corpus.blog
41554 blogs · 4,504,310 posts Claim your blog
Record · corpus.blog/posts/01a0d4a2-34e6-73ae-8a47-696eb09bfa20

Paved With Intent: ROADtools and Nation-State Tactics in the Cloud

Unit 42 · published 22 May 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at unit42.paloaltonetworks.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
41
Words captured
3,895

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://github.com/dirkjanm/ROADtools
github.com
https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
volexity.com
https://docs-cortex.paloaltonetworks.com/r/Cortex-CLOUD/Cortex-Cloud-Runtime-Security-Documentation/What-is-Cortex-Cloud
docs-cortex.paloaltonetworks.com
https://start.paloaltonetworks.com/contact-unit42.html
start.paloaltonetworks.com
https://github.com/dirkjanm/ROADtools/wiki/Getting-started-with-ROADrecon
github.com
https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.microsoft.com_en-2Dus_graph_migrate-2Dazure-2Dad-2Dgraph-2Doverview&d=DwMGaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=_lIJbiuLEsecGC88yMz56rH6l-Y5OB28uwt-Y9Xz4rE&m=yo6tyUYrspO2VsHW_5TInS8MihQ4I9VA6SKK-9L0Rys5ZHzIwKU7zl0xtE5SLfVs&s=POvA4ehlh4k_iOM9BqSgr926rWcBQqBtgmONdmyjf38&e=
urldefense.proofpoint.com
https://github.com/dirkjanm/ROADtools/tree/msgraph
github.com
https://github.com/Tom2Byrne/ROADtools
github.com
https://github.com/dirkjanm/ROADtools/wiki/ROADtools-Token-eXchange-(roadtx
github.com
https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-on-behalf-of-flow
learn.microsoft.com
https://www.microsoft.com/en-us/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/
microsoft.com
https://unit42.paloaltonetworks.com/tag/cloaked-ursa/
unit42.paloaltonetworks.com
Threat Brief: Escalation of Cyber Risk Related to Iran (Updated June 30) Read at the source ↗
unit42.paloaltonetworks.com
https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/
microsoft.com
https://attack.mitre.org/techniques/T1098/
attack.mitre.org
https://attack.mitre.org/techniques/T1550/
attack.mitre.org
https://attack.mitre.org/techniques/T1087/
attack.mitre.org
https://learn.microsoft.com/en-us/entra/identity/devices/overview
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/devices/device-registration-how-it-works
learn.microsoft.com
https://github.com/dirkjanm/ROADtools/blob/master/roadtx/roadtools/roadtx/main.py
github.com
https://learn.microsoft.com/en-us/entra/identity/devices/concept-primary-refresh-token?tabs=windows-prt-issued%2Cbrowser-behavior-windows%2Cwindows-prt-used%2Cwindows-prt-renewal%2Cwindows-prt-protection%2Cwindows-apptokens%2Cwindows-browsercookies%2Cwindows-mfa
learn.microsoft.com
Phishing for Primary Refresh Tokens and Windows Hello keys Read at the source ↗
dirkjanm.io
https://learn.microsoft.com/en-us/entra/identity/devices/protecting-tokens-microsoft-entra-id
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-application-permissions
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant
learn.microsoft.com
https://www.paloaltonetworks.com/blog/security-operations/detecting-threats-with-microsoft-graph-activity-logs/
paloaltonetworks.com
https://urldefense.proofpoint.com/v2/url?u=https-3A__portal.azure.com_-23view_Microsoft-5FAAD-5FIAM_SecurityMenuBlade_-7E_RiskySignIns&d=DwMGaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=_lIJbiuLEsecGC88yMz56rH6l-Y5OB28uwt-Y9Xz4rE&m=4-qQhuKma8thzIZvlSLW8DmApFbwqnw0UZEso5tA_83yeyvOrEPIR7y-_WpUu-_w&s=WeVUppuI_j-zNq3KVx0nI6zG4QDE6YrFfDMfZIoGeM0&e=
urldefense.proofpoint.com
https://urldefense.proofpoint.com/v2/url?u=https-3A__portal.azure.com_-23view_Microsoft-5FAAD-5FIAM_SecurityMenuBlade_-7E_RiskyUsers&d=DwMGaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=_lIJbiuLEsecGC88yMz56rH6l-Y5OB28uwt-Y9Xz4rE&m=4-qQhuKma8thzIZvlSLW8DmApFbwqnw0UZEso5tA_83yeyvOrEPIR7y-_WpUu-_w&s=CGePElKdqJQaLd4nVEmz6BKuHlgvB4LRKDdiCUgV7ag&e=
urldefense.proofpoint.com
https://docs-cortex.paloaltonetworks.com/r/Cortex-CLOUD/Cortex-Cloud-Runtime-Security-Documentation/Endpoint-protection
docs-cortex.paloaltonetworks.com
https://www.paloaltonetworks.com/blog/cloud-security/visibility-governance-automation/
paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/p/XDR
docs-cortex.paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/p/XSIAM
docs-cortex.paloaltonetworks.com
https://www.paloaltonetworks.com/resources/techbriefs/identity-threat-detection-and-response-module
paloaltonetworks.com
https://www.paloaltonetworks.com/unit42/assess/cloud-security-assessment
paloaltonetworks.com
https://www.cyberthreatalliance.org
cyberthreatalliance.org
https://techcommunity.microsoft.com/blog/microsoft-entra-blog/important-update-azure-ad-graph-retirement/4364990
techcommunity.microsoft.com
https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/devices/concept-primary-refresh-token
learn.microsoft.com