Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

MDI Check Instance

Noise: RESTRICTED_ACCESS_BLUR_MARKER

OSINT

Reconnaissance

Archived PowerShell 0.1 script that sends an Exchange Autodiscover GetFederationInformation request for an input domain, uses returned federated domains (not necessarily every accepted domain) to derive an onmicrosoft.com tenant prefix, and probes two legacy tenant-derived atp.azure.com URL forms. Treat the MDI result as an unverified heuristic: HTTP 200 produces a 'looks like' message, while request exceptions are reported as 'no instance'; neither confirms deployment. Current Microsoft documentation directs admins to authenticated Defender portal settings for workspace and sensor status and documents a workspace-specific sensor API endpoint.

Source

https://github.com/thalpius/Microsoft-Defender-for-Identity-Check-Instance

Language

PowerShell

References

github.com raw.githubusercontent.com learn.microsoft.com learn.microsoft.com learn.microsoft.com

+7 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER