Azure AD Incident Response (AAD-IR)

Azure AD Incident Response life cycle and phases including tools, articles, tips, and useful information

Note: the information will be updated continuously

*** The information in this repo is part of Azure Hacktive Directory content ***

Articles

• Azure AD Incident Response Life-Cycle and Process
• Azure AD Incident Response - Builtin Investigtaion Tools
• Azure AD Incident Response - PowerShell Investigtaion Tools
• Azure AD Incident Response - M5 Investigtaion Tools
• Azure AD Incident Response - Attack & Defense Scenario's

Tools

• Sparrow
• AzureHound
• Hawk
• CRT
• AzureADIncidentResponse
• Go365 - user enum and password guessing

Azure Sentinel 4 Azure AD IR

Azure AD Incident Response Queries