The Triforce of Initial Access

This report outlines a modern offensive workflow targeting Microsoft Entra ID/Office 365: using Evilginx to capture session cookies and bypass MFA, ROADtools to convert cookies into JWT/access-refresh tokens and pivot between resources, and TeamFiltration (with the Bobber automation script) to automate exfiltration of emails, Teams chats, OneDrive and SharePoint files. The document also provides PowerShell examples for leveraging the .roadtools_auth output with various post-exploitation tools (AADInternals, AzureHound, GraphRunner, Power-Pwn) to maximize data collection.