# azurehound-analysis

Use for AzureHound and BloodHound Azure or Entra ID attack-path work when the user clearly means Azure semantics such as Global Administrator, privileged Entra roles, service principals, applications, app roles, managed identities, subscriptions, resource groups, VMs, Key Vaults, or hybrid AD/Azure paths. Do not use for generic BloodHound connection checks, unclear graph-domain triage, explicit Cypher authoring/review, or OpenGraph schema-extension work.

- **Kind:** skill
- **Source:** https://github.com/SpecterOps/skills
- **Page:** https://forefy.com/skills/bd115e2f-b1ca-4cc6-9d05-b1b8358bb5dd
- **API (JSON + files):** https://forefy.com/api/asr/bd115e2f-b1ca-4cc6-9d05-b1b8358bb5dd

---

## SKILL.md

---
name: azurehound-analysis
description: "Use for AzureHound and BloodHound Azure or Entra ID attack-path work when the user clearly means Azure semantics such as Global Administrator, privileged Entra roles, service principals, applications, app roles, managed identities, subscriptions, resource groups, VMs, Key Vaults, or hybrid AD/Azure paths. Do not use for generic BloodHound connection checks, unclear graph-domain triage, explicit Cypher authoring/review, or OpenGraph schema-extension work."
metadata:
  author: "GhostWorks"
---

# AzureHound

Use this skill for AzureHound / Entra ID BloodHound query design and attack-path triage.

## Required context

- Authorized Azure tenants/subscriptions and whether AzureHound/Entra collection is present.
- Known object IDs, tenant names, privileged roles, subscriptions, or resource scopes.
- Hybrid collection availability when paths cross AD, GitHub, Okta, or SCIM.

## Workflow

1. Read `../../references/docs/bloodhound-query-methodology.md` and `../../references/docs/azurehound-methodology.md`.
2. Search `../../references/query-indexes/azurehound.md` for a matching Query Library pattern.
3. Inspect the snapshot and confirm `AZ*` labels/edges before adapting.
4. Use exact `objectid` filters when possible and bound broad tenant paths.
5. Explain each path segment by platform and collector source.

## Common pivots

- Users/groups/service principals to privileged Entra roles.
- App owners, app role assignments, credentials, and Graph API permission edges.
- Managed identities to Azure resources.
- Subscription/resource group/VM/Key Vault control paths.
- AAD/Entra Connect and synced identity bridges.
- GitHub/OIDC or Okta/SCIM hybrid paths when data is present.

## Output

Use the shared output contract from `$bloodhound-query` and include Azure-specific caveats such as display-name ambiguity, tenant-scale query cost, non-traversable Graph API edges, and collector freshness.

## agents

```

```

## agents/openai.yaml

```yaml
interface:
  display_name: "AzureHound"
  short_description: "Analyze Entra ID and Azure privilege or attack paths."
  icon_small: ./assets/icon.svg
  icon_large: ./assets/icon.png
  default_prompt: "Use $azurehound-analysis to analyze Entra ID and Azure privilege paths involving Global Admin, service principals, managed identities, subscriptions, or hybrid Azure links."
  brand_color: "#991B1B"

policy:
  allow_implicit_invocation: true
```

## assets

```

```

## assets/icon.png

```

```

## assets/icon.svg

```

```