# MAAD-AF - MAAD Attack Framework | An Attack Tool For Simple, Fast And Effective Security Testing Of M365 And Azure AD

**URL:** <https://onehack.st/t/maad-af-maad-attack-framework-an-attack-tool-for-simple-fast-and-effective-security-testing-of-m365-and-azure-ad/243343>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, cloud-storage\
**Created:** [June 6, 2023, 8:47pm UTC](https://onehack.st/t/maad-af-maad-attack-framework-an-attack-tool-for-simple-fast-and-effective-security-testing-of-m365-and-azure-ad/243343 "2023-06-06T20:47:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [June 6, 2023, 8:47pm UTC](https://onehack.st/t/maad-af-maad-attack-framework-an-attack-tool-for-simple-fast-and-effective-security-testing-of-m365-and-azure-ad/243343/1 "2023-06-06T20:47:11Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/1/d/1de49cc1fd5b741049c8a59c372b0fad7d1f95d7.png)

# MAAD Attack Framework

MAAD-AF is an open-source cloud attack tool developed for testing security of Microsoft 365 & Azure AD environments through adversary emulation. MAAD-AF provides security practitioners easy to use attack modules to exploit configurations across different M365/AzureAD cloud-based tools & services.

MAAD-AF is designed to make cloud security testing simple, fast and effective. Through its virtually no-setup requirement and easy to use interactive attack modules, security teams can test their security controls, detection and response capabilities easily and swiftly.

## Features

- Pre & Post-compromise techniques
- Simple interactive use
- Virtually no-setup requirements
- Attack modules for Azure AD
- Attack modules for Exchange
- Attack modules for Teams
- Attack modules for SharePoint
- Attack modules for eDiscovery

### MAAD-AF Attack Modules

- Azure AD External Recon (Includes sub-modules)
- Azure AD Internal Recon (Includes sub-modules)
- Backdoor Account Setup
- Backdoor through Cross Tenant Synchronization
- Trusted Network Modification
- Disable Mailbox Auditing
- Disable Anti-Phishing
- Mailbox Deletion Rule Setup
- Exfiltration through Mailbox Forwarding
- Gain User Mailbox Access
- External Teams Access Setup (Includes sub-modules)
- eDiscovery exploitation (Includes sub-modules)
- Bruteforce
- MFA Manipulation
- User Account Deletion
- SharePoint exploitation (Includes sub-modules)

## Getting Started

### Plug & Play - It’s that easy!

1. Clone or download the MAAD-AF github repo to your windows host
2. Open PowerShell as Administrator
3. Navigate to the local MAAD-AF directory `(cd /MAAD-AF)`
4. Run MAAD\_Attack.ps1 `(./MAAD_Attack.ps1)`

### Requirements

1. Internet accessible Windows host
2. PowerShell (version 5 or later) terminal as Administrator
3. The following PowerShell modules are required and will be installed automatically:

- [Az](https://www.powershellgallery.com/packages/Az/)
- [AzureAd](https://www.powershellgallery.com/packages/AzureAD/)
- [MSOnline](https://www.powershellgallery.com/packages/MSOnline/)
- [ExchangeOnlineManagement](https://www.powershellgallery.com/packages/ExchangeOnlineManagement/)
- [MicrosoftTeams](https://www.powershellgallery.com/packages/MicrosoftTeams/)
- [AzureADPreview](https://www.powershellgallery.com/packages/AzureADPreview/)
- [ADInternals](https://aadinternals.com/aadinternals/)
- [ExchangePowershell](https://www.powershellgallery.com/packages/ExchangeOnlineManagement/3.0.0)
- [Microsoft.Online.SharePoint.PowerShell](https://www.powershellgallery.com/packages/Microsoft.Online.SharePoint.PowerShell/16.0.23311.12000)
- [PnP.PowerShell](https://github.com/pnp/powershell)
- [Microsoft.Graph.Identity.SignIns](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.SignIns/2.0.0-rc3)

### Limitations

- MAAD-AF is currently only fully supported on Windows OS

## Contribute

- Thank you for considering contributing to MAAD-AF!
- Your contributions will help make MAAD-AF better.
- Join the mission to make security testing simple, fast and effective.
- There’s ongoing efforts to make the source code more modular to enable easier contributions.
- Continue monitoring this space for updates on how you can easily incorporate new attack modules into MAAD-AF.

### Add Custom Modules

- Everyone is encouraged to come up with new attack modules that can be added to the MAAD-AF Library.
- Attack modules are functions that leverage access & privileges established by MAAD-AF to exploit configuration flaws in Microsoft services.

### Report Bugs

- Submit bugs or other issues related to the tool directly in the “Issues” section

### Request Features

- Share those great ideas. Submit new features by submitting a PR or sharing them in the Discussions.

## Contact

- If you found this tool useful, want to share an interesting use-case, bring issues to attention, whatever the reason - share them. You can email at: [maad-af@vectra.ai](mailto:maad-af@vectra.ai) or post it in Discussions on GitHub.

## GitHub:

> **[GitHub - vectra-ai-research/MAAD-AF: MAAD Attack Framework - An attack tool for simple,...](https://github.com/vectra-ai-research/MAAD-AF)**
>
> MAAD Attack Framework - An attack tool for simple, fast & effective security testing of M365 & Entra ID (Azure AD).