Detecting Azure AD Enumeration: ROADrecon, AADInternals & Closing Visibility Gaps

---
title: Azure AD Enumeration via AADInternals PowerShell Module
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the import and usage of the AADInternals PowerShell module, commonly used for Azure AD enumeration and exploitation.
references:
 - https://github.com/Gerenios/AADInternals
 - https://www.elastic.co/security-labs/aad-graph-activity-logs-threat-detection
author: Security Arsenal
date: 2026/04/22
tags:
 - attack.execution
 - attack.t1059.001
 - attack.discovery
 - attack.t1087.002
logsource:
 category: process_creation
 product: windows
detection:
 selection_module:
 CommandLine|contains: 'Import-Module AADInternals'
 selection_cmdlet:
 CommandLine|contains:
   - 'Get-AADInt'
   - 'Invoke-AADInt'
 condition: 1 of selection*
falsepositives:
 - Legitimate Azure AD administration by authorized IT staff (rare in standard endpoints)
level: high
---
title: ROADrecon Execution on Windows Endpoint
id: 9c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects the execution of ROADrecon (roadrecon.exe or roadrecon.py), a tool used for dumping Azure AD database state.
references:
 - https://github.com/dirkjanm/ROADtools
 - https://www.elastic.co/security-labs/aad-graph-activity-logs-threat-detection
author: Security Arsenal
date: 2026/04/22
tags:
 - attack.discovery
 - attack.t1087.002
 - attack.execution
 - attack.t1059.001
logsource:
 category: process_creation
 product: windows
detection:
 selection_exe:
 Image|endswith:
   - '\roadrecon.exe'
 selection_script:\   CommandLine|contains:
   - 'roadrecon.exe'
   - 'roadrecon.py'
   - 'python.exe roadrecon'
 condition: 1 of selection*
falsepositives:
 - Rare, should be investigated if not performed by a known security administrator.
level: high

let Threshold = 50;
AuditLogs
| where OperationName in~ (
    "List users", "Get user", "List groups", "Get group members", 
    "List directory roles", "Get role members", "List applications"
)
| extend Caller = tostring(InitiatedBy.user.userPrincipalName)
| extend AppId = tostring(InitiatedBy.app.servicePrincipalId)
| summarize Count = count() by Caller, AppId, bin(TimeGenerated, 5m)
| where Count > Threshold
| project TimeGenerated, Caller, AppId, Count
| order by Count desc

-- Hunt for AADInternals and ROADrecon artifacts
SELECT 
  Sys.Btime as CreationTime,
  Sys.Mtime as ModifiedTime,
  FullPath,
  Size,
  MD5
FROM glob(globs="*/AADInternals/*")
WHERE FullPath

UNION ALL

SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username 
FROM pslist()
WHERE Name =~ "python.exe" 
   AND CommandLine =~ "roadrecon"
   OR Name =~ "powershell.exe" 
   AND CommandLine =~ "AADInternals"

<#
.SYNOPSIS
    Hardens Azure AD Tenant against enumeration attempts.
.DESCRIPTION
    Reviews Conditional Access policies and MFA settings to limit the effectiveness of credential dumping tools.
#>

Connect-MgGraph -Scopes "Policy.Read.All", "User.Read.All"

Write-Host "[+] Checking Conditional Access Policies..." -ForegroundColor Cyan

$policies = Get-MgConditionalAccessPolicy
$enforcedPolicies = $policies | Where-Object { $_.State -eq "enabled" }

if ($enforcedPolicies.Count -lt 1) {
    Write-Host "[!] CRITICAL: No enforced Conditional Access policies found." -ForegroundColor Red
} else {
    Write-Host "[+] Found $($enforcedPolicies.Count) active policies." -ForegroundColor Green
    # Check for MFA requirement on Admin roles
    $mfaPolicy = $enforcedPolicies | Where-Object { $_.Conditions.Users.IncludeRoles -ne $null }
    if ($mfaPolicy) {
        Write-Host "[+] Verified MFA policies exist for Role protection." -ForegroundColor Green
    } else {
        Write-Host "[!] WARNING: No MFA policy detected for Global Administrators." -ForegroundColor Yellow
    }
}

Write-Host "[+] Auditing Global Admins..." -ForegroundColor Cyan

$roleName = "Global Administrator"
$roleId = (Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq '$roleName'".Id

$admins = Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$roleId'"

Write-Host "[+] Found $($admins.Count) Global Administrators. Ensure they are compliant with MFA and PIM." -ForegroundColor Yellow

Disconnect-MgGraph
Write-Host "[+] Remediation check complete." -ForegroundColor Green