AADInternals federation forgery and token minting cmdlets

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects the execution of AADInternals PowerShell toolkit commands. AADInternals is a known framework used for administration, enumeration, and exploitation of Azure Active Directory and Microsoft Entra ID, including the creation of backdoors and manipulation of federation settings.