GitHub - dafthack/GraphRunner: A Post-exploitation Toolset for ...
GraphRunner is a post-exploitation toolset for interacting with the Microsoft Graph API. It provides various tools for performing reconnaissance, persistence, and pillaging of data from a …
Introducing GraphRunner: A Post-Exploitation Toolset for …
Oct 19, 2023 · We built a post-compromise toolset called GraphRunner for interacting with the Microsoft Graph API. It provides various tools for performing reconnaissance, persistence, and …
A Defenders Guide to GraphRunner — Part I
GraphRunner is a post-exploitation toolset for working with a Microsoft Entra ID (Azure AD) account. It contains various tools for accessing and manipulating data within the tenant.
GraphRunner : The Dual-Use Toolset For Microsoft 365 Security
Mar 4, 2025 · GraphRunner is a powerful post-exploitation toolset designed for interacting with the Microsoft Graph API, enabling red teams and attackers to perform reconnaissance, …
dafthack/GraphRunner | DeepWiki
GraphRunner is a powerful post-exploitation toolkit for Microsoft 365 environments, providing a comprehensive set of tools for authentication, reconnaissance, data extraction, and persistence.
Home · dafthack/GraphRunner Wiki · GitHub
Oct 11, 2023 · GraphRunner is a post-exploitation toolset for working with a Microsoft Entra ID (Azure AD) account. It contains various tools for accessing and manipulating data within the …
GraphRunner Cheatsheet - Black Hills Information Security, Inc.
Aug 6, 2025 · GraphRunner is a collection of post-exploitation PowerShell modules for interacting with the Microsoft Graph API. It provides modules for enumeration, exfiltration, persistence, …
GraphRunner
Feb 5, 2025 · "GraphRunner is a post-exploitation toolset for interacting with the Microsoft Graph API. It provides various tools for performing reconnaissance, persistence, and pillaging of data …
Microsoft Entra ID Post-Exploitation : Introduction to GraphRunner
Jun 24, 2025 · GraphRunner is a post-exploitation toolset developed by Beau Bullock and Steve Borosh from Black Hills Information Security. It is designed for interacting with Microsoft Entra …
As Defenders, how can we gain visibility into these actions? What Is GraphRunner? “Refresh tokens replace themselves with a fresh token upon every use. The Microsoft identity platform …