azure-redteam-email

Use this OPTIONAL skill to assess Microsoft 365 email security during a red team engagement when Exchange Online / M365 is in scope. Covers email authentication (SPF, DKIM, DMARC) via DNS, Exchange Online Protection and Microsoft Defender for Office 365 policies (anti-phishing, anti-spoofing, Safe Links, Safe Attachments), and risky mail-flow / transport rules. Trigger when assessing email spoofing risk, SPF/DKIM/DMARC posture, phishing defenses, or Exchange Online mail security. Requires Microsoft Graph / Exchange Online read permissions.

跳到安装

仓库: Contoso-State/red-team-agent-orchestration
最近来源活动: 2026年6月17日 15:15
检测到的 SKILL.md 语言: 英语
星标: 6
分支: 1

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/Contoso-State/red-team-agent-orchestration --skill azure-redteam-email

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

azure-redteam-orchestrator

Use this skill when the user wants to run, coordinate, or manage an Azure cloud security penetration test or red team assessment against an Azure environment. This is the "Pentest Manager" that validates engagement scope, spins up the specialist red team, assigns reconnaissance and assessment tasks, and aggregates findings into a report. Engagements are single-subscription per run. Trigger on requests like "pentest my Azure environment", "run a red team assessment", "find security vulnerabilities in my Azure subscription", or "coordinate an Azure security assessment".

2026-08-03

azure-redteam-ai

Use this skill to assess Azure AI and machine-learning security during a red team engagement. Covers Azure AI Foundry (hubs, projects, connections), Azure OpenAI, Azure AI Services / Cognitive Services, and Azure Machine Learning workspaces. Finds public network access on AI endpoints, key-based auth instead of managed identity, disabled content/abuse filtering, exposed model deployments, over-privileged AI managed identities, and AI-to-data connections that expose grounding data. Trigger when assessing Azure OpenAI, AI Foundry, Cognitive Services, AI Search grounding, or Azure ML security.

2026-06-17

azure-redteam-aks-container

Use this skill to assess Azure container and Kubernetes security during a red team engagement. Owns AKS, Azure Container Registry (ACR), Container Apps, and Container Instances. Finds public API servers, local-admin kubeconfig, missing Entra/Azure RBAC for Kubernetes, no network policy, Pod Security Admission gaps, in-cluster cluster-admin RBAC sprawl, node managed-identity exposure via IMDS, registry admin-user and anonymous pull, missing content trust, and vulnerable container images. Read-only by default, with a hard-gated cluster-active lane (kube-bench/kubesec, offline trivy/grype image scanning, and benign read-only in-pod inventory) that scans inside a live cluster only under mode cluster-active-testing. Trigger when assessing AKS clusters, Kubernetes security, container images, ACR, or running-container vulnerabilities in Azure.

2026-06-17

查看这个仓库的全部 Skills

name

azure-redteam-email

description

Azure Red Team — Email Security (Optional, Microsoft 365)

You assess whether the organization's email can be spoofed and whether inbound phishing is stopped. This is the Microsoft 365 / Exchange Online surface — adjacent to Azure but distinct — covering domain authentication and the EOP / Defender for Office 365 policy stack.

Scope note: Only run when engagement.yaml includes M365 / Exchange Online and the caller has Microsoft Graph / Exchange Online read access. This is not part of a baseline Azure assessment.

Full methodology: agents/email-security/system-prompt.md. Checks: checks/email/checks.yaml. Runner: tools/az-cli/email.md — DNS lookups + Microsoft Graph (az rest GET) / Exchange Online Get-* cmdlets.

What You Hunt

SPF: missing record, +all/?all (permissive), or no SPF at all — enables sender spoofing.
DMARC: missing record, policy p=none (monitor-only), or no aggregate reporting — spoofed mail is not rejected/quarantined.
DKIM: signing not enabled for accepted domains; weak (1024-bit) keys.
Anti-phishing (Defender for Office 365): no anti-phishing policy, spoof intelligence off, mailbox/impersonation protection disabled.
Safe Links / Safe Attachments: disabled or not applied to all users.
Connection filtering / EOP: permissive allow-lists, IP allow-lists bypassing spam filtering.
Mail-flow / transport rules: rules that bypass spam filtering, auto-forward externally, or whitelist senders/domains broadly (data-exfil and phishing-bypass risk).

How You Work

Enumerate accepted domains (Graph GET /domains).
For each domain, resolve SPF (TXT), DMARC (_dmarc.<domain> TXT), and DKIM selector records via DNS.
Read EOP / Defender for Office 365 policy posture via Microsoft Graph security/policy endpoints (or Exchange Online PowerShell Get-AntiPhishPolicy, Get-SafeLinksPolicy, etc. where available).
Review transport rules for external auto-forward and filter-bypass.
Emit findings to engagements/<session>/findings/raw/email-security.jsonl, ID prefix AZ-MAIL-.

Tools

DNS resolution (nslookup / dig), az rest (GET) against Microsoft Graph, and Exchange Online PowerShell Get-* cmdlets (read-only) when the module is connected.

Safety

Read-only. DNS and Get-*/GET reads only. Never send test/phishing email, never modify policies or transport rules, never read message contents. Honor data_handling redaction for domains and addresses.

azure-redteam-email

来源信息

安装方式

检查来源文件

同仓库更多 Skills

同仓库更多 Skills

Azure Red Team — Email Security (Optional, Microsoft 365)

What You Hunt

How You Work

Tools

Safety

Azure Red Team — Email Security (Optional, Microsoft 365)

What You Hunt

How You Work

Tools

Safety