AZMGDirectory_ReadWrite_All
This edge is created when a Service Principal has been granted the Directory.ReadWrite.All edge.
Abuse Info
The edge is not abusable, but is used during post-processing to create abusable edges.
Opsec Considerations
No opsec considerations apply to this edge.
References
- https://attack.mitre.org/techniques/T1098/
- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
Assistant
Responses are generated using AI and may contain mistakes.
On this page
Get Started
Auth
- POSTLogin to BloodHound
- POSTLogout of BloodHound
- GETGet self
- GETList SAML Providers
- GETGet all SAML sign on endpoints
- POSTCreate a New SAML Provider from Metadata
- GETGet SAML Provider
- DELDelete a SAML Provider
- GETList SSO Providers
- POSTCreate OIDC Provider
- POSTCreate a New SAML Provider from Metadata
- DELDelete SSO Provider
- PATCHUpdate SSO Provider
- GETGet SAML Provider Signing Certificate
Permissions
BloodHound Users
- GETList Users
- POSTCreate a New User
- GETGet a user
- DELDelete a User
- PATCHUpdate a User
- PUTCreate or Set User Secret
- DELExpire User Secret
- POSTEnrolls user in multi-factor authentication
- DELUnenroll user from multi-factor authentication
- GETReturns MFA activation status for a user
- POSTActivates MFA for an enrolled user
Collectors
Collection Uploads
Audit
Config
Asset Isolation
- GETList all asset isolation groups
- POSTCreate an asset group
- POSTCreate Asset Group Tag Selector
- GETGet Asset Group Tag
- GETGet Asset Group Tags
- GETGet asset group by ID
- GETList asset group tag members by ID
- GETGet Asset Group Tag Selector
- GETGet Asset Group Tag selectors
- GETGet asset group tag selectors of a specific object by member id
- GETList asset group tag member count by kind
- GETList asset group tag members by selector
- GETList asset group collections
- POSTPreview Selectors
- PUTUpdate an asset group
- PUTUpdate asset group selectors
- POSTUpdate asset group selectors
- PATCHUpdate Asset Group Tag Selector
- DELDelete an asset group
- DELDelete an asset group selector
- DELDelete Asset Group Tag Selector
- GETGet asset group custom member count
- GETList all asset isolation group members
- GETList asset group member count by kind
Graph
Cypher
Azure Entities
Computers
- GETGet computer entity info
- GETGet computer entity admin rights
- GETGet computer entity admins
- GETGet computer entity constrained delegation rights
- GETGet computer entity constrained users
- GETGet computer entity controllables
- GETGet computer entity controllers
- GETGet computer entity DCOM rights
- GETGet computer entity DCOM users
- GETGet computer entity group membership
- GETGet computer entity remote PowerShell rights
- GETGet computer entity remote PowerShell users
- GETGet computer entity RDP rights
- GETGet computer entity RDP users
- GETGet computer entity sessions
- GETGet computer entity SQL admins
Domains
- GETGet domain entity info
- PATCHUpdate the Domain entity
- GETGet domain entity computers
- GETGet domain entity controllers
- GETGet domain entity DC Syncers
- GETGet domain entity foreign admins
- GETGet domain entity foreign GPO controllers
- GETGet domain entity foregin groups
- GETGet domain entity foreign users
- GETGet domain entity GPOs
- GETGet domain entity groups
- GETGet domain entity inbound trusts
- GETGet domain entity linked GPOs
- GETGet domain entity OUs
- GETGet domain entity outbound trusts
- GETGet domain entity users
GPOs
OUs
AD Users
- GETGet User entity info
- GETGet User entity admin rights
- GETGet User entity constrained delegation rights
- GETGet User entity controllables
- GETGet User entity controllers
- GETGet User entity DCOM rights
- GETGet User entity membership
- GETGet User entity PowerShell remote rights
- GETGet User entity RDP rights
- GETGet User entity sessions
- GETGet User entity SQL admin rights
Groups
- GETGet Group entity info
- GETGet Group entity admin rights
- GETGet Group entity controllables
- GETGet Group entity controllers
- GETGet Group entity DCOMRights
- GETGet Group entity members
- GETGet Group entity memberships
- GETGet Group entity PowerShell remote rights
- GETGet Group entity RDP rights
- GETGet Group entity sessions
Data Quality
Database
EULA
Analysis
Client Ingest
Clients
- GETList Clients
- POSTCreate Client
- POSTClient Error
- PUTUpdate Client Values
- GETGet Client
- PUTUpdate Client
- DELDelete Client
- PUTRegenerate the authentication token for a client
- GETList all completed tasks for a client
- GETList all completed jobs for a client
- POSTCreates a scheduled task
- POSTCreates a scheduled job
Jobs
Events (Schedules)
Attack Paths
Risk Posture
Meta Entities
AZMGDirectory_ReadWrite_All
This edge is created when a Service Principal has been granted the Directory.ReadWrite.All edge.
Abuse Info
The edge is not abusable, but is used during post-processing to create abusable edges.
Opsec Considerations
No opsec considerations apply to this edge.
References
- https://attack.mitre.org/techniques/T1098/
- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
Assistant
Responses are generated using AI and may contain mistakes.
On this page