H3XA — Operational Evidence

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[AADInternals](https://attack.mitre.org/software/S0677) is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.(Citation: AADInternals Github)(Citation: AADInternals Documentation)

Labels

tool

26 recorded

Relationships

uses

to Cloud Account

Technique

uses

to Cloud Account

Technique

uses

to Cloud Administration Command

Technique

uses

to Cloud Groups

Technique

uses

to Cloud Service Discovery

Technique

uses

to Credentials In Files

Technique

uses

to Data from Cloud Storage

Technique

uses

to Device Registration

Technique

uses

to Domain Properties

Technique

uses

to Email Addresses

Technique

uses

to Exfiltration Over Alternative Protocol

Technique

uses

to Hybrid Identity

Technique

uses

Technique

uses

to Modify Registry

Technique

uses

to Multi-Factor Authentication

Technique

uses

Technique

uses

to Private Keys

Technique

uses

Technique

uses

to Silver Ticket

Technique

uses

to Spearphishing Link

Technique

uses

to Spearphishing Link

Technique

uses

to Steal Application Access Token

Technique

uses

to Steal or Forge Authentication Certificates

Technique

uses

to Trust Modification

Technique

uses

from APT29

Group

uses

from Storm-0501

Group

4 external

References

mitre-attack

S0677

AADInternals

https://o365blog.com/aadinternals/

AADInternals Documentation

https://o365blog.com/aadinternals

AADInternals Github

https://github.com/Gerenios/AADInternals