Merge pull request #292 from HackTricks-wiki/update_Paved_With_Intent__ROADtools_and_Nation-State_Tact_20260522_143732

Paved With Intent ROADtools and Nation-State Tactics in the ...

Author: carlospolop

src/pentesting-cloud/azure-security/az-enumeration-tools.md

@@ -469,9 +469,17 @@ import-module Az
 
 ## Automated Post-Exploitation tools
 
-### [**ROADRecon**](https://github.com/dirkjanm/ROADtools)
+### [**ROADtools**](https://github.com/dirkjanm/ROADtools) / ROADrecon / ROADtx
 
-The enumeration of ROADRecon offers information about the configuration of Entra ID, like users, groups, roles, conditional access policies...
+ROADtools is one of the main open-source frameworks for Entra ID offensive research. The most relevant components are:
+
+- **`roadrecon`**: tenant discovery and local dataset generation (users, groups, roles, devices, service principals, applications, directory settings).
+- **`roadtx`**: token acquisition/exchange, refresh-token reuse, device registration, and PRT workflows.
+- **`roadlib`**: lower-level auth/API library used by the other modules.
+
+The collected data is stored in a local SQLite database and can be explored in the ROADrecon web UI, which is useful to map privileged users, role assignments, devices, service principals, and application relationships before planning persistence or lateral movement.
+
+#### ROADrecon collection
 
 ```bash
 cd ROADTools
@@ -484,6 +492,41 @@ roadrecon gather
 roadrecon gui
 ```
 
+ROADrecon originally targeted Azure AD Graph. As of **May 22, 2026**, the official repository still keeps Microsoft Graph support in the **`msgraph`** branch, and community forks such as **Tom2Byrne/ROADtools** continue updating Graph-based collection. In Graph-capable builds, ROADrecon adds the **`-mg`** switch to enumerate endpoints such as **`/users`**, **`/groups`**, **`/devices`**, **`/servicePrincipals`**, and **`/applications`**.
+
+```bash
+# Graph-capable ROADrecon builds
+roadrecon auth -u test@corp.onmicrosoft.com -p "Welcome2022!"
+roadrecon gather -mg
+roadrecon gui
+```
+
+#### ROADtx high-value use cases
+
+If you already have valid credentials, a refresh token, or a PRT-derived session, ROADtx is commonly used to:
+
+- **Register a rogue Entra ID device** against **`urn:ms-drs:enterpriseregistration.windows.net`** to obtain device keys/certificates and create durable device-backed access.
+- **Exchange/reuse refresh tokens** to get fresh Microsoft Graph or other resource tokens without repeating interactive sign-in.
+- **Abuse PRT workflows** to silently mint new access tokens in the background.
+
+A useful hunting clue is that default **`roadtx device`** values have historically been:
+
+- **OS**: `Windows`
+- **OS version**: `10.0.19041.928`
+- **Name**: `DESKTOP-<RANDOM 8 DIGITS>`
+
+These values are easy to change, so treat them as **weak indicators**. They are still useful when correlated with unusual device registration events, non-corporate naming patterns, suspicious source IPs/geos/ASNs, or scripted user agents.
+
+#### ROADtools opsec / hunting notes
+
+Because ROADtools uses legitimate Microsoft identity APIs, defenders should hunt for the **combination** of token activity, enumeration patterns, and user-agent anomalies instead of expecting malware-like signatures. Useful signals include:
+
+- **Device registration** audit operations such as `Add device`, `Add registered owner to device`, `Add registered user to device`, and `Register device`
+- Requests or sign-ins tied to **Device Registration Service**
+- Script-like user agents such as **`python-requests`**, **`urllib`**, or **`curl`**
+- Bursty Microsoft Graph reads against discovery-heavy endpoints like **`/users`**, **`/groups`**, **`/devices`**, **`/servicePrincipals`**, and **`/applications`**
+- Powerful OAuth scopes appearing in audit data, especially **`Directory.ReadWrite.All`**, **`Device.ReadWrite.All`**, **`Application.ReadWrite.All`**, **`AuditLog.ReadWrite.All`**, and **`Policy.ReadWrite.All`**
+
 ### [**AzureHound**](https://github.com/BloodHoundAD/AzureHound)
 
 AzureHound is the BloodHound collector for Microsoft Entra ID and Azure. It is a single static Go binary for Windows/Linux/macOS that talks directly to:
@@ -683,6 +726,10 @@ python stormspotter\stormcollector\sscollector.pyz cli
 
 ## References
 - [Cloud Discovery With AzureHound (Unit 42)](https://unit42.paloaltonetworks.com/threat-actor-misuse-of-azurehound/)
+- [Paved With Intent: ROADtools and Nation-State Tactics in the Cloud](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/)
+- [ROADtools repository](https://github.com/dirkjanm/ROADtools)
+- [ROADtools msgraph branch](https://github.com/dirkjanm/ROADtools/tree/msgraph)
+- [Tom2Byrne/ROADtools](https://github.com/Tom2Byrne/ROADtools)
 - [AzureHound repository](https://github.com/SpecterOps/AzureHound)
 - [BloodHound repository](https://github.com/SpecterOps/BloodHound)
 - [AzureHound Community Edition Flags](https://bloodhound.specterops.io/collect-data/ce-collection/azurehound-flags)