CyberStrike doesn’t scan Azure: it operates on it. Azurehook is the deterministic execution layer behind CyberStrike’s cloud domain: 154 programs that enumerate, extract, escalate, persist, move laterally, evade detection, exfiltrate data, and audit compliance, all through the Azure REST API, Microsoft Graph, and IMDS. No third-party scanners, no CSPM dashboards. The same APIs an attacker would use, wrapped in structured tooling an AI agent can drive.
What it covers
154 programs across 13 attack categories:
| Category | # | Examples |
|---|---|---|
| Recon | 47 | Subscriptions, Entra ID, RBAC, VMs, AKS, NSGs, DNS, ACR, Databricks, IoT Hub, Sentinel, 35+ more |
| Credential | 14 | Key Vault secrets, IMDS tokens, managed identity, FOCI token abuse, storage keys, kubeconfig |
| Privilege escalation | 11 | Entra privesc, PIM abuse, Global Admin elevation, custom role exploit, deployment abuse |
| Persistence | 11 | Runbook/Logic App/Function App backdoors, SP secrets, VM extensions, Lighthouse delegation |
| Lateral movement | 10 | VM Run Command, Bastion tunnels, Arc execution, DevOps service connections, Intune deploy |
| Evasion | 11 | Sentinel suppress, Defender disable, activity log tamper, WAF bypass, NSG flow log disable |
| Exfiltration | 12 | Blob/Cosmos/Data Lake dump, Service Bus sniff, Event Hub tap, Graph mail, Teams, SharePoint |
| Compliance | 18 | CIS-aligned: Defender plans, SQL audit, storage security, MFA, Key Vault, resource locks |
| Identity | 10 | Golden SAML, PTA abuse, AADConnect, Seamless SSO, password spray, consent phishing |
| Impact | 5 | Resource hijack, data destruction, ransomware sim, assessment-only by default |
| M365 | 4 | Exchange, SharePoint, Teams, OneDrive |
| Cleanup | 1 | Remove everything CyberStrike created |
How it works
One tool call, one program. An agent (or a human) calls azurehook with a program name and arguments (keyvault_dump, nsg_audit, entra_privesc) and gets back structured findings with severity, CWE mapping, and evidence. Every finding carries a unique ID (like AZ-KV-001 or AZ-PIM-002) mapped to a CWE entry, so results are traceable to industry taxonomy from the start.
The meta-program azure_assess launches 65+ recon and compliance programs in parallel with concurrency control, retry, and a circuit breaker. One call produces a full Layer 1 picture of the environment.
What makes it different
It’s an offensive toolkit, not a compliance checker. Recon and compliance are just the foundation. The other 89 programs cover credential theft, privilege escalation, persistence, lateral movement, evasion, and exfiltration, the full MITRE ATT&CK kill chain for Azure. A CSPM tells you a storage account is public; azurehook dumps it, checks whether the keys rotate, and tests whether a managed identity on the same subnet can reach it.
It’s deterministic. No model involved. Every program runs the same way every time: repeatable, auditable, fast. The AI comes in Layer 2, where 9 specialist agents analyze what azurehook found, verify findings, and chase cross-group attack paths. The split is deliberate: azurehook guarantees breadth; the agents bring judgment.
It’s safe by default. The five destructive programs (resource hijack, data destruction, ransomware simulation, service disruption, VM disk download) run in assessment/dry-run mode unless explicitly armed with execute: true. Cleanup is enforced: agents are instructed to always run cleanup_azure before ending a session.
It hits three API planes. ARM for resource enumeration and config. Microsoft Graph for Entra ID, Conditional Access, PIM, Intune, and M365. IMDS for managed identity tokens and VM metadata. The programs go where the attack surface lives.
Part of the @cyberstrike-io/azure package. Auth: Azure CLI or managed identity. For the full two-layer architecture, see Azure cloud security testing: a capabilities reference; for the AWS equivalent, see Awshook: 173 programs for AWS offense.
