diff --git a/Potential-Attack-Path-Examples.md b/Potential-Attack-Path-Examples.md index 92aef27..f1acb1b 100644 --- a/Potential-Attack-Path-Examples.md +++ b/Potential-Attack-Path-Examples.md @@ -11,8 +11,6 @@ GraphRunner has a lot of different modules that do specific tasks but combining Guest users can be injected into groups too but your current user (Entra ID user in the target tenant) needs to be injected first. -![Untitled](https://graphrunnerdemos.s3.amazonaws.com/GraphRunner_Demo_1_Groups_Abuse.gif) - ### Dynamic Group PrivEsc (Abusing membership rule) 1. Identify dynamic groups (Get-DynamicGroups) that have rules that can be abused such as a rule that adds a user to a group if their email contains “admin”.