logsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-entra-offensive-tools-in-graph-logs -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-entra-offensive-tools-in-graph-logs -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-entra-offensive-tools-in-graph-logsgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-entra-offensive-tools-in-graph-logsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-entra-offensive-tools-in-graph-logs ~/.claude/skills/detecting-entra-offensive-tools-in-graph-logs # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-entra-offensive-tools-in-graph-logs ~/.agents/skills/detecting-entra-offensive-tools-in-graph-logs # Codex, Cursor, Gemini CLI, Copilot, OpenCode