AzureHound Community Edition Flags

AzureHound Community Edition has several optional flags that let you control scan scope, performance, output, and other behaviors.

Enumeration Commands and Options

list

The `list` command tells AzureHound to read all possible information from AzureAD and AzureRM. You can optionally limit the scope of what data AzureHound will collect by providing a scope option after the “list” command:

These are the most common options you’ll likely use:

• az-ad: Collect all information available at the AzureAD tenant level. In most tenants, all users can read all this information by default.
• az-rm: Collect all information available at the AzureRM subscription level. Users cannot read this by default.

You can also scope the collection to particular object types:

• apps Collects AzureAD application registration objects.
• devices Collects AzureAD devices regardless of join type.
• groups Collects AzureAD security-enabled groups, both role- and non-role-eligible.
• key-vaults Collects AzureRM key vaults.
• management-groups Collects AzureRM management group objects
• resource-groups Collects AzureRM resource group objects
• roles Collects AzureAD admin role objects
• service-principals Collects AzureAD service principals
• subscriptions Collects AzureRM subscriptions
• tenants Collects AzureAD tenant objects
• users Collects AzureAD users, including any guest users in the target tenant.
• virtual-machines Collects AzureRM virtual machines

You can even further scope collection to particular abuses against each object type. Here are a few examples:

• app-owners Collects explicitly set owners of AzureAD application registration objects
• management-group-user-access-admins Collects any principal with the User Access Admin role against any management group
• virtual-machine-avere-contributors Collects any principal with the Avere Contributor role assignment against any virtual machine

Authentication Flags

AzureHound supports several authentication options. You can control how AzureHound authenticates by using command line flags or the configuration file. Some flags should always be used together and are presented here in the context of their authentication use cases:

Authenticating with Username and Password

• -u or --username - The user principal name of the AzureAD user you wish to authenticate as. UPN format is “[e-mail]”
• -p or --password - The clear-text password of the AzureAD user.
• -t or --tenant - The directory tenant to authenticate to (GUID or friendly name format).

Example:

./azurehound -u "[e-mail]" -p "MyVerySecurePassword123" --tenant "contoso.onmicrosoft.com" list

You can skip proving the password on the command line, and AzureHound will interactively prompt you for the password instead.

Authenticating with Service Principal Secret

• -a or --app - The Application (client) ID that the Azure app registration portal assigned when the app was registered.
• -s or --secret - The Application Secret generated for the app in the app registration portal.
• -t or --tenant - The directory tenant to authenticate to (GUID or friendly name format).

Example:

./azurehound -a "6b5adee8-0d36-45b6-b393-8f29ae8a8cc8" -s "<secret>" --tenant "contoso.onmicrosoft.com" list

Authenticating with Service Principal Certificate

• -a or --app - The Application (client) ID that the Azure app registration portal assigned when the app was registered.
• --cert - The path to the certificate uploaded to the app registration portal (PEM format).
• -k or --key - The path to the private key file for the certificate (PEM format).
• --keypass (optional) - The passphrase to use if the private key is encrypted.
• -t or --tenant - The directory tenant to authenticate to (GUID or friendly name format).

Example:

./azurehound -a "6b5adee8-0d36-45b6-b393-8f29ae8a8cc8" --cert ./certificate.pem --key ./key.pem --tenant "contoso.onmicrosoft.com" list

Authenticating with Azure Managed Identity

• --managed-identity - Use Azure Managed Identity to authenticate. Use this when running AzureHound on an Azure resource (VM, App Service, etc.) with a managed identity assigned.
• --managed-identity-client-id (optional) - Client ID of a user-assigned managed identity. If not provided, uses system-assigned identity.
• -t or --tenant - The directory tenant to authenticate to (GUID or friendly name format).

Example (system-assigned):

./azurehound --managed-identity --tenant "contoso.onmicrosoft.com" list

Example (user-assigned):

./azurehound --managed-identity --managed-identity-client-id "6b5adee8-0d36-45b6-b393-8f29ae8a8cc8" --tenant "contoso.onmicrosoft.com" list

Authenticating with a JWT

• -j or --jwt - An MS Graph or AzureRM scoped JWT. These JWTs last a maximum of 90 minutes, so you may need to get a new JWT to enumerate data with AzureHound later.

Example:

./azurehound -j "ey..." list az-ad

Authenticating with a Refresh Token

• -r or --refresh-token - A refresh token. AzureHound will automatically exchange this for an appropriately scoped JWT when accessing the MS Graph and AzureRM APIs.
• -t or --tenant - The directory tenant to authenticate to (GUID or friendly name format).

Example:

./azurehound -r "0.ARwA6Wg..." --tenant "contoso.onmicrosoft.com" list

Additional Scoping and Output Flags

• -b - Filter by one or more subscription IDs. AzureHound will automatically dedupe this list for you.
• -m - Filter by one or more management group IDs. AzureHound will automatically dedupe all descendant management groups and subscriptions for you.
• -o or --output - Instructs AzureHound to write its output to a specified file name. Accepts either a bare filename (azurehound.json, written to the current working directory) or an absolute path (~/azurehound.json).
• --log-file - Write logs to the specified file. Accepts either a bare filename (log.txt, written to the current working directory) or an absolute path (~/azurehound.log).
• --json - Emit logs as structured JSON instead of the default line-based format. Requires --log-file to be set.
• -v or --verbosity - AzureHound verbosity level (defaults to 0), a higher value gives more verbosity [Min: -1, Max: 2]
• --version - Print the AzureHound version and exit.

Custom User-Agent

-U or --user-agent - Set a custom User-Agent header for all HTTP requests. This can be useful for evasion purposes or for debugging and identification. If not specified, AzureHound uses the default User-Agent value.

Example:

./azurehound list --tenant "contoso.onmicrosoft.com" -u "[e-mail]" -p "MyVerySecurePassword123" --user-agent "MyCustomAgent/1.0"