Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Cloud Discovery With Azure Hound

Summary: AzureHound is an open-source Go tool in the BloodHound suite that uses the Microsoft Graph and Azure REST APIs to enumerate Entra ID and Azure environments, writing output to JSON files that BloodHound ingests to map attack paths. Unit 42 notes threat actors run it after initial access to discover identities, permission structures and storage accounts, and that activity with the tool continued as recently as August 2025.

Key Takeaway: AzureHound needs no foothold inside the victim environment because both APIs are reachable externally, so a stolen token or infostealer-harvested session is enough to enumerate every user, role assignment and storage account in the tenant.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026