Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

MFASweep

Password Sprayer

Credentials & User Impersonation

Initial Access

A PowerShell tool by dafthack for checking whether an explicitly scoped account can authenticate to Microsoft services through different endpoints, protocols, and web user-agent strings. It tests Microsoft Graph, Azure Resource Manager, Microsoft 365 web sign-in, Exchange Web Services, ActiveSync, and optional ADFS paths. Its unknown-platform check sends a Nintendo Switch user-agent that Entra may classify as an unknown platform. Its client-ID check probes username/password ROPC requests for multiple client/resource pairs. Results apply only to the tested identity, endpoint, client/resource, policy state, and time; they do not establish organization-wide MFA coverage. ROPC is incompatible with MFA and Conditional Access, so that mode tests password-grant exposure rather than proving an interactive MFA bypass.

Source

https://github.com/dafthack/MFASweep

Language

PowerShell

References

github.com blackhillsinfosec.com raw.githubusercontent.com learn.microsoft.com learn.microsoft.com

+6 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER