Loading malware…
AzureHound is an open-source, Go-based data collection tool developed by SpecterOps for the BloodHound suite. It is legitimate penetration-testing software rather than an inherently malicious program, but threat actors abuse it for post-compromise reconnaissance in Microsoft Entra ID and Azure environments. Precompiled versions are available for Windows, Linux, and macOS.
AzureHound queries Microsoft Graph and Azure REST APIs to enumerate users, groups, service principals, applications, roles, permissions, subscriptions, storage resources, and cloud infrastructure. It exports collected information as JSON for ingestion into BloodHound, which visualizes relationships and potential privilege-escalation paths. AzureHound supports authentication using credentials, tokens, and service principal secrets or certificates. Because the APIs are externally accessible, it does not need to execute within the compromised organization's network.
Observed adversarial users include Peach Sandstorm, also known as Curious Serpens, as well as Void Blizzard and Storm-0501. These actors have used AzureHound to discover tenant configurations and identify opportunities for subsequent operations. Its enumeration can expose privileged identities, access relationships, and potential data targets; identifying these opportunities does not itself constitute privilege escalation or data theft. Some Azure Resource Manager read and list operations are absent from standard Azure activity logs, limiting visibility into portions of its enumeration.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
AzureHound is a data collection tool intended for penetration testing that is part of the BloodHound suite. Threat actors misuse this tool to enumerate Azure resources and map potential attack paths, enabling further malicious operations.
AzureHound is a data collection tool intended for penetration testing that is part of the BloodHound suite. Threat actors misuse this tool to enumerate Azure resources and map potential attack paths, enabling further malicious operations.
AzureHound is a data collection tool intended for penetration testing that is part of the BloodHound suite. Threat actors misuse this tool to enumerate Azure resources and map potential attack paths, enabling further malicious operations.
AzureHound is a data collection tool intended for penetration testing that is part of the BloodHound suite. Threat actors misuse this tool to enumerate Azure resources and map potential attack paths, enabling further malicious operations.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
The team used publicly available tools, including AzureHound and ROADrecon, to gather information about applications, their permissions, and their owners.
Threat actors also run the tool after obtaining initial access to the victim environment... AzureHound supports multiple means of authentication, including: Username and password Refresh tokens JSON web tokens (JWT) Service principal secrets Service principal certificates... Threat actors will use whatever means of authentication is available.
“the infection chain begins when threat actors gain initial access… using stolen credentials or authentication tokens… refresh tokens, or JSON Web Tokens (JWTs), threat actors authenticate to the Azure environment.”
Let's authorize a Microsoft public client application using Python. In this example, we will complete an device authorization grant flow as the Azure CLI public client application.
Threat actors also run the tool after obtaining initial access to the victim environment... AzureHound supports multiple means of authentication, including: Username and password Refresh tokens JSON web tokens (JWT) Service principal secrets Service principal certificates... Threat actors will use whatever means of authentication is available.
“the infection chain begins when threat actors gain initial access… using stolen credentials or authentication tokens… refresh tokens, or JSON Web Tokens (JWTs), threat actors authenticate to the Azure environment.”
Threat actors also run the tool after obtaining initial access to the victim environment... AzureHound supports multiple means of authentication, including: Username and password Refresh tokens JSON web tokens (JWT) Service principal secrets Service principal certificates... Threat actors will use whatever means of authentication is available.
Threat actors also run the tool after obtaining initial access to the victim environment... AzureHound supports multiple means of authentication, including: Username and password Refresh tokens JSON web tokens (JWT) Service principal secrets Service principal certificates... Threat actors will use whatever means of authentication is available.
Infostealers such as Raccoon Stealer or Redline can extract cookies, credentials and session tokens from a user's browser. Researchers from Flare found that session tokens acquired from infostealers have exposed tokens from Azure.
AzureHound supports multiple means of authentication, including... Service principal certificates
"AD Explorer for Active Directory environment mapping"; "AzureHound and Roadtools for Azure AD reconnaissance"
情報収集 csvde dcdiag dsquery ldifde nltest nmap ntdsutil AzureHound SharpHound
They enumerate users, groups, roles, applications and service principals.
Detect AzureHound Command-Line Arguments ... Local Groups ... Detect SharpHound Usage ... Local Groups ... Group Discovery Via Net ... Local Groups
Detect AzureHound Command-Line Arguments ... Domain Groups ... Detect SharpHound Usage ... Domain Groups ... Group Discovery Via Net ... Domain Groups
T1069.003: Permission Groups Discovery: Cloud Groups Once threat actors know the identities within the target environment, they need to understand the relationships between the identities by discovering permission structures... For Permissions Groups Discovery: Cloud Accounts, AzureHound has the following capabilities: list groups list roles list group-members list group-owners list role-assignments list app-role-assignments list key-vault-access-policies list management-group-role-assignments list resource-group-role-assignments list subscription-role-assignments list virtual-machine-role-assignments
情報収集 csvde dcdiag dsquery ldifde nltest nmap ntdsutil AzureHound SharpHound
Detect AzureHound Command-Line Arguments ... Local Account ... Detect SharpHound Usage ... Local Account ... Windows SOAPHound Binary Execution ... Local Account
Step 2 - Reconnaissance T1087.002, T1482, T1518.001, T1057, T1082 | Affiliate Domain enumeration via obfuscated ADRecon.ps1, nltest, net group, tasklist, sc query.
“ROADrecon's gather command uses aiohttp by default and walks every directory object type” and produces “Bulk enumeration across every object type ROADrecon knows.”
Detect AzureHound Command-Line Arguments ... Domain Trust Discovery ... Detect SharpHound Usage ... Domain Trust Discovery ... Windows SOAPHound Binary Execution ... Domain Trust Discovery
AzureHound and ROADrecon gathered information about Entra ID applications, their permissions, and their owners.
T1580: Cloud Infrastructure Discovery To fully grasp the architecture of the target environment, a threat actor must discover the foundational infrastructure components... For Cloud Infrastructure Discovery, AzureHound has the following capabilities: list tenants list subscriptions list resource-groups list management-groups list virtual-machines list key-vaults
T1619: Cloud Storage Object Discovery A primary objective for many threat actors is data exfiltration, making it critical to identify where data is stored... AzureHound has two options for storage object discovery, covering both Azure storage accounts and containers: list storage-accounts list storage-containers
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.