dafthack/GraphRunner

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1333 stars · 169 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

GraphRunner is a post-exploitation toolset for interacting with the Microsoft Graph API, written in PowerShell. It enables reconnaissance, persistence, and data pillaging against Microsoft Entra ID (Azure AD) accounts using authenticated access tokens.

Use cases

• search and export a compromised user's email, OneDrive, and SharePoint files
• dump Teams chats and channels from an account with a stolen token
• enumerate app registrations and conditional access policies in a tenant
• find modifiable security groups and misconfigured mailboxes during red team engagements
• harvest OAuth authorization codes during consent grant attacks
• maintain persistence by refreshing token packages and deploying malicious apps

When to choose

• you are doing authorized post-exploitation or red team work against Microsoft 365 / Entra ID
• you need a dependency-free PowerShell toolset that works on Windows and Linux
• you want both a CLI and an HTML GUI for pillaging an account via Graph API tokens

When to avoid

• you need a defensive auditing or compliance tool rather than offensive tradecraft
• your target is not Microsoft Graph / Entra ID
• you require stealth features or C2 integration beyond token-based Graph interaction

Facets

cli-tool · maturity active

security http-client cli security penetration-testing windows cli post-exploitation microsoft-graph azure-ad entra-id red-team offensive-security oauth reconnaissance powershell linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="dafthack/GraphRunner")