vectra-ai-research/MAAD-AF：MAAD 攻击框架——一款用于简单、快速且有效的 M365

429

GNU General Public License v3.0

项目介绍

vectra-ai-research/MAAD-AF 是一个托管在 GitHub 上的开源项目，主要使用 PowerShell 编写，采用 GNU General Public License v3.0 许可证，目前获得 429 个 Star、63 次 Fork。

仓库全名: vectra-ai-research/MAAD-AF
开源许可证: GNU General Public License v3.0
Star 数: 429
Fork 数: 63
未关闭 Issue: 3

README 摘要

MAAD Attack Framework MAAD-AF is an open-source cloud attack tool for Microsoft 365 & Entra ID(Azure AD) environments. MAAD-AF offers simple, fast and effective security testing. Validate Microsoft cloud controls and test detection & response capabilities with a virutally zero-setup process, complete with a fully interactive workflow for executing emulated attacks. MAAD-AF is developed natively in PowerShell. Usage…

完整内容见 GitHub 原始 README 或本页。

常见问题

MAAD-AF 用什么语言开发？

主要使用 PowerShell 编写，采用 GNU General Public License v3.0 许可证，目前有 429 个 Star。

MAAD-AF 可以免费商用吗？

仓库标注的许可证为 GNU General Public License v3.0，商用前请先阅读仓库 LICENSE 文件确认授权范围。

如何获取 MAAD-AF 的源码？

可以直接克隆仓库：git clone https://github.com/vectra-ai-research/MAAD-AF.git，默认分支为 main；安装与运行步骤见仓库 README。

MAAD-AF 最近还在维护吗？

仓库最近一次更新为 1月14日，当前有 3 个未关闭 Issue；Star 数为 429，可作为社区活跃度的参考。

关于

GitHub 原始描述（英文）

MAAD Attack Framework - An attack tool for simple, fast & effective security testing of M365 & Entra ID (Azure AD).

描述取自 GitHub 官方 API，保持仓库作者书写的原文。

简要分析

热度分

570

价值分

277

活跃状态

活跃

adversary-emulation microsoft microsoft-azure-security powershell security cloud-security mitre red-team security-testing azuread

GitHub

语言占比

PowerShell

Release

MAAD-AF V32024年1月16日
MAAD-AFv2.12023年12月23日
MAAD-AF v1.12023年9月16日

贡献者

openrec0n

CyrilleFranchet

README

MAAD Attack Framework

MAAD_Logo

MAAD-AF is an open-source cloud attack tool for Microsoft 365 & Entra ID(Azure AD) environments.

MAAD-AF offers simple, fast and effective security testing. Validate Microsoft cloud controls and test detection & response capabilities with a virutally zero-setup process, complete with a fully interactive workflow for executing emulated attacks.

MAAD-AF is developed natively in PowerShell.

Usage

Clone or download MAAD-AF from GitHub
Start PowerShell as Admin and navigate to MAAD-AF directory

> git clone https://github.com/vectra-ai-research/MAAD-AF.git
> cd /MAAD-AF

Launch MAAD-AF

> MAAD_Attack.ps1 
# Launch and bypass dependency checks
> MAAD_Attack.ps1 -ForceBypassDependencyCheck

Requirements

Windows host
PowerShell 5.1

Features

Attack emulation tool
Fully interactive (no-commands) workflow
Zero-setup deployment
Ability to revert actions for post-testing cleanup
Leverage MITRE ATT&CK
Emulate post-compromise attack techniques
Attack techniques for Entra ID (Azure AD)
Attack techniques for Exchange Online
Attack techniques for Teams
Attack techniques for SharePoint
Attack techniques for eDiscovery

MAAD-AF Techniques

Recon data from various Microsoft services
Backdoor Account Setup
Trusted Network Modification
Mailbox Audit Bypass
Disable Anti-Phishing in Exchange
Mailbox Deletion Rule Setup
Exfiltration through Mail Forwarding
Gain User Mailbox Access
Setup External Teams Access
Exploit Cross Tenant Synchronization
eDiscovery exploitation for data recon & exfil
Bruteforce credentials
MFA Manipulation
User Account Deletion
SharePoint exploitation for data recon & exfil
More…

Contribute

Thanks for considering contributing to MAAD-AF! Your contributions will help make MAAD-AF better.
Submit your PR to the main branch.
Submit bugs & issues directly to GitHub Issues
Share ideas in GitHub Discussions

Contact

If you found MAAD-AF useful, want to share an interesting use-case or idea - reach out & share them

Maintainer : Arpan Sarkar
Email : [email protected]

MAAD-AF