Microsoft Entra Authcode Flow BOF

A Beacon Object File (BOF) to obtain Microsoft Entra tokens via authcode flow.

Usage

Compile with make and import the entra-authcode-flow.cna aggressor to Cobalt Strike.

beacon> help entra-authcode-flow
beacon> entra-authcode-flow <clientid> <scope> <browser> [opt: email-hint]

References

• Blog post Obtaining Microsoft Entra Refresh Tokens via Beacon
• Original get_azure_token BOF by freefirex from TrustedSec Remote Ops repo
• Family of client IDs research by Secureworks
• First-party scopes - Dirk-Jan