azurehound

Overview

AzureHound is the Azure/AAD equivalent of SharpHound. It collects data from Azure Active Directory and Azure resources, then feeds it into BloodHound for attack path analysis. It finds privilege escalation paths through Azure RBAC roles, AAD group memberships, service principals, and resource permissions.

Authentication

With username and password (interactive)

azurehound -u "user@domain.onmicrosoft.com" -p "P@ssw0rd"

With service principal (client credentials)

azurehound -a "<TENANT_ID>" --client-id "<APP_ID>" --client-secret "<SECRET>"

With existing access token

azurehound -t "<ACCESS_TOKEN>"

With device code flow (no credentials needed interactively)

azurehound --device-code

With refresh token (from AADInternals or roadtx)

azurehound -r "<REFRESH_TOKEN>" -a "<TENANT_ID>"

Data Collection

Collect all Azure AD data

azurehound list -t all --tenant "<TENANT_ID>"

# Collect specific objects
azurehound list users -t "<TENANT_ID>"
azurehound list groups -t "<TENANT_ID>"
azurehound list roles -t "<TENANT_ID>"
azurehound list apps -t "<TENANT_ID>"
azurehound list service-principals -t "<TENANT_ID>"
azurehound list devices -t "<TENANT_ID>"

Include Azure resource data

azurehound list -t all --tenant "<TENANT_ID>" --subscriptions

Output and Import to BloodHound

Collect and save to JSON (import into BloodHound CE)

azurehound list -t all --tenant "<TENANT_ID>" -o azurehound.json

Start BloodHound CE locally

docker run -p 7474:7474 -p 7687:7687 specterops/bloodhound-ce:latest

# Import data via BloodHound UI:
# Administration → File Ingest → Upload azurehound.json

Tenant Discovery

Find tenant ID from domain

curl "https://login.microsoftonline.com/<domain.com>/.well-known/openid-configuration" \
  | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['token_endpoint'].split('/')[3])"

List available subscriptions after auth

azurehound list subscriptions

What AzureHound Collects

AAD Objects:
  Users, Groups, Service Principals, Applications
  Device registrations, Role assignments
  Group memberships and ownership
  Conditional Access policies

Azure Resources:
  Subscriptions and management groups
  Resource groups
  VM instances
  Key Vaults and secrets
  Storage accounts
  App Services and Function Apps

BloodHound Attack Paths (Azure)

AZAddMembers          → Add members to groups
AZOwns                → Ownership gives full control
AZContributor         → Azure resource contributor role
AZUserAccessAdministrator → Grant any role
AZResetPassword       → Reset AAD user password
AZApplicationAdministrator → Manage all applications
AZGlobalAdmin         → Full AAD admin

Tips

• Combine with on-prem BloodHound data for hybrid AD environments
• AZContributor + resource with MSI can escalate to other resources
• Service principals with AZOwns on app registrations can add credentials
• Check for AZAddSecret edges — allows adding secrets to service principals

# Using roadtx (token theft toolkit)
pip install roadtx
roadtx gettokens --username user@domain.com --password pass

Get-AADIntAccessTokenForMSGraph -Credentials (Get-Credential) | ConvertFrom-Json

# Using az CLI
az login
az account get-access-token --resource https://graph.microsoft.com

Vue d’ensemble

AzureHound est l’équivalent Azure/AAD de SharpHound. Il collecte des données depuis Azure Active Directory et les ressources Azure, puis les injecte dans BloodHound pour l’analyse de chemins d’attaque. Il trouve les chemins d’élévation de privilèges à travers les rôles Azure RBAC, les appartenances de groupe AAD, les service principals et les permissions sur les ressources.

Authentification

# Avec nom d'utilisateur et mot de passe (interactif)
azurehound -u "user@domain.onmicrosoft.com" -p "P@ssw0rd"

# Avec un service principal (client credentials)
azurehound -a "<TENANT_ID>" --client-id "<APP_ID>" --client-secret "<SECRET>"

# Avec un access token existant
azurehound -t "<ACCESS_TOKEN>"

# Avec le device code flow (aucun identifiant à saisir interactivement)
azurehound --device-code

# Avec un refresh token (depuis AADInternals ou roadtx)
azurehound -r "<REFRESH_TOKEN>" -a "<TENANT_ID>"

Collecte de données

# Collecter toutes les données Azure AD
azurehound list -t all --tenant "<TENANT_ID>"

# Collecter des objets spécifiques
azurehound list users -t "<TENANT_ID>"
azurehound list groups -t "<TENANT_ID>"
azurehound list roles -t "<TENANT_ID>"
azurehound list apps -t "<TENANT_ID>"
azurehound list service-principals -t "<TENANT_ID>"
azurehound list devices -t "<TENANT_ID>"

# Inclure les données des ressources Azure
azurehound list -t all --tenant "<TENANT_ID>" --subscriptions

Sortie et import dans BloodHound

# Collecter et sauvegarder en JSON (à importer dans BloodHound CE)
azurehound list -t all --tenant "<TENANT_ID>" -o azurehound.json

# Démarrer BloodHound CE en local
docker run -p 7474:7474 -p 7687:7687 specterops/bloodhound-ce:latest

# Importer les données via l'UI BloodHound :
# Administration → File Ingest → Upload azurehound.json

Découverte de tenant

# Trouver l'ID de tenant depuis un domaine
curl "https://login.microsoftonline.com/<domain.com>/.well-known/openid-configuration" \
  | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['token_endpoint'].split('/')[3])"

# Lister les souscriptions disponibles après authentification
azurehound list subscriptions

Ce que collecte AzureHound

AAD Objects:
  Users, Groups, Service Principals, Applications
  Device registrations, Role assignments
  Group memberships and ownership
  Conditional Access policies

Azure Resources:
  Subscriptions and management groups
  Resource groups
  VM instances
  Key Vaults and secrets
  Storage accounts
  App Services and Function Apps

Chemins d’attaque BloodHound (Azure)

AZAddMembers          → Add members to groups
AZOwns                → Ownership gives full control
AZContributor         → Azure resource contributor role
AZUserAccessAdministrator → Grant any role
AZResetPassword       → Reset AAD user password
AZApplicationAdministrator → Manage all applications
AZGlobalAdmin         → Full AAD admin

Conseils

• Combinez avec les données BloodHound on-prem pour les environnements AD hybrides
• AZContributor + une ressource avec une MSI peut permettre de rebondir vers d’autres ressources
• Les service principals ayant AZOwns sur des app registrations peuvent y ajouter des identifiants
• Cherchez les edges AZAddSecret : ils permettent d’ajouter des secrets aux service principals

# Using roadtx (token theft toolkit)
pip install roadtx
roadtx gettokens --username user@domain.com --password pass

Get-AADIntAccessTokenForMSGraph -Credentials (Get-Credential) | ConvertFrom-Json

# Using az CLI
az login
az account get-access-token --resource https://graph.microsoft.com