hunt-m365
From the author
Microsoft 365 / Entra ID attack - tenant discovery, user enumeration via OneDrive differential (2026 verified), AADSTS code reference, Smart Lockout math (hard cap 1-2 attempts/user), ROPC validation, Conditional Access mapping. Wiki-first, FIND schema output.
Install
npx skills add Encod3d-Sec/TORCH --skill hunt-m365 -a claude-code
Installs to .claude/skills/hunt-m365/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 83
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- detecting-oauth-token-theft26zl/cybersec-toolkitDetects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly detection. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft detection, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.DevOps★ 82
- cippServosity/msp-skillsMCP server and CLI for CIPP - Microsoft 365, Entra ID, Intune, Exchange Online, Defender and GDAP across every client tenant, with an offline store, fleet posture analytics, and cross-tenant fan-out. Trigger phrases: `check MFA across all my tenants`, `Defender vulnerabilities across all my clients`, `Intune policies for every tenant`, `mailbox forwarding across tenants`, `GDAP roles for each client`, `find unused M365 licenses`, `offboard users from a CSV in CIPP`, `which tenants drifted off baseline`, `list CIPP tenants`, `use cipp`, `run cipp-cli`.Security★ 63
- detecting-email-account-compromise26zl/cybersec-toolkitDetect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.Productivity★ 82
- cloud-securityhypnguyen1209/offensive-claudeUse when attacking AWS/Azure/GCP cloud — IAM/identity privilege escalation, IMDS/metadata SSRF, Entra device-code & PRT theft, GCP impersonation chains, Kubernetes/container escape, IaC/CI-CD federation abuseSecurity★ 401
- hunt-idorEncod3d-Sec/TORCHIDOR / BOLA hunting - two-account methodology, identifier discovery and UUID leak chaining, the trusted-identifier test, GraphQL node and nested-object IDOR, cross-tenant escalation, write and delete operations. Bounded ID sampling, never range sweeps. Wiki-first, FIND schema output. Trigger on IDOR, BOLA, broken access control, object level authorization, cross-tenant, "read another user's data", "swap the id", or any API path or parameter carrying a numeric ID, UUID, or account identifier.Testing★ 335
- ms365-tenant-managerborghei/Claude-SkillsMicrosoft 365 tenant administration for Global Administrators. Use for tenant setup, Azure AD user management, Exchange Online and Teams config, Conditional Access policies, license management, and PowerShell bulk-operation scripts.DevOps★ 978
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in