This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected.

BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world.…

MDATP

Create a high level interactive HTML report for you Active Directory environment using PowerShell

Content and collateral for the Microsoft Sentinel SOC 101 series

Simple GUI for Microsoft Defender for Endpoint API machine actions in PowerShell.

Create a Word document showing your Sentinel configuration

sentinel work

Generate a report of the analytic rules that can be updated

Create a CSV to show solution information. Includes PowerBI and Workbook to show data