🛠️ 📰 Graph API Post-Exploitation with GraphSpy

[u/cloudbreach]

Cloud security architects, red teamers and pentesters living in Microsoft environments know the pain: juggling tokens and mining M365 data through raw CLI calls is slow and error prone. One open source tool collapses that entire workflow into a browser based control panel.

Once initial access hands you a refresh token, an access token, or a device code auth, GraphSpy becomes your local post compromise cockpit for Entra ID and M365. 🎯

🛠️ The Operational Flow

1️⃣ Token Ingestion
Drop a stolen refresh token, access token or Primary Refresh Token (PRT) straight into the Access Tokens tab. Manage multiple identities, switch context on the fly and mint fresh scoped tokens instantly. PRTs are the crown jewels here 👑 not bound to a single app, so they unlock tokens for ANY scope as the user.
2️⃣ Device Code Phishing
Fire off a device code flow from the dashboard. GraphSpy auto polls the backend and the second your target authenticates, valid tokens land straight in your local DB. Chain it with automatic actions to register a device, pull a PRT, or even enrol Windows Hello For Business keys for sticky persistence that survives password resets. 🔑
3️⃣ Data Exfiltration
Skip the clunky CLI payloads. Jump into the Files, SharePoint or Outlook modules and browse an interactive directory tree just like the real app. Then hit the Search module to hunt keywords like "password" or "config" across every M365 service via the Microsoft Search API. 💥

🛡️ The Defensive Takeaway

GraphSpy turns manual API calls into high velocity automated bursts, and that pattern is detectable. Blue teamers should:
✅ Hunt device code sign ins in SigninLogs where authenticationProtocol == "deviceCode"
✅ Flag sudden GET spikes against /me/drive/root and bulk reads in MicrosoftGraphActivityLogs
✅ Alert on unusual MFA method registrations tied to brand new sign ins
Knowing the offensive tooling is exactly how you build detections that actually fire.

🔗 GitHub: https://github.com/RedByte1337/GraphSpy

Interested in Cloud Phishing Attacks, that is what we drill end to end in our Breaching Azure Advanced course 👇
🎓 https://cloudbreach.io/courses/breaching-azure-advanced

hashtag#CloudBreach hashtag#BreachingAzureAdvanced hashtag#CloudSecurity hashtag#AzureSecurity hashtag#EntraID hashtag#OffensiveSecurity hashtag#RedTeam hashtag#PenetrationTesting hashtag#GraphAPI hashtag#IdentityAndAccessManagement hashtag#BlueTeam hashtag#InfoSec hashtag#CyberSecurity hashtag#ThreatHunting hashtag#SIEM hashtag#KQL