Module Details

Halberd modules allow users to execute different attack techniques. Here is a list of all modules available in current release.

Attack Surface : Entra ID, M365, AWS, Azure

Total Unique Modules : 57

Note: Only unique modules are listed in each category. Modules overlap across multiple categories.

Entra ID

Initial Access

• Delegated Access (Username / Password)
• Password Spray
• Brute force Graph Access Token
• Brute force Password
• Entra ID App Only Access
• Entra ID Device Code Flow
• Entra ID Direct Token Access

Defense Evasion

• Modify Trusted IP Configuration

Discovery

• Recon Tenant Info
• Recon User Accounts
• Recon Groups
• Recon Applications
• Recon Directory Roles
• Recon Conditional Access Policies
• Recon User One Drive
• Recon SharePoint Sites

Privilege Escalation

• Add User to Group
• Assign Directory Role to User
• Generate Application Credentials

Persistence

• Create Backdoor Account in Tenant
• Invite External User to Tenant
• Create New Application

Impact

• Remove User Account

M365

Collection

• Search User Outlook Messages
• Exfil User Mailbox
• Search User Teams Chat
• Search User SP One Drive
• Setup Email Forwarding Rule
• Search Teams Messages

Defense Evasion

• Setup Email Deletion Rule

Lateral Movement

• Send Email (Spear-Phishing)

AWS

Initial Access

• AWS Access

Discovery

• List Buckets
• Get Bucket ACL
• List Bucket Objects
• List IAM Roles
• List DynamoDB Tables
• Enumerate EC2 Instances
• Recon IAM Users
• Recon IAM Policies
• Recon Account Authorization Details
• Recon User Details

Privilege Escalation

• Assume Role

Collection

• Exfil S3 Bucket

Impact

• Delete S3 Bucket
• Delete Bucket Objects
• Delete DynamoDB Table

Azure

Initial Access

• Credential Access - Azure CLI
• Service Principal Access - Azure CLI
• Password Spray

Discovery

• Recon Assigned Role
• Recon VMs
• Recon Resources

Privilege Escalation

• Elevate Azure Access for Global Admin
• Assign Azure Role

Defense Evasion

• Create Resource Group

Impact

• Delete Azure VM