Introducing GraphRunner: A Post-Exploitation Toolset for Microsoft 365

The report unveils GraphRunner, a post-compromise toolkit that leverages Microsoft Graph API to perform reconnaissance, persistence, and data collection across Microsoft 365 (email, SharePoint/OneDrive, Teams, users, groups, and conditional access). It details modules for token handling, app injection, mailbox and file search, group cloning/abuse, and OAuth flow automation; presents attack paths such as dynamic and updatable group privilege escalation, internal OAuth consent phishing, and a SharePoint unmanaged-device download bypass via Immersive Reader; and offers a lightweight GUI and defensive considerations.