GraphRunner Cheatsheet

This cheatsheet documents GraphRunner, a collection of post-exploitation PowerShell modules for interacting with Microsoft Graph and Microsoft 365. It provides installation steps, methods for obtaining and refreshing access tokens, modules for reconnaissance (users, groups, conditional access, apps), capabilities to search mail/Teams/SharePoint/OneDrive for sensitive data, techniques to modify or clone groups for privilege escalation, and an OAuth app injection workflow to achieve persistent delegated access; it is a tool and techniques reference rather than an incident report.