Paved With Intent: ROADtools and Nation-State Tactics in the Cloud

This Palo Alto Networks Unit 42 report analyzes ROADtools, an open-source Python framework used to enumerate Entra ID, register devices, and perform token acquisition/exchange; it documents how attackers (including nation-state actors) have operationalized ROADtools for discovery, persistence (device registration and PRT misuse), and defense evasion via legitimate Microsoft APIs, and provides MITRE ATT&CK mappings, detection hunts, indicators (user-agent patterns), and mitigation recommendations.