Kali Linux

Reportly : An AzureAD User Activity Report Tool

Reportly is an AzureAD user activity report tool.

About the tool

This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following:

  1. Information about the user
  2. Actions taken by the user
  3. Actions taken on the user
  4. User login and failure logs

Example_video

Usage

When running the tool, a link to authentication and a device code will show, follow the link and enter the code to authenticate.

Insert User principal name of a suspicious user.
Insert start and end times in the following format: 2022-11-16
I recommend a range of no longer then a week.

After authentication, in order to create a full report choose the option “5”

When the report will be ready the tool will print “Your report is ready!”. The reports are created in the executable’s directory.

Installation

In order to use the tool you will need an AzureAD application with the following delegated microsoft graph api permissions:

  • AuditLog.Read.All
  • GroupMember.Read.All
  • RoleManagement.Read.Directory
  • User.Read
  • User.Read.All

dont forget to grant admin consent

  • To create an application go to “App registration” tab and select “New registration” option.
  • Also, when creating the application, make sure you mark the following option as “yes”:
  • you can find this property under the application’s “Authentication” tab.

Add a secret to the application.

  • Go to “Certificates & secrets”
  • Add a secret
  • Immediately copy the secret to the config file (after you watch it once, it disappears)

After you created the application you need to fill the config.cfg file:
clientId = application id
clientSecret = application secret
tenantId = tenant id

Please consider following and supporting us to stay updated with the latest info

R K

Recent Posts

JBDev : A Tool For Jailbreak And TrollStore Development

JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…

13 hours ago

Kereva LLM Code Scanner : A Revolutionary Tool For Python Applications Using LLMs

The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…

15 hours ago

Nuclei-Templates-Labs : A Hands-On Security Testing Playground

Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…

16 hours ago

SSH-Stealer : The Stealthy Threat Of Advanced Credential Theft

SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…

16 hours ago

ollvm-unflattener : A Tool For Reversing Control Flow Flattening In OLLVM

Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…

16 hours ago

Cybersecurity – Tools And Their Function

Cybersecurity tools play a critical role in safeguarding digital assets, systems, and networks from malicious…

2 days ago