[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DNG2XVST1CE3P1Z4D3N17":3,"skill-same:01M71DNG2XVST1CE3P1Z4D3N17":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":14,"repositoryHtmlUrl":64,"repositoryHomepageUrl":6,"ownerHtmlUrl":65,"ownerBlogUrl":6,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M71DNG2XVST1CE3P1Z4D3N17","mfa-passwordless-exploit",null,"Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Activates for requests involving passwordless deployment, FIDO2 passkey configuration, phishing-resistant MFA, or Microsoft Entra authentication method policies.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fmfa\u002Fpasswordless\u002Fexploit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"mfa passwordless exploit","exploit","mfa","passwordless","security","certificate","hello","read","passkeys","FIDO2","passkey","Bash","access","cybersecurity","entra id","authentication","t1566","phishing-resistant-MFA","Windows-Hello","Microsoft-Entra","2026-11-10 10:12:30",false,"---\nname: mfa-passwordless-exploit\ndescription: Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Activates for requests involving passwordless deployment, FIDO2 passkey configuration, phishing-resistant MFA, or Microsoft Entra authentication method policies.\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- passwordless\n- FIDO2\n- passkeys\n- Microsoft-Entra\n- Windows-Hello\n- phishing-resistant-MFA\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1003\n- T1566\ncapec: []\n---\n\n# Implementing Passwordless Auth with Microsoft Entra\n\n## When to Use\n\n- Organization wants to eliminate password-based attacks (phishing, credential stuffing, brute force)\n- Regulatory or internal mandate requires phishing-resistant MFA (Executive Order 14028, CISA guidance)\n- Deploying FIDO2 security keys or Windows Hello for Business across the enterprise\n- Migrating from legacy MFA (SMS, phone call) to phishing-resistant authentication methods\n- Implementing passkey support for hybrid or cloud-joined Windows devices\n- Reducing helpdesk costs from password reset requests\n\n**Do not use** for environments that cannot support modern authentication protocols; legacy applications using NTLM or basic authentication must be migrated first.\n\n## Prerequisites\n\n- Microsoft Entra ID P1 or P2 license (Azure AD Premium)\n- Windows 10\u002F11 22H2+ for Windows Hello for Business deployment\n- FIDO2-compliant security keys (YubiKey 5 Series, Feitian BioPass, Google Titan)\n- Microsoft Authenticator app 6.8+ for passkey support on iOS 16+\u002FAndroid 14+\n- Hybrid Azure AD join or Azure AD join configured for Windows devices\n- Conditional Access policies configured for authentication strength\n\n## Workflow\n\n### Step 1: Configure Authentication Methods Policy\n\nEnable passwordless authentication methods in Microsoft Entra:\n\n```powershell\n# Connect to Microsoft Graph\nConnect-MgGraph -Scopes \"Policy.ReadWrite.AuthenticationMethod\", \"User.ReadWrite.All\"\n\n# Enable FIDO2 Security Key authentication method\n$fido2Policy = @{\n    \"@odata.type\" = \"#microsoft.graph.fido2AuthenticationMethodConfiguration\"\n    state = \"enabled\"\n    isAttestationEnforced = $true\n    isSelfServiceRegistrationAllowed = $true\n    keyRestrictions = @{\n        isEnforced = $true\n        enforcementType = \"allow\"\n        aaGuids = @(\n            \"cb69481e-8ff7-4039-93ec-0a2729a154a8\",  # YubiKey 5 Series\n            \"ee882879-721c-4913-9775-3dfcce97072a\",  # YubiKey 5 NFC\n            \"fa2b99dc-9e39-4257-8f92-4a30d23c4118\",  # YubiKey 5C NFC\n            \"2fc0579f-8113-47ea-b116-bb5a8db9202a\",  # YubiKey Bio\n            \"73bb0cd4-e502-49b8-9c6f-b59445bf720b\"   # Google Titan\n        )\n    }\n    includeTargets = @(\n        @{\n            targetType = \"group\"\n            id = \"all_users\"  # Or specific security group ID\n        }\n    )\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"fido2\" `\n    -BodyParameter $fido2Policy\n\n# Enable Microsoft Authenticator with passkey support\n$authenticatorPolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration\"\n    state = \"enabled\"\n    featureSettings = @{\n        displayAppInformationRequiredState = @{\n            state = \"enabled\"\n            includeTarget = @{\n                targetType = \"group\"\n                id = \"all_users\"\n            }\n        }\n        displayLocationInformationRequiredState = @{\n            state = \"enabled\"\n            includeTarget = @{\n                targetType = \"group\"\n                id = \"all_users\"\n            }\n        }\n        companionAppAllowedState = @{\n            state = \"enabled\"\n        }\n    }\n    includeTargets = @(\n        @{\n            targetType = \"group\"\n            id = \"all_users\"\n            authenticationMode = \"any\"\n        }\n    )\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"microsoftAuthenticator\" `\n    -BodyParameter $authenticatorPolicy\n\n# Enable Windows Hello for Business\n$whfbPolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.windowsHelloForBusinessAuthenticationMethodConfiguration\"\n    state = \"enabled\"\n    pinMinimumLength = 6\n    pinMaximumLength = 127\n    pinLowercaseCharactersUsage = \"allowed\"\n    pinUppercaseCharactersUsage = \"allowed\"\n    pinSpecialCharactersUsage = \"allowed\"\n    securityKeyForSignIn = \"enabled\"\n    includeTargets = @(\n        @{\n            targetType = \"group\"\n            id = \"all_users\"\n        }\n    )\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"windowsHelloForBusiness\" `\n    -BodyParameter $whfbPolicy\n\nWrite-Host \"Passwordless authentication methods enabled successfully\"\n```\n\n### Step 2: Configure Authentication Strength Conditional Access\n\nCreate Conditional Access policies requiring phishing-resistant authentication:\n\n```powershell\n# Create custom authentication strength for phishing-resistant MFA\n$authStrength = @{\n    displayName = \"Phishing-Resistant Passwordless\"\n    description = \"Requires FIDO2, WHfB, or certificate-based authentication\"\n    allowedCombinations = @(\n        \"fido2\",\n        \"windowsHelloForBusiness\",\n        \"x509CertificateMultiFactor\"\n    )\n    requirementsSatisfied = \"mfa\"\n}\n$strengthPolicy = New-MgPolicyAuthenticationStrengthPolicy -BodyParameter $authStrength\n\n# Create Conditional Access policy requiring phishing-resistant auth\n$caPolicy = @{\n    displayName = \"Require Phishing-Resistant Auth for All Apps\"\n    state = \"enabledForReportingButNotEnforced\"  # Start in report-only\n    conditions = @{\n        users = @{\n            includeUsers = @(\"All\")\n            excludeGroups = @(\"Passwordless-Exclusion-Group\")\n        }\n        applications = @{\n            includeApplications = @(\"All\")\n        }\n        clientAppTypes = @(\"browser\", \"mobileAppsAndDesktopClients\")\n    }\n    grantControls = @{\n        operator = \"OR\"\n        authenticationStrength = @{\n            id = $strengthPolicy.Id\n        }\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy\n\n# Create stricter policy for admin portals\n$adminPolicy = @{\n    displayName = \"Require Security Key for Admin Access\"\n    state = \"enabled\"\n    conditions = @{\n        users = @{\n            includeRoles = @(\n                \"62e90394-69f5-4237-9190-012177145e10\",  # Global Admin\n                \"194ae4cb-b126-40b2-bd5b-6091b380977d\",  # Security Admin\n                \"f28a1f50-f6e7-4571-818b-6a12f2af6b6c\",  # SharePoint Admin\n                \"29232cdf-9323-42fd-ade2-1d097af3e4de\"   # Exchange Admin\n            )\n        }\n        applications = @{\n            includeApplications = @(\n                \"797f4846-ba00-4fd7-ba43-dac1f8f63013\",  # Azure Portal\n                \"00000006-0000-0ff1-ce00-000000000000\",  # Microsoft 365 Admin\n                \"0000000a-0000-0000-c000-000000000000\"   # Entra Admin Center\n            )\n        }\n    }\n    grantControls = @{\n        operator = \"OR\"\n        authenticationStrength = @{\n            id = $strengthPolicy.Id\n        }\n    }\n    sessionControls = @{\n        signInFrequency = @{\n            value = 4\n            type = \"hours\"\n            isEnabled = $true\n        }\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $adminPolicy\n```\n\n### Step 3: Deploy Windows Hello for Business via Intune\n\nConfigure WHfB deployment through Microsoft Intune MDM:\n\n```powershell\n# Create Windows Hello for Business configuration profile in Intune\n$whfbProfile = @{\n    \"@odata.type\" = \"#microsoft.graph.windowsIdentityProtectionConfiguration\"\n    displayName = \"WHfB - Enterprise Deployment\"\n    description = \"Windows Hello for Business configuration for all managed devices\"\n    useSecurityKeyForSignin = $true\n    windowsHelloForBusinessBlocked = $false\n    pinMinimumLength = 6\n    pinMaximumLength = 127\n    pinUppercaseCharactersUsage = \"allowed\"\n    pinLowercaseCharactersUsage = \"allowed\"\n    pinSpecialCharactersUsage = \"allowed\"\n    enhancedAntiSpoofingForFacialFeaturesEnabled = $true\n    pinRecoveryEnabled = $true\n    securityDeviceRequired = $true  # Require TPM\n    unlockWithBiometricsEnabled = $true\n    useCertificatesForOnPremisesAuthEnabled = $true  # For hybrid scenarios\n    # Cloud Kerberos Trust for hybrid join (recommended over key trust)\n    windowsHelloForBusinessAuthenticationMethod = \"cloudKerberosTrust\"\n}\n\n# Create the configuration profile\n$profile = New-MgDeviceManagementDeviceConfiguration -BodyParameter $whfbProfile\n\n# Assign to all Windows devices\n$assignment = @{\n    target = @{\n        \"@odata.type\" = \"#microsoft.graph.allDevicesAssignmentTarget\"\n    }\n}\nNew-MgDeviceManagementDeviceConfigurationAssignment `\n    -DeviceConfigurationId $profile.Id `\n    -BodyParameter $assignment\n\n# Configure Cloud Kerberos Trust (for hybrid Azure AD joined devices)\n# This eliminates the need for PKI infrastructure\n# Requires Azure AD Kerberos module\n\nImport-Module AzureADHybridAuthenticationManagement\n\n# Create Azure AD Kerberos Server object in on-premises AD\n$domain = \"corp.local\"\n$cloudCredential = Get-Credential -Message \"Enter Azure AD Global Admin credentials\"\n$domainCredential = Get-Credential -Message \"Enter on-premises Domain Admin credentials\"\n\nSet-AzureADKerberosServer `\n    -Domain $domain `\n    -CloudCredential $cloudCredential `\n    -DomainCredential $domainCredential\n\n# Verify Kerberos Server object\nGet-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCredential `\n    -DomainCredential $domainCredential\n\nWrite-Host \"Cloud Kerberos Trust configured for hybrid WHfB deployment\"\n```\n\n### Step 4: Register FIDO2 Security Keys for Users\n\nImplement security key registration workflow:\n\n```powershell\n# Bulk FIDO2 security key registration via Temporary Access Pass\n# Step 1: Issue Temporary Access Pass for key registration\n\nfunction Issue-TemporaryAccessPass {\n    param(\n        [string]$UserId,\n        [int]$LifetimeMinutes = 60,\n        [bool]$IsUsableOnce = $true\n    )\n\n    $tap = @{\n        \"@odata.type\" = \"#microsoft.graph.temporaryAccessPassAuthenticationMethod\"\n        lifetimeInMinutes = $LifetimeMinutes\n        isUsableOnce = $IsUsableOnce\n    }\n\n    $result = New-MgUserAuthenticationTemporaryAccessPassMethod `\n        -UserId $UserId `\n        -BodyParameter $tap\n\n    return @{\n        UserId = $UserId\n        TemporaryAccessPass = $result.TemporaryAccessPass\n        ExpiresAt = $result.CreatedDateTime.AddMinutes($LifetimeMinutes)\n    }\n}\n\n# Bulk issue TAPs for security key registration event\n$registrationUsers = Import-Csv \"security_key_registration_list.csv\"\n\n$tapResults = foreach ($user in $registrationUsers) {\n    $tap = Issue-TemporaryAccessPass -UserId $user.UserPrincipalName\n    [PSCustomObject]@{\n        User = $user.UserPrincipalName\n        TAP = $tap.TemporaryAccessPass\n        Expires = $tap.ExpiresAt\n        KeySerial = $user.AssignedKeySerial\n    }\n}\n\n# Export TAPs for secure distribution to registration team\n$tapResults | Export-Csv \"tap_assignments.csv\" -NoTypeInformation\n\n# Monitor FIDO2 registration progress\nfunction Get-Fido2RegistrationStatus {\n    $allUsers = Get-MgUser -All -Property \"id,userPrincipalName,department\"\n\n    $registrationStatus = foreach ($user in $allUsers) {\n        $methods = Get-MgUserAuthenticationFido2Method -UserId $user.Id\n\n        [PSCustomObject]@{\n            UserPrincipalName = $user.UserPrincipalName\n            Department = $user.Department\n            Fido2KeyCount = $methods.Count\n            KeyModels = ($methods.Model -join \", \")\n            RegistrationDates = ($methods.CreatedDateTime -join \", \")\n            HasBackupKey = $methods.Count -ge 2\n        }\n    }\n\n    return $registrationStatus\n}\n\n$status = Get-Fido2RegistrationStatus\n$total = $status.Count\n$registered = ($status | Where-Object { $_.Fido2KeyCount -gt 0 }).Count\n$withBackup = ($status | Where-Object { $_.HasBackupKey }).Count\n\nWrite-Host \"FIDO2 Registration Progress\"\nWrite-Host \"  Total Users: $total\"\nWrite-Host \"  Registered:  $registered ($([math]::Round($registered\u002F$total*100,1))%)\"\nWrite-Host \"  With Backup: $withBackup ($([math]::Round($withBackup\u002F$total*100,1))%)\"\n```\n\n### Step 5: Disable Legacy Authentication Methods\n\nPhase out phishable authentication factors:\n\n```powershell\n# Disable SMS and voice call authentication\n$smsPolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.smsAuthenticationMethodConfiguration\"\n    state = \"disabled\"\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"sms\" `\n    -BodyParameter $smsPolicy\n\n$voicePolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.voiceAuthenticationMethodConfiguration\"\n    state = \"disabled\"\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"voice\" `\n    -BodyParameter $voicePolicy\n\n# Block legacy authentication protocols via Conditional Access\n$blockLegacyPolicy = @{\n    displayName = \"Block Legacy Authentication\"\n    state = \"enabled\"\n    conditions = @{\n        users = @{ includeUsers = @(\"All\") }\n        applications = @{ includeApplications = @(\"All\") }\n        clientAppTypes = @(\n            \"exchangeActiveSync\",\n            \"other\"\n        )\n    }\n    grantControls = @{\n        operator = \"OR\"\n        builtInControls = @(\"block\")\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $blockLegacyPolicy\n\n# Audit users still using legacy authentication\n$legacyAuthReport = Get-MgAuditLogSignIn -Filter \"clientAppUsed ne 'Browser' and clientAppUsed ne 'Mobile Apps and Desktop clients'\" `\n    -Top 1000 | Group-Object userPrincipalName | Select-Object Count, Name |\n    Sort-Object Count -Descending\n\nWrite-Host \"Users with Legacy Auth (last 30 days):\"\n$legacyAuthReport | Format-Table -AutoSize\n```\n\n### Step 6: Monitor Passwordless Adoption Metrics\n\nTrack deployment progress and authentication method usage:\n\n```powershell\n# Generate passwordless adoption dashboard data\nfunction Get-PasswordlessAdoptionMetrics {\n    # Authentication method registration statistics\n    $registrationReport = Get-MgReportAuthenticationMethodUserRegistrationDetail -All\n\n    $metrics = @{\n        TotalUsers = $registrationReport.Count\n        PasswordlessCapable = ($registrationReport | Where-Object { $_.IsPasswordlessCapable }).Count\n        MfaRegistered = ($registrationReport | Where-Object { $_.IsMfaRegistered }).Count\n        Fido2Registered = ($registrationReport | Where-Object { \"fido2\" -in $_.MethodsRegistered }).Count\n        WhfbRegistered = ($registrationReport | Where-Object { \"windowsHelloForBusiness\" -in $_.MethodsRegistered }).Count\n        AuthenticatorRegistered = ($registrationReport | Where-Object { \"microsoftAuthenticator\" -in $_.MethodsRegistered }).Count\n        SmsOnly = ($registrationReport | Where-Object {\n            \"sms\" -in $_.MethodsRegistered -and\n            \"fido2\" -notin $_.MethodsRegistered -and\n            \"windowsHelloForBusiness\" -notin $_.MethodsRegistered\n        }).Count\n    }\n\n    # Authentication method usage from sign-in logs\n    $signInLogs = Get-MgAuditLogSignIn -Top 10000 -Filter \"createdDateTime ge $((Get-Date).AddDays(-30).ToString('yyyy-MM-ddTHH:mm:ssZ'))\"\n\n    $authMethodUsage = $signInLogs |\n        Group-Object { $_.AuthenticationMethodsUsed -join \",\" } |\n        Select-Object Count, Name | Sort-Object Count -Descending\n\n    return @{\n        Registration = $metrics\n        Usage = $authMethodUsage\n    }\n}\n\n$adoption = Get-PasswordlessAdoptionMetrics\n$reg = $adoption.Registration\n\nWrite-Host \"PASSWORDLESS ADOPTION REPORT\"\nWrite-Host \"============================\"\nWrite-Host \"Total Users:              $($reg.TotalUsers)\"\nWrite-Host \"Passwordless Capable:     $($reg.PasswordlessCapable) ($([math]::Round($reg.PasswordlessCapable\u002F$reg.TotalUsers*100,1))%)\"\nWrite-Host \"  FIDO2 Keys:             $($reg.Fido2Registered)\"\nWrite-Host \"  Windows Hello:          $($reg.WhfbRegistered)\"\nWrite-Host \"  Authenticator:          $($reg.AuthenticatorRegistered)\"\nWrite-Host \"MFA Registered:           $($reg.MfaRegistered) ($([math]::Round($reg.MfaRegistered\u002F$reg.TotalUsers*100,1))%)\"\nWrite-Host \"SMS Only (needs upgrade): $($reg.SmsOnly)\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **FIDO2** | Fast Identity Online 2 standard enabling passwordless authentication using public-key cryptography bound to hardware authenticators or platform credentials |\n| **Passkey** | FIDO2 credential that can be device-bound (security key) or synced across devices, providing phishing-resistant authentication without passwords |\n| **Windows Hello for Business** | Windows platform authenticator using PIN, fingerprint, or facial recognition backed by TPM-protected asymmetric keys for passwordless sign-in |\n| **Cloud Kerberos Trust** | Deployment model for hybrid WHfB that uses Azure AD Kerberos to authenticate to on-premises resources without requiring PKI certificate infrastructure |\n| **Temporary Access Pass** | Time-limited passcode issued by admins enabling users to register passwordless methods or recover access when their primary method is unavailable |\n| **Authentication Strength** | Conditional Access capability in Microsoft Entra that specifies which authentication method combinations satisfy MFA requirements for a given policy |\n\n## Tools & Systems\n\n- **Microsoft Entra Admin Center**: Portal for configuring authentication methods, Conditional Access policies, and monitoring sign-in analytics\n- **Microsoft Intune**: MDM\u002FMAM platform for deploying Windows Hello for Business configuration profiles to managed devices\n- **Microsoft Graph API**: Programmatic interface for managing authentication methods, policies, and generating adoption reports\n- **FIDO2 Security Keys**: Hardware authenticators (YubiKey, Feitian, Google Titan) storing cryptographic credentials for phishing-resistant authentication\n\n## Common Scenarios\n\n### Scenario: Enterprise-Wide Passwordless Migration\n\n**Context**: Organization with 5,000 users plans to eliminate passwords within 12 months after experiencing a phishing attack that compromised 47 accounts. Current state: 60% use SMS MFA, 30% use Authenticator app, 10% have no MFA.\n\n**Approach**:\n1. Phase 1 (Month 1-2): Enable FIDO2 and WHfB authentication methods in report-only Conditional Access\n2. Phase 2 (Month 2-3): Deploy WHfB to all managed Windows devices via Intune with Cloud Kerberos Trust\n3. Phase 3 (Month 3-5): Distribute FIDO2 security keys to executives, IT admins, and finance (highest-risk users first)\n4. Phase 4 (Month 5-8): Enable Authenticator passkeys for mobile-primary users and field workers\n5. Phase 5 (Month 8-10): Switch Conditional Access from report-only to enforced for phishing-resistant auth\n6. Phase 6 (Month 10-12): Disable SMS and voice call methods, block legacy authentication protocols\n7. Ongoing: Monitor adoption metrics, issue TAPs for stragglers, maintain break-glass accounts\n\n**Pitfalls**:\n- Not deploying Cloud Kerberos Trust causes WHfB to fail for on-premises resource access in hybrid environments\n- Enforcing passwordless without ensuring all applications support modern authentication breaks access\n- Issuing only one security key per user without a backup creates lockout risk if the key is lost\n- Not configuring Temporary Access Pass as a recovery method before disabling password-based sign-in\n\n## Output Format\n\n```\nPASSWORDLESS AUTHENTICATION DEPLOYMENT REPORT\n================================================\nTenant:            corp.onmicrosoft.com\nUsers:             5,247\nDeployment Phase:  Phase 4 (Authenticator Passkeys)\n\nAUTHENTICATION METHOD REGISTRATION\nPasswordless Capable:    4,103 \u002F 5,247 (78.2%)\n  FIDO2 Security Keys:   892 (17.0%)\n  Windows Hello:          2,847 (54.3%)\n  Authenticator Passkey:  1,234 (23.5%)\n  Certificate-Based:      312 (5.9%)\n\nLEGACY METHOD STATUS\nSMS-Only Users:          387 (7.4%) -- migration in progress\nVoice-Only Users:        0 (disabled)\nNo MFA Users:            42 (0.8%) -- TAPs issued\n\nCONDITIONAL ACCESS\nPhishing-Resistant Policy:  ENFORCED (all users except exclusion group)\nLegacy Auth Block:          ENABLED\nAdmin Portal Policy:        SECURITY KEY REQUIRED\n\nSIGN-IN ANALYTICS (Last 30 Days)\nTotal Sign-Ins:          847,293\n  Passwordless:          623,891 (73.6%)\n  Password + MFA:        198,402 (23.4%)\n  Password Only:         0 (blocked)\n  Legacy Protocol:       0 (blocked)\n\nSECURITY IMPACT\nPhishing Incidents:      0 (down from 47 pre-deployment)\nPassword Reset Tickets:  -82% reduction\nAvg Sign-In Time:        8.2s (passwordless) vs 24.1s (password)\n```\n","# Implementing Passwordless Auth with Microsoft Entra\n\n## When to Use\n\n- Organization wants to eliminate password-based attacks (phishing, credential stuffing, brute force)\n- Regulatory or internal mandate requires phishing-resistant MFA (Executive Order 14028, CISA guidance)\n- Deploying FIDO2 security keys or Windows Hello for Business across the enterprise\n- Migrating from legacy MFA (SMS, phone call) to phishing-resistant authentication methods\n- Implementing passkey support for hybrid or cloud-joined Windows devices\n- Reducing helpdesk costs from password reset requests\n\n**Do not use** for environments that cannot support modern authentication protocols; legacy applications using NTLM or basic authentication must be migrated first.\n\n## Prerequisites\n\n- Microsoft Entra ID P1 or P2 license (Azure AD Premium)\n- Windows 10\u002F11 22H2+ for Windows Hello for Business deployment\n- FIDO2-compliant security keys (YubiKey 5 Series, Feitian BioPass, Google Titan)\n- Microsoft Authenticator app 6.8+ for passkey support on iOS 16+\u002FAndroid 14+\n- Hybrid Azure AD join or Azure AD join configured for Windows devices\n- Conditional Access policies configured for authentication strength\n\n## Workflow\n\n### Step 1: Configure Authentication Methods Policy\n\nEnable passwordless authentication methods in Microsoft Entra:\n\n```powershell\n# Connect to Microsoft Graph\nConnect-MgGraph -Scopes \"Policy.ReadWrite.AuthenticationMethod\", \"User.ReadWrite.All\"\n\n# Enable FIDO2 Security Key authentication method\n$fido2Policy = @{\n    \"@odata.type\" = \"#microsoft.graph.fido2AuthenticationMethodConfiguration\"\n    state = \"enabled\"\n    isAttestationEnforced = $true\n    isSelfServiceRegistrationAllowed = $true\n    keyRestrictions = @{\n        isEnforced = $true\n        enforcementType = \"allow\"\n        aaGuids = @(\n            \"cb69481e-8ff7-4039-93ec-0a2729a154a8\",  # YubiKey 5 Series\n            \"ee882879-721c-4913-9775-3dfcce97072a\",  # YubiKey 5 NFC\n            \"fa2b99dc-9e39-4257-8f92-4a30d23c4118\",  # YubiKey 5C NFC\n            \"2fc0579f-8113-47ea-b116-bb5a8db9202a\",  # YubiKey Bio\n            \"73bb0cd4-e502-49b8-9c6f-b59445bf720b\"   # Google Titan\n        )\n    }\n    includeTargets = @(\n        @{\n            targetType = \"group\"\n            id = \"all_users\"  # Or specific security group ID\n        }\n    )\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"fido2\" `\n    -BodyParameter $fido2Policy\n\n# Enable Microsoft Authenticator with passkey support\n$authenticatorPolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration\"\n    state = \"enabled\"\n    featureSettings = @{\n        displayAppInformationRequiredState = @{\n            state = \"enabled\"\n            includeTarget = @{\n                targetType = \"group\"\n                id = \"all_users\"\n            }\n        }\n        displayLocationInformationRequiredState = @{\n            state = \"enabled\"\n            includeTarget = @{\n                targetType = \"group\"\n                id = \"all_users\"\n            }\n        }\n        companionAppAllowedState = @{\n            state = \"enabled\"\n        }\n    }\n    includeTargets = @(\n        @{\n            targetType = \"group\"\n            id = \"all_users\"\n            authenticationMode = \"any\"\n        }\n    )\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"microsoftAuthenticator\" `\n    -BodyParameter $authenticatorPolicy\n\n# Enable Windows Hello for Business\n$whfbPolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.windowsHelloForBusinessAuthenticationMethodConfiguration\"\n    state = \"enabled\"\n    pinMinimumLength = 6\n    pinMaximumLength = 127\n    pinLowercaseCharactersUsage = \"allowed\"\n    pinUppercaseCharactersUsage = \"allowed\"\n    pinSpecialCharactersUsage = \"allowed\"\n    securityKeyForSignIn = \"enabled\"\n    includeTargets = @(\n        @{\n            targetType = \"group\"\n            id = \"all_users\"\n        }\n    )\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"windowsHelloForBusiness\" `\n    -BodyParameter $whfbPolicy\n\nWrite-Host \"Passwordless authentication methods enabled successfully\"\n```\n\n### Step 2: Configure Authentication Strength Conditional Access\n\nCreate Conditional Access policies requiring phishing-resistant authentication:\n\n```powershell\n# Create custom authentication strength for phishing-resistant MFA\n$authStrength = @{\n    displayName = \"Phishing-Resistant Passwordless\"\n    description = \"Requires FIDO2, WHfB, or certificate-based authentication\"\n    allowedCombinations = @(\n        \"fido2\",\n        \"windowsHelloForBusiness\",\n        \"x509CertificateMultiFactor\"\n    )\n    requirementsSatisfied = \"mfa\"\n}\n$strengthPolicy = New-MgPolicyAuthenticationStrengthPolicy -BodyParameter $authStrength\n\n# Create Conditional Access policy requiring phishing-resistant auth\n$caPolicy = @{\n    displayName = \"Require Phishing-Resistant Auth for All Apps\"\n    state = \"enabledForReportingButNotEnforced\"  # Start in report-only\n    conditions = @{\n        users = @{\n            includeUsers = @(\"All\")\n            excludeGroups = @(\"Passwordless-Exclusion-Group\")\n        }\n        applications = @{\n            includeApplications = @(\"All\")\n        }\n        clientAppTypes = @(\"browser\", \"mobileAppsAndDesktopClients\")\n    }\n    grantControls = @{\n        operator = \"OR\"\n        authenticationStrength = @{\n            id = $strengthPolicy.Id\n        }\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy\n\n# Create stricter policy for admin portals\n$adminPolicy = @{\n    displayName = \"Require Security Key for Admin Access\"\n    state = \"enabled\"\n    conditions = @{\n        users = @{\n            includeRoles = @(\n                \"62e90394-69f5-4237-9190-012177145e10\",  # Global Admin\n                \"194ae4cb-b126-40b2-bd5b-6091b380977d\",  # Security Admin\n                \"f28a1f50-f6e7-4571-818b-6a12f2af6b6c\",  # SharePoint Admin\n                \"29232cdf-9323-42fd-ade2-1d097af3e4de\"   # Exchange Admin\n            )\n        }\n        applications = @{\n            includeApplications = @(\n                \"797f4846-ba00-4fd7-ba43-dac1f8f63013\",  # Azure Portal\n                \"00000006-0000-0ff1-ce00-000000000000\",  # Microsoft 365 Admin\n                \"0000000a-0000-0000-c000-000000000000\"   # Entra Admin Center\n            )\n        }\n    }\n    grantControls = @{\n        operator = \"OR\"\n        authenticationStrength = @{\n            id = $strengthPolicy.Id\n        }\n    }\n    sessionControls = @{\n        signInFrequency = @{\n            value = 4\n            type = \"hours\"\n            isEnabled = $true\n        }\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $adminPolicy\n```\n\n### Step 3: Deploy Windows Hello for Business via Intune\n\nConfigure WHfB deployment through Microsoft Intune MDM:\n\n```powershell\n# Create Windows Hello for Business configuration profile in Intune\n$whfbProfile = @{\n    \"@odata.type\" = \"#microsoft.graph.windowsIdentityProtectionConfiguration\"\n    displayName = \"WHfB - Enterprise Deployment\"\n    description = \"Windows Hello for Business configuration for all managed devices\"\n    useSecurityKeyForSignin = $true\n    windowsHelloForBusinessBlocked = $false\n    pinMinimumLength = 6\n    pinMaximumLength = 127\n    pinUppercaseCharactersUsage = \"allowed\"\n    pinLowercaseCharactersUsage = \"allowed\"\n    pinSpecialCharactersUsage = \"allowed\"\n    enhancedAntiSpoofingForFacialFeaturesEnabled = $true\n    pinRecoveryEnabled = $true\n    securityDeviceRequired = $true  # Require TPM\n    unlockWithBiometricsEnabled = $true\n    useCertificatesForOnPremisesAuthEnabled = $true  # For hybrid scenarios\n    # Cloud Kerberos Trust for hybrid join (recommended over key trust)\n    windowsHelloForBusinessAuthenticationMethod = \"cloudKerberosTrust\"\n}\n\n# Create the configuration profile\n$profile = New-MgDeviceManagementDeviceConfiguration -BodyParameter $whfbProfile\n\n# Assign to all Windows devices\n$assignment = @{\n    target = @{\n        \"@odata.type\" = \"#microsoft.graph.allDevicesAssignmentTarget\"\n    }\n}\nNew-MgDeviceManagementDeviceConfigurationAssignment `\n    -DeviceConfigurationId $profile.Id `\n    -BodyParameter $assignment\n\n# Configure Cloud Kerberos Trust (for hybrid Azure AD joined devices)\n# This eliminates the need for PKI infrastructure\n# Requires Azure AD Kerberos module\n\nImport-Module AzureADHybridAuthenticationManagement\n\n# Create Azure AD Kerberos Server object in on-premises AD\n$domain = \"corp.local\"\n$cloudCredential = Get-Credential -Message \"Enter Azure AD Global Admin credentials\"\n$domainCredential = Get-Credential -Message \"Enter on-premises Domain Admin credentials\"\n\nSet-AzureADKerberosServer `\n    -Domain $domain `\n    -CloudCredential $cloudCredential `\n    -DomainCredential $domainCredential\n\n# Verify Kerberos Server object\nGet-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCredential `\n    -DomainCredential $domainCredential\n\nWrite-Host \"Cloud Kerberos Trust configured for hybrid WHfB deployment\"\n```\n\n### Step 4: Register FIDO2 Security Keys for Users\n\nImplement security key registration workflow:\n\n```powershell\n# Bulk FIDO2 security key registration via Temporary Access Pass\n# Step 1: Issue Temporary Access Pass for key registration\n\nfunction Issue-TemporaryAccessPass {\n    param(\n        [string]$UserId,\n        [int]$LifetimeMinutes = 60,\n        [bool]$IsUsableOnce = $true\n    )\n\n    $tap = @{\n        \"@odata.type\" = \"#microsoft.graph.temporaryAccessPassAuthenticationMethod\"\n        lifetimeInMinutes = $LifetimeMinutes\n        isUsableOnce = $IsUsableOnce\n    }\n\n    $result = New-MgUserAuthenticationTemporaryAccessPassMethod `\n        -UserId $UserId `\n        -BodyParameter $tap\n\n    return @{\n        UserId = $UserId\n        TemporaryAccessPass = $result.TemporaryAccessPass\n        ExpiresAt = $result.CreatedDateTime.AddMinutes($LifetimeMinutes)\n    }\n}\n\n# Bulk issue TAPs for security key registration event\n$registrationUsers = Import-Csv \"security_key_registration_list.csv\"\n\n$tapResults = foreach ($user in $registrationUsers) {\n    $tap = Issue-TemporaryAccessPass -UserId $user.UserPrincipalName\n    [PSCustomObject]@{\n        User = $user.UserPrincipalName\n        TAP = $tap.TemporaryAccessPass\n        Expires = $tap.ExpiresAt\n        KeySerial = $user.AssignedKeySerial\n    }\n}\n\n# Export TAPs for secure distribution to registration team\n$tapResults | Export-Csv \"tap_assignments.csv\" -NoTypeInformation\n\n# Monitor FIDO2 registration progress\nfunction Get-Fido2RegistrationStatus {\n    $allUsers = Get-MgUser -All -Property \"id,userPrincipalName,department\"\n\n    $registrationStatus = foreach ($user in $allUsers) {\n        $methods = Get-MgUserAuthenticationFido2Method -UserId $user.Id\n\n        [PSCustomObject]@{\n            UserPrincipalName = $user.UserPrincipalName\n            Department = $user.Department\n            Fido2KeyCount = $methods.Count\n            KeyModels = ($methods.Model -join \", \")\n            RegistrationDates = ($methods.CreatedDateTime -join \", \")\n            HasBackupKey = $methods.Count -ge 2\n        }\n    }\n\n    return $registrationStatus\n}\n\n$status = Get-Fido2RegistrationStatus\n$total = $status.Count\n$registered = ($status | Where-Object { $_.Fido2KeyCount -gt 0 }).Count\n$withBackup = ($status | Where-Object { $_.HasBackupKey }).Count\n\nWrite-Host \"FIDO2 Registration Progress\"\nWrite-Host \"  Total Users: $total\"\nWrite-Host \"  Registered:  $registered ($([math]::Round($registered\u002F$total*100,1))%)\"\nWrite-Host \"  With Backup: $withBackup ($([math]::Round($withBackup\u002F$total*100,1))%)\"\n```\n\n### Step 5: Disable Legacy Authentication Methods\n\nPhase out phishable authentication factors:\n\n```powershell\n# Disable SMS and voice call authentication\n$smsPolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.smsAuthenticationMethodConfiguration\"\n    state = \"disabled\"\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"sms\" `\n    -BodyParameter $smsPolicy\n\n$voicePolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.voiceAuthenticationMethodConfiguration\"\n    state = \"disabled\"\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"voice\" `\n    -BodyParameter $voicePolicy\n\n# Block legacy authentication protocols via Conditional Access\n$blockLegacyPolicy = @{\n    displayName = \"Block Legacy Authentication\"\n    state = \"enabled\"\n    conditions = @{\n        users = @{ includeUsers = @(\"All\") }\n        applications = @{ includeApplications = @(\"All\") }\n        clientAppTypes = @(\n            \"exchangeActiveSync\",\n            \"other\"\n        )\n    }\n    grantControls = @{\n        operator = \"OR\"\n        builtInControls = @(\"block\")\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $blockLegacyPolicy\n\n# Audit users still using legacy authentication\n$legacyAuthReport = Get-MgAuditLogSignIn -Filter \"clientAppUsed ne 'Browser' and clientAppUsed ne 'Mobile Apps and Desktop clients'\" `\n    -Top 1000 | Group-Object userPrincipalName | Select-Object Count, Name |\n    Sort-Object Count -Descending\n\nWrite-Host \"Users with Legacy Auth (last 30 days):\"\n$legacyAuthReport | Format-Table -AutoSize\n```\n\n### Step 6: Monitor Passwordless Adoption Metrics\n\nTrack deployment progress and authentication method usage:\n\n```powershell\n# Generate passwordless adoption dashboard data\nfunction Get-PasswordlessAdoptionMetrics {\n    # Authentication method registration statistics\n    $registrationReport = Get-MgReportAuthenticationMethodUserRegistrationDetail -All\n\n    $metrics = @{\n        TotalUsers = $registrationReport.Count\n        PasswordlessCapable = ($registrationReport | Where-Object { $_.IsPasswordlessCapable }).Count\n        MfaRegistered = ($registrationReport | Where-Object { $_.IsMfaRegistered }).Count\n        Fido2Registered = ($registrationReport | Where-Object { \"fido2\" -in $_.MethodsRegistered }).Count\n        WhfbRegistered = ($registrationReport | Where-Object { \"windowsHelloForBusiness\" -in $_.MethodsRegistered }).Count\n        AuthenticatorRegistered = ($registrationReport | Where-Object { \"microsoftAuthenticator\" -in $_.MethodsRegistered }).Count\n        SmsOnly = ($registrationReport | Where-Object {\n            \"sms\" -in $_.MethodsRegistered -and\n            \"fido2\" -notin $_.MethodsRegistered -and\n            \"windowsHelloForBusiness\" -notin $_.MethodsRegistered\n        }).Count\n    }\n\n    # Authentication method usage from sign-in logs\n    $signInLogs = Get-MgAuditLogSignIn -Top 10000 -Filter \"createdDateTime ge $((Get-Date).AddDays(-30).ToString('yyyy-MM-ddTHH:mm:ssZ'))\"\n\n    $authMethodUsage = $signInLogs |\n        Group-Object { $_.AuthenticationMethodsUsed -join \",\" } |\n        Select-Object Count, Name | Sort-Object Count -Descending\n\n    return @{\n        Registration = $metrics\n        Usage = $authMethodUsage\n    }\n}\n\n$adoption = Get-PasswordlessAdoptionMetrics\n$reg = $adoption.Registration\n\nWrite-Host \"PASSWORDLESS ADOPTION REPORT\"\nWrite-Host \"============================\"\nWrite-Host \"Total Users:              $($reg.TotalUsers)\"\nWrite-Host \"Passwordless Capable:     $($reg.PasswordlessCapable) ($([math]::Round($reg.PasswordlessCapable\u002F$reg.TotalUsers*100,1))%)\"\nWrite-Host \"  FIDO2 Keys:             $($reg.Fido2Registered)\"\nWrite-Host \"  Windows Hello:          $($reg.WhfbRegistered)\"\nWrite-Host \"  Authenticator:          $($reg.AuthenticatorRegistered)\"\nWrite-Host \"MFA Registered:           $($reg.MfaRegistered) ($([math]::Round($reg.MfaRegistered\u002F$reg.TotalUsers*100,1))%)\"\nWrite-Host \"SMS Only (needs upgrade): $($reg.SmsOnly)\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **FIDO2** | Fast Identity Online 2 standard enabling passwordless authentication using public-key cryptography bound to hardware authenticators or platform credentials |\n| **Passkey** | FIDO2 credential that can be device-bound (security key) or synced across devices, providing phishing-resistant authentication without passwords |\n| **Windows Hello for Business** | Windows platform authenticator using PIN, fingerprint, or facial recognition backed by TPM-protected asymmetric keys for passwordless sign-in |\n| **Cloud Kerberos Trust** | Deployment model for hybrid WHfB that uses Azure AD Kerberos to authenticate to on-premises resources without requiring PKI certificate infrastructure |\n| **Temporary Access Pass** | Time-limited passcode issued by admins enabling users to register passwordless methods or recover access when their primary method is unavailable |\n| **Authentication Strength** | Conditional Access capability in Microsoft Entra that specifies which authentication method combinations satisfy MFA requirements for a given policy |\n\n## Tools & Systems\n\n- **Microsoft Entra Admin Center**: Portal for configuring authentication methods, Conditional Access policies, and monitoring sign-in analytics\n- **Microsoft Intune**: MDM\u002FMAM platform for deploying Windows Hello for Business configuration profiles to managed devices\n- **Microsoft Graph API**: Programmatic interface for managing authentication methods, policies, and generating adoption reports\n- **FIDO2 Security Keys**: Hardware authenticators (YubiKey, Feitian, Google Titan) storing cryptographic credentials for phishing-resistant authentication\n\n## Common Scenarios\n\n### Scenario: Enterprise-Wide Passwordless Migration\n\n**Context**: Organization with 5,000 users plans to eliminate passwords within 12 months after experiencing a phishing attack that compromised 47 accounts. Current state: 60% use SMS MFA, 30% use Authenticator app, 10% have no MFA.\n\n**Approach**:\n1. Phase 1 (Month 1-2): Enable FIDO2 and WHfB authentication methods in report-only Conditional Access\n2. Phase 2 (Month 2-3): Deploy WHfB to all managed Windows devices via Intune with Cloud Kerberos Trust\n3. Phase 3 (Month 3-5): Distribute FIDO2 security keys to executives, IT admins, and finance (highest-risk users first)\n4. Phase 4 (Month 5-8): Enable Authenticator passkeys for mobile-primary users and field workers\n5. Phase 5 (Month 8-10): Switch Conditional Access from report-only to enforced for phishing-resistant auth\n6. Phase 6 (Month 10-12): Disable SMS and voice call methods, block legacy authentication protocols\n7. Ongoing: Monitor adoption metrics, issue TAPs for stragglers, maintain break-glass accounts\n\n**Pitfalls**:\n- Not deploying Cloud Kerberos Trust causes WHfB to fail for on-premises resource access in hybrid environments\n- Enforcing passwordless without ensuring all applications support modern authentication breaks access\n- Issuing only one security key per user without a backup creates lockout risk if the key is lost\n- Not configuring Temporary Access Pass as a recovery method before disabling password-based sign-in\n\n## Output Format\n\n```\nPASSWORDLESS AUTHENTICATION DEPLOYMENT REPORT\n================================================\nTenant:            corp.onmicrosoft.com\nUsers:             5,247\nDeployment Phase:  Phase 4 (Authenticator Passkeys)\n\nAUTHENTICATION METHOD REGISTRATION\nPasswordless Capable:    4,103 \u002F 5,247 (78.2%)\n  FIDO2 Security Keys:   892 (17.0%)\n  Windows Hello:          2,847 (54.3%)\n  Authenticator Passkey:  1,234 (23.5%)\n  Certificate-Based:      312 (5.9%)\n\nLEGACY METHOD STATUS\nSMS-Only Users:          387 (7.4%) -- migration in progress\nVoice-Only Users:        0 (disabled)\nNo MFA Users:            42 (0.8%) -- TAPs issued\n\nCONDITIONAL ACCESS\nPhishing-Resistant Policy:  ENFORCED (all users except exclusion group)\nLegacy Auth Block:          ENABLED\nAdmin Portal Policy:        SECURITY KEY REQUIRED\n\nSIGN-IN ANALYTICS (Last 30 Days)\nTotal Sign-Ins:          847,293\n  Passwordless:          623,891 (73.6%)\n  Password + MFA:        198,402 (23.4%)\n  Password Only:         0 (blocked)\n  Legacy Protocol:       0 (blocked)\n\nSECURITY IMPACT\nPhishing Incidents:      0 (down from 47 pre-deployment)\nPassword Reset Tickets:  -82% reduction\nAvg Sign-In Time:        8.2s (passwordless) vs 24.1s (password)\n```\n",{"name":5,"tags":44,"capec":45,"model":46,"tools":47,"domain":32,"maxTurns":51,"nist_csf":52,"subdomain":57,"description":7,"mitre_attack":58},[22,28,27,38,37,36],[],"sonnet",[48,30,49,50],"Read","Glob","Grep",20,[53,54,55,56],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management",[59,60],"T1003","T1566","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fidentity\u002Fmfa\u002Fpasswordless\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill mfa-passwordless-exploit",{"tool":74,"command":75},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill mfa-passwordless-exploit",{"tool":77,"command":78},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill mfa-passwordless-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fmfa\u002Fpasswordless\u002Fexploit\u002FSKILL.md",true,[82],{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"index.json","REFERENCE","参考文档",689,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fmfa\u002Fpasswordless\u002Fexploit\u002Findex.json",[89,114,134,155,177,193],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,32,113],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[20,96,121,99,122,123,124,32,30,125,126,127,128,129,101,130,131,26,132,133],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[141,142,143,144,145,146,32,30,147,125,148,149,101,26,150,151,152,153,154,46],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[97,162,163,164,165,166,167,102,168,32,113,169,170,171,172,173,174,175,176,101],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[184,185,97,186,164,166,187,102,188,168,32,113,125,189,190,191,192,176,101,103],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":199,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[200,97,164,201,187,102,202,203,32,113,204,205,206,207,208,209,101,103,210,211],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]