Module Details

Halberd modules allow users to execute different attack techniques. Here is a list of all modules available in current release.

Attack Surface : Entra ID, M365, AWS, Azure

Total Unique Techniques : 90

Note: Only unique techniques are listed in each tactic. Techniques overlap across multiple tactics.

Entra ID

Initial Access

• Establish Access via Device Code Flow
• Establish Access As User - Delegated Access
• Establish Access As App
• Password Spray
• Bruteforce Password
• Bruteforce Graph Apps - Delegated Access

Lateral Movement

• Establish Access With Token

Defense Evasion

• Add Trusted IP Configuration

Discovery

• Recon Tenant Info
• Check User Validity
• Enumerate Users
• Enumerate Apps
• Enumerate Directory Roles
• Enumerate Application Permissions
• Enumerate Groups
• Enumerate Conditional Access Policies
• Enumerate Users One Drive
• Enumerate Sharepoint Sites

Privilege Escalation

• Add User to Group
• Assign Directory Role
• Generate App Credentials
• Assign App Permission

Persistence

• Create Backdoor Account
• Invite External User
• Create New Application

Impact

• Remove Account Access

M365

Collection

• Deploy Email Forwarding Rule
• Exfil Users Mailbox
• Search Outlook Messages
• Search Teams Chat
• Search Teams Messages
• Search User One Drive

Defense Evasion

• Deploy Email Deletion Rule

Lateral Movement

• Send Outlook email

AWS

Initial Access

• Establish Access

Discovery

• Recon IAM User Info
• Recon Account Authorization Info
• Enumerate IAM Users
• Enumerate IAM Roles
• Enumerate IAM Policies
• Enumerate S3 Buckets
• Enumerate S3 Bucket Objects
• Get S3 Bucket ACL
• Enumerate EC2 Instances
• Enumerate Dynamo DB Tables
• Enumerate Cloud Trail Logs
• Enumerate GuardDuty Detectors
• Recon Risky IAM Policy User
• Recon EC2 Over Permissive Security Groups
• Recon S3 Public Buckets

Defense Evasion

• Disable CloudTrail Logging
• Modify Guard Duty Trusted IP

Privilege Escalation

• Assume Role

Collection

• Exfiltrate S3 Bucket

Exfiltration

• Expose S3 Bucket Public

Impact

• Delete S3 Bucket
• Delete S3 Bucket Object
• Delete DynamoDB Table

Azure

Initial Access

• Establish Access As User
• Establish Access As App
• Password Spray

Discovery

• Enumerate VM
• Enumerate Resources
• Enumerate Resource Groups
• Enumerate Role Assignment
• Enumerate Virtual Machine Scale Set
• Enumerate VM in VMSS
• Enumerate Storage Accounts

Execution

• VM - Deploy Malicious Extension
• VM - Execute Scripts/Commands

Privilege Escalation

• Elevate Access From EntraID
• Assign Role
• Modify Key Vault Access

Defense Evasion

• Create New Resource Group
• Enable Storage Account Public Access
• Expose Storage Account Container Public
• Abuse Azure Policy - Disable Logging
• Disable Resource Diagnostic Logging
• Disable Storage Account Firewall

Credential Access

• Dump Key Vault
• Dump Automation Account
• Dump Storage Account
• Share VM Disk
• Scan Logic Apps for Credentials

Exfiltration

• Share Storage Account Container
• Generate Storage Account Container SAS

Impact

• Delete VM

Azure

Initial Access

• Establish Access As Service Account