technique
https://attack.mitre.org/techniques/T1594
technique
https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/
Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active Directory Leaks via Azure. Retrieved October 6, 2019.
technique
https://github.com/True-Demon/raindance
Stringer, M.. (2018, November 21). RainDance. Retrieved October 6, 2019.
technique
https://cloud.google.com/identity/docs/reference/rest
Google. (n.d.). Retrieved March 16, 2021.
technique
https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest
Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.
technique
https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0
Microsoft. (n.d.). Get-MsolRole. Retrieved October 6, 2019.
technique
https://attack.mitre.org/techniques/T1069/003
technique
https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
Mark Russinovich. (2019, June 28). Autoruns for Windows v13.96. Retrieved March 13, 2020.
technique
https://trustedsignal.blogspot.com/2014/05/kansa-service-related-collectors-and.html
Hull, D.. (2014, May 3). Kansa: Service related collectors and analysis. Retrieved October 10, 2019.
technique
https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights?redir
Microsoft. (2018, May 31). Registry Key Security and Access Rights. Retrieved March 16, 2017.