📘
DFIR
Ctrlk
  • Networking
    • Networking
  • Windows
    • Administration
    • Forensics
    • Cheat Sheet
    • Investigation
    • Internals
    • Active Directory
    • MISC
  • Linux
    • Forensics
    • SSH
    • Linux WebShells
    • Directories of Interest
    • Internals
  • Enterprise Architecture
    • CI/CD Pipline
    • Citrix
    • Web Applications
    • The Cloud
      • AWS
      • Azure
        • Hunting
        • Admin
        • Securing Azure
        • CheatSheet
        • Detections
        • Forensics
        • Attacking Azure
          • Initial Access
          • Persistence
          • Credential Theft
            • Golden SAML Theft
            • Attacking key vaults
            • Skeleton Keys (PTA Abuse)
            • Family of Client IDs
            • Token Theft
          • Execution
          • Exfiltration
          • Test Page
        • Fundementals
        • Logging
      • M365
      • Cloud Labs
    • vSphere
    • Containers
    • Troubleshooting
  • Mac
    • Forensics
  • Attacker Information
    • Adversary Operations
    • Actor Playbooks
    • Abused Domains
  • IR Playbook
    • Activity from Unmanaged Host
    • Recommendations
  • Reverse Engineering
    • Python - Pyinstaller
Powered by GitBook
On this page
  1. Enterprise Architecture
  2. The Cloud
  3. Azure
  4. Attacking Azure

Credential Theft

Golden SAML TheftAttacking key vaultsSkeleton Keys (PTA Abuse)Family of Client IDsToken Theft
PreviousUser CreationNextGolden SAML Theft