Cloud Discovery With AzureHound

AzureHound is a data collection tool that's part of the BloodHound suite, designed for enumerating an Entra ID and Azure environment to map potential attack paths. The Unit 42 article notes that threat actors misuse AzureHound to automate discovery in cloud environments, helping them identify user hierarchies, permissions and high‑value targets for privilege escalation and lateral movement.

It highlights that publicly known groups have used AzureHound in post‑compromise activity, with examples including the Iranian‑backed Curious Serpens and a May 2025 Void Blizzard campaign, and a August 2025 Storm-0501 operation operating in a hybrid Azure environment.

The piece maps AzureHound activity to MITRE ATT&CK techniques such as T1087.004, T1619, T1526 and T1580, and discusses how logs from Microsoft Graph activity and Entra ID sign‑in and audit logs can aid detection, while noting that some REST API reads may not appear in activity logs. According to Unit 42, token binding in Entra ID began general availability in August 2025, offering a potential defence against stolen tokens used to authenticate AzureHound.