BlackHat Arsenal 2025 - msInvader : Automating Adversary Simulation in M365 and Azure

msInvader is an adversary simulation tool built for blue teams, designed to simulate adversary techniques within M365 and Azure environments. This tool generates attack telemetry, aiding teams in building, testing, and enhancing detection analytics. By implementing multiple authentication mechanisms, including OAuth flows for compromised user scenarios and service principals, msInvader mirrors realistic attack conditions. It interacts with Exchange Online using the Graph API, EWS, and REST API, providing comprehensive simulation capabilities. This session will explore msInvader's technical features, demonstrating its application in improving security defenses through detailed adversary simulations.

1. #BHUSA   @BlackHatEvents
msInvader: Automating Adversary
Simulation in M365 & Azure

Mauricio Velazco
@mvelazco

2. #BHUSA   @BlackHatEvents
●From Arequipa, Peru


●Security Researcher at Microsoft


●@mvelazco


●https://github.com/mvelazc0

#whoami

3. #BHUSA   @BlackHatEvents

●Personal Views: The opinions and views expressed in this presentation are
my own and do not reflect those of my employer.
●Independence: The content presented is based on my personal research
and experience.
●No Endorsement: Mention of specific tools, technologies, or companies
does not imply endorsement by my employer.
●Responsibility: I assume full responsibility for any errors or omissions in
the presentation.

Disclaimer

4. #BHUSA   @BlackHatEvents
The New Cloud Reality

5. #BHUSA   @BlackHatEvents

●Threat actors abuse trusted identities,
not endpoints.

●API-based access bypasses endpoint
and network controls

●Evolving cloud techniques challenge
defenders’ understanding of attacks
and telemetry


Cloud Attacks Redefine Visibility

6. #BHUSA   @BlackHatEvents

●Realistic, repeatable cloud attack
simulations

●Visibility into post-compromise
techniques


●Attack telemetry to test and tune
detections
What Defenders Need

7. #BHUSA   @BlackHatEvents
msInvader
https://github.com/mvelazc0/msInvader

8. #BHUSA   @BlackHatEvents
●Adversary simulation tool designed to
execute attacker techniques against
EntraID/M365 tenants and Azure
subscriptions.

●Generates attack telemetry to help
defenders improve detection and
response capabilities.

●Leverages APIs like MS Graph,
EWS and ARM for comprehensive
simulations and technique variations.


msInvader

9. #BHUSA   @BlackHatEvents
Microsoft Identity Platform
https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols

10. #BHUSA   @BlackHatEvents
OAuth Grant Flows
https://learn.microsoft.com/en-us/entra/fundamentals/introduction-identity-access-management

11. #BHUSA   @BlackHatEvents
●Stolen Credentials (Phishing, Keylogger, Brute Force)

-> Resource Owner Password Credentials Flow

●MFA Bypass (AITM, Token Theft, MFA Fatigue)

-> Device Code Flow

●Compromised Service Principal Secrets (Keys, Certs)

-> Client Credentials Flow



Token Acquisition

12. #BHUSA   @BlackHatEvents
Device Code Flow

13. #BHUSA   @BlackHatEvents
●Microsoft Graph

●Exchange Web Services (EWS)

●Exchange Online Pws Module API

●Azure Resource Management API

●Security & Compliance API


Supported APIs

14. #BHUSA   @BlackHatEvents
●Flexible configuration of simulation
playbooks using a YAML file.

●The YAML configuration file consists
of two main sections:
authentication and techniques.




Configuration File

15. #BHUSA   @BlackHatEvents
Demos

16. #BHUSA   @BlackHatEvents
●Storm‑2372 abuses device code
phishing to steal OAuth tokens and
bypass MFA in M365 environments

●Post-compromise access is fully
API-driven, using MS Graph to search
and exfiltrate email and directory data.

●Lateral movement is achieved by
sending internal phishing emails,
expanding access to additional users.



Storm-2372
https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/

17. #BHUSA   @BlackHatEvents
Storm-2372
Device Code Phishing Email Exfiltration Email Lateral Movement

18. #BHUSA   @BlackHatEvents
Extending Storm-2372
Email Lateral Movement Mailbox Rule Creation File Exfiltration
Device Code Phishing Tenant Enumeration Email Exfiltration

19. #BHUSA   @BlackHatEvents
Extending Storm-2372
read_email
method: EWS
Limit:10
enumerate_directory_roles
method:Graph
enumerate_applications
method:Graph
search_email
method: Graph
keyword:*Contract
search_email
method: Graph
keyword:*Contract
search_onedrive
method: Graph
keyword: invoice
device_code
enumerate_users
method:Graph
enumerate_groups
method:Graph
send_email
method:Graph
subject: Action Required: Install...
create_rule
method:EWS
type:moving_rule
search_onedrive
method: Graph
keyword: invoice

20. #BHUSA   @BlackHatEvents
Demo 1: Extending Storm-2372

21. #BHUSA   @BlackHatEvents
●SignInLogs

Tracks user sign-ins, methods, IPs, and risk
info.

●MicrosoftGraphActivityLogs

Logs Graph API calls like email access and
user enumeration.

●OfficeActivity

Shows actions in Exchange, OneDrive,
SharePoint, and Teams.





Demo 1: Log Insights

22. #BHUSA   @BlackHatEvents
●Attackers abuse legitimate cloud
services and configurations

●Access often escalates through
over-permissioned identities

●Cloud lateral movement doesn’t
require malware or code execution

●Misconfigured roles and secrets are
common pivot points
Key Vault Lateral Movement

23. #BHUSA   @BlackHatEvents
Key Vault Lateral Movement

Email Exfiltration Service Principal Hijack Key Vault Exfiltration
Password Spray Graph Enumeration ARM Enumeration

24. #BHUSA   @BlackHatEvents
Key Vault Lateral Movement
list_key_vaults
enumerate_arm_role_assignments
method:ARM
enumerate_arm_resources
method:ARM
access_key_vault_item add_keyvault_access_policy access_key_vault_item
password_spray
enumerate_users
method:Graph
enumerate_groups
method:Graph
enumerate_app_role_assignments get_ms_token_clientread_email

25. #BHUSA   @BlackHatEvents
Demo 2: Key Vault Lateral Movement

26. #BHUSA   @BlackHatEvents
●AADServicePrincipalSignInLogs

Captures sign-ins by service principals.

●AzureActivity

Tracks control plane actions like role
assignments and access policy changes.

●AzureDiagnostics

Logs resource-level activity such as Key Vault
secret reads.








Demo 2: Log Insights

27. #BHUSA   @BlackHatEvents
●Reveal Visibility Gaps

Simulations highlight what logs you have —
and what you’re missing.

●Drive Detection Engineering

Turn real attack behavior into custom, tested
detections.

●Validate Security Assumptions

Validate whether your controls work as
expected — or fail silently.



Takeaways

28. #BHUSA   @BlackHatEvents
msInvader
https://github.com/mvelazc0/msInvader

29. #BHUSA   @BlackHatEvents
msInvader: Automating Adversary
Simulation in M365 & Azure

Mauricio Velazco
@mvelazco