AzureHound
AzureHound is an open-source, Go-based data collection tool in the BloodHound suite, originally intended for penetration testing. It is used to enumerate Microsoft Entra ID and Azure environments via the Microsoft Graph API and Azure REST API, export the results to JSON, and map relationships and potential privilege-escalation paths in BloodHound. It is available precompiled for Windows, Linux, and macOS, and does not need to run inside the victim environment because the relevant cloud APIs are externally accessible.
Observed capabilities in the provided content include account and identity discovery; enumeration of users, devices, service principals, groups, roles, role assignments, app role assignments, subscriptions, tenants, management groups, resource groups, virtual machines, key vaults, storage accounts and containers, web apps, function apps, logic apps, automation accounts, managed clusters, VM scale sets, and container registries. The content states AzureHound can reveal details such as user attributes, privileged roles, key vault access policies, storage configuration, network ACLs, and cloud infrastructure relationships that attackers can use to identify high-value accounts, exfiltration targets, and escalation paths.
The content describes AzureHound as a legitimate tool that is abused by threat actors for post-compromise discovery in Microsoft cloud environments. Reported misuse includes reconnaissance in Microsoft Entra ID and Azure after successful access to a tenant. Public reporting cited in the content links AzureHound use to Iranian-backed Curious Serpens / Peach Sandstorm, Microsoft-tracked Void Blizzard, and Storm-0501. Microsoft observed Peach Sandstorm using AzureHound for reconnaissance in Microsoft Entra ID and Azure Resource Manager via Microsoft Graph and Azure REST APIs after successful authentication, in campaigns targeting sectors including satellite, defense, and pharmaceutical organizations; separate reporting in the content also notes Curious Serpens / Peach Sandstorm targeting aerospace, defense, and energy sectors.
Detection-relevant details directly mentioned in the content include a default user-agent format of "azurehound/<version>" and detections that look for BloodHound-suite user agents across Entra ID and Microsoft 365. The content also notes that Microsoft Graph activity logs can expose many AzureHound requests, while some Azure REST API ARM read/list operations used by AzureHound may not appear in standard Azure activity logs, creating a visibility gap.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
AzureHound is a data collection tool intended for penetration testing that is part of the BloodHound suite. Threat actors misuse this tool to enumerate Azure resources and map potential attack paths, enabling further malicious operations.
AzureHound is a data collection tool intended for penetration testing that is part of the BloodHound suite. Threat actors misuse this tool to enumerate Azure resources and map potential attack paths, enabling further malicious operations.
AzureHound is a data collection tool intended for penetration testing that is part of the BloodHound suite. Threat actors misuse this tool to enumerate Azure resources and map potential attack paths, enabling further malicious operations.
AzureHound is a data collection tool intended for penetration testing that is part of the BloodHound suite. Threat actors misuse this tool to enumerate Azure resources and map potential attack paths, enabling further malicious operations.
Abuse of AzureHound in the Wild — ...leveraged a Go-based open-source data collection tool called AzureHound... enumerate Azure resources and map potential attack paths...
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Threat actors also run the tool after obtaining initial access to the victim environment... AzureHound supports multiple means of authentication, including: Username and password Refresh tokens JSON web tokens (JWT) Service principal secrets Service principal certificates... Threat actors will use whatever means of authentication is available.
Execution
1 technique
Execution
Persistence
2 techniques
Persistence
Threat actors also run the tool after obtaining initial access to the victim environment... AzureHound supports multiple means of authentication, including: Username and password Refresh tokens JSON web tokens (JWT) Service principal secrets Service principal certificates... Threat actors will use whatever means of authentication is available.
Privilege Escalation
1 technique
Privilege Escalation
Threat actors also run the tool after obtaining initial access to the victim environment... AzureHound supports multiple means of authentication, including: Username and password Refresh tokens JSON web tokens (JWT) Service principal secrets Service principal certificates... Threat actors will use whatever means of authentication is available.
Stealth
1 technique
Stealth
Threat actors also run the tool after obtaining initial access to the victim environment... AzureHound supports multiple means of authentication, including: Username and password Refresh tokens JSON web tokens (JWT) Service principal secrets Service principal certificates... Threat actors will use whatever means of authentication is available.
Credential Access
2 techniques
Credential Access
Discovery
13 techniques
Discovery
"AD Explorer for Active Directory environment mapping"; "AzureHound and Roadtools for Azure AD reconnaissance"
The threat actor has also in some cases enumerated the compromised organization's Microsoft Entra ID configuration using the publicly available AzureHound tool to gain information about the users, roles, groups, applications, and devices belonging to that tenant.
Detect AzureHound Command-Line Arguments ... Local Groups ... Detect SharpHound Usage ... Local Groups ... Group Discovery Via Net ... Local Groups
Detect AzureHound Command-Line Arguments ... Domain Groups ... Detect SharpHound Usage ... Domain Groups ... Group Discovery Via Net ... Domain Groups
T1069.003: Permission Groups Discovery: Cloud Groups Once threat actors know the identities within the target environment, they need to understand the relationships between the identities by discovering permission structures... For Permissions Groups Discovery: Cloud Accounts, AzureHound has the following capabilities: list groups list roles list group-members list group-owners list role-assignments list app-role-assignments list key-vault-access-policies list management-group-role-assignments list resource-group-role-assignments list subscription-role-assignments list virtual-machine-role-assignments
Tokens are needed not only for manual enumeration via APIs but also for tools like AzureHound or GraphRunner, which require a valid refresh token.
Detect AzureHound Command-Line Arguments ... Local Account ... Detect SharpHound Usage ... Local Account ... Windows SOAPHound Binary Execution ... Local Account
Step 2 - Reconnaissance T1087.002, T1482, T1518.001, T1057, T1082 | Affiliate Domain enumeration via obfuscated ADRecon.ps1, nltest, net group, tasklist, sc query.
T1087.004: Account Discovery: Cloud To establish a foundational understanding of the target environment, a threat actor might first locate the identities operating within it... AzureHound parameters that facilitate the MITRE technique Account Discovery: Cloud Account include the following: list users list devices list device-owners list service-principals list service-principal-owners
Detect AzureHound Command-Line Arguments ... Domain Trust Discovery ... Detect SharpHound Usage ... Domain Trust Discovery ... Windows SOAPHound Binary Execution ... Domain Trust Discovery
T1526: Cloud Service Discovery Beyond storage and identities, an actor will seek to understand what platform services are in use... For Cloud Service Discovery, AzureHound has the following capabilities: list apps list web-apps list function-apps list logic-apps list automation-accounts list managed-clusters list vm-scale-sets list container-registries
T1580: Cloud Infrastructure Discovery To fully grasp the architecture of the target environment, a threat actor must discover the foundational infrastructure components... For Cloud Infrastructure Discovery, AzureHound has the following capabilities: list tenants list subscriptions list resource-groups list management-groups list virtual-machines list key-vaults
T1619: Cloud Storage Object Discovery A primary objective for many threat actors is data exfiltration, making it critical to identify where data is stored... AzureHound has two options for storage object discovery, covering both Azure storage accounts and containers: list storage-accounts list storage-containers
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Open-source Azure/Entra ID data collection tool (part of the BloodHound ecosystem) used post-compromise to enumerate identities, roles, resources, and relationships to map privilege-escalation paths and facilitate lateral movement in Azure environments.
Go-based Azure enumeration/attack-path mapping tool abused post-compromise to identify misconfigurations and privilege-escalation paths in Azure environments.
Open-source Azure/Entra ID enumeration tool in the BloodHound ecosystem. It uses Microsoft Graph and Azure REST APIs to collect identities, roles, groups, permissions, storage, applications and infrastructure data, helping operators map privilege-escalation and lateral-movement paths in cloud environments.
Reconnaissance tool used to collect and dump data from Microsoft Entra ID (Azure AD) environments.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.