Translated ['', 'src/pentesting-cloud/azure-security/az-enumeration-tool

src/pentesting-cloud/azure-security/az-enumeration-tools.md

@@ -1,11 +1,11 @@
-# Az - Zana za Kuorodhesha
+# Az - Enumeration Tools
 
 {{#include ../../banners/hacktricks-training.md}}
 
 ## Sakinisha PowerShell kwenye Linux
 
 > [!TIP]
-> Kwenye linux utahitaji kusakinisha PowerShell Core:
+> Katika linux utahitaji kusakinisha PowerShell Core:
 ```bash
 sudo apt-get update
 sudo apt-get install -y wget apt-transport-https software-properties-common
@@ -28,11 +28,11 @@ curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
 
 Maelekezo kutoka kwenye [**documentation**](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-macos?view=powershell-7.4):
 
-1. Sakinisha `brew` ikiwa bado haijasakinishwa:
+1. Sakinisha `brew` ikiwa haujauwekwa bado:
 ```bash
 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
 ```
-2. Sakinisha toleo thabiti la PowerShell la hivi karibuni:
+2. Sakinisha toleo thabiti la hivi karibuni la PowerShell:
 ```sh
 brew install powershell/tap/powershell
 ```
@@ -45,23 +45,23 @@ pwsh
 brew update
 brew upgrade powershell
 ```
-## Zana Kuu za Uorodheshaji
+## Vyombo Vikuu vya Enumeration
 
 ### az cli
 
-[**Azure Command-Line Interface (CLI)**](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) ni zana ya kuvuka-mifumo iliyandikwa kwa Python kwa kusimamia na kuendesha (sehemu kubwa ya) rasilimali za Azure na Entra ID. Inajiunga na Azure na inatekeleza amri za usimamizi kupitia mstari wa amri au skripti.
+[**Azure Command-Line Interface (CLI)**](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) ni chombo cha kufanya kazi kwa majukwaa mbalimbali kilichoandikwa kwa Python kwa kusimamia na kuendesha rasilimali nyingi za Azure na Entra ID. Inajiunganisha na Azure na inatekeleza amri za utawala kupitia mstari wa amri au scripts.
 
-Tazama [**maelekezo ya usakinishaji**](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli#install).
+Follow this link for the [**installation instructions¡**](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli#install).
 
-Amri katika Azure CLI zimepangwa kwa kutumia muundo: `az <service> <action> <parameters>`
+Commands in Azure CLI are structured using a pattern of: `az <service> <action> <parameters>`
 
 #### Debug | MitM az cli
 
-Kutumia parameta **`--debug`** inawezekana kuona maombi yote ambayo zana **`az`** inazituma:
+Using the parameter **`--debug`** it's possible to see all the requests the tool **`az`** is sending:
 ```bash
 az account management-group list --output table --debug
 ```
-Ili kufanya **MitM** kwa zana na **kuangalia maombi yote** inayoituma kwa mkono unaweza kufanya:
+Ili kufanya **MitM** kwenye zana na **kukagua maombi yote** inayotuma kwa mikono, unaweza kufanya:
 
 {{#tabs }}
 {{#tab name="Bash" }}
@@ -104,51 +104,215 @@ $env:HTTP_PROXY="http://127.0.0.1:8080"
 {{#endtab }}
 {{#endtabs }}
 
+<details>
+<summary><strong>Kurekebisha “CA cert does not include key usage extension”</strong></summary>
+
+### Kwa nini kosa linatokea
+
+When Azure CLI authenticates, it makes HTTPS requests (via MSAL → Requests → OpenSSL). If you’re intercepting TLS with Burp, Burp generates “on the fly” certificates for sites like `login.microsoftonline.com` and signs them with Burp’s CA.
+
+On newer stacks (Python 3.13 + OpenSSL 3), CA validation is stricter:
+
+- A CA certificate must include **Basic Constraints: `CA:TRUE`** and a **Key Usage** extension permitting certificate signing (**`keyCertSign`**, and typically **`cRLSign`**).
+
+Burp’s default CA (PortSwigger CA) is old and typically lacks the Key Usage extension, so OpenSSL rejects it even if you “trust it”.
+
+That produces errors like:
+
+- `CA cert does not include key usage extension`
+- `CERTIFICATE_VERIFY_FAILED`
+- `self-signed certificate in certificate chain`
+
+So you must:
+
+1. Create a modern CA (with proper Key Usage).
+2. Make Burp use it to sign intercepted certs.
+3. Trust that CA in macOS.
+4. Point Azure CLI / Requests to that CA bundle.
+
+### Step-by-step: working configuration
+
+#### 0) Mahitaji ya awali
+
+- Burp running locally (proxy at `127.0.0.1:8080`)
+- Azure CLI installed (Homebrew)
+- You can `sudo` (to trust the CA in the system keychain)
+
+#### 1) Tengeneza Burp CA inayokidhi viwango (PEM + KEY)
+
+Tengeneza faili ya config ya OpenSSL ambayo kwa wazi inaweka extensions za CA:
+```bash
+mkdir -p ~/burp-ca && cd ~/burp-ca
+
+cat > burp-ca.cnf <<'EOF'
+[ req ]
+default_bits       = 2048
+prompt             = no
+default_md         = sha256
+distinguished_name = dn
+x509_extensions    = v3_ca
+
+[ dn ]
+C  = US
+O  = Burp Custom CA
+CN = Burp Custom Root CA
+
+[ v3_ca ]
+basicConstraints = critical,CA:TRUE
+keyUsage = critical,keyCertSign,cRLSign
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer
+EOF
+```
+Tengeneza cheti cha CA + private key:
+```bash
+openssl req -x509 -new -nodes \
+-days 3650 \
+-keyout burp-ca.key \
+-out burp-ca.pem \
+-config burp-ca.cnf
+```
+Ukaguzi wa busara (LAZIMA uone Key Usage):
+```bash
+openssl x509 -in burp-ca.pem -noout -text | egrep -A3 "Basic Constraints|Key Usage"
+```
+Inatarajiwa kujumuisha kitu kama:
+
+- `CA:TRUE`
+- `Key Usage: ... Certificate Sign, CRL Sign`
+
+#### 2) Badilisha kuwa PKCS#12 (muundo wa kuingiza wa Burp)
+
+Burp inahitaji certificate + private key, rahisi zaidi kama PKCS#12:
+```bash
+openssl pkcs12 -export \
+-out burp-ca.p12 \
+-inkey burp-ca.key \
+-in burp-ca.pem \
+-name "Burp Custom Root CA"
+```
+Utaulizwa kuweka nenosiri la kusafirisha (weka moja; Burp itakuuliza).
+
+#### 3) Ingiza CA ndani ya Burp na anzisha tena Burp
+
+Ndani ya Burp:
+
+- Proxy → Options
+- Find Import / export CA certificate
+- Click Import CA certificate
+- Choose PKCS#12
+- Select `burp-ca.p12`
+- Enter the password
+- Restart Burp completely (important)
+
+Kwa nini kuanzisha tena? Burp inaweza kuendelea kutumia CA ya zamani hadi itakapozinduliwa tena.
+
+#### 4) Amini CA mpya kwenye keychain ya mfumo wa macOS
+
+Hii inaruhusu programu za mfumo na TLS stacks nyingi kuamini CA.
+```bash
+sudo security add-trusted-cert \
+-d -r trustRoot \
+-k /Library/Keychains/System.keychain \
+~/burp-ca/burp-ca.pem
+```
+(Ikiwa unapendelea GUI: Keychain Access → System → Certificates → import → set “Always Trust”.)
+
+#### 5) Sanidi env vars za proxy
+```bash
+export HTTPS_PROXY="http://127.0.0.1:8080"
+export HTTP_PROXY="http://127.0.0.1:8080"
+```
+#### 6) Sanidi Requests/Azure CLI ili kuamini Burp CA yako
+
+Azure CLI inatumia Python Requests kwa ndani; weka hizi zote mbili:
+```bash
+export REQUESTS_CA_BUNDLE="$HOME/burp-ca/burp-ca.pem"
+export SSL_CERT_FILE="$HOME/burp-ca/burp-ca.pem"
+```
+Vidokezo:
+
+- `REQUESTS_CA_BUNDLE` hutumika na Requests.
+- `SSL_CERT_FILE` husaidia kwa watumiaji wengine wa TLS na hali za pembezoni.
+- Kwa kawaida hautahitaji `ADAL_PYTHON_SSL_NO_VERIFY` / `AZURE_CLI_DISABLE_CONNECTION_VERIFICATION` ya zamani mara tu CA itakapokuwa sahihi.
+
+#### 7) Hakikisha Burp kwa kweli inasaini na CA yako mpya (ukaguzi muhimu)
+
+Hii inathibitisha kwamba interception chain yako iko sahihi:
+```bash
+openssl s_client -connect login.microsoftonline.com:443 \
+-proxy 127.0.0.1:8080 </dev/null 2>/dev/null \
+| openssl x509 -noout -issuer
+```
+Mtoaji anayetarajiwa unatakiwa kuwa na jina la CA yako, kwa mfano:
+
+`O=Burp Custom CA, CN=Burp Custom Root CA`
+
+Ikiwa bado unaona PortSwigger CA, Burp haitumii CA uliyoiingiza → angalia tena uingizaji na anzisha upya.
+
+#### 8) Hakikisha Python Requests zinafanya kazi kupitia Burp
+```bash
+python3 - <<'EOF'
+import requests
+requests.get("https://login.microsoftonline.com")
+print("OK")
+EOF
+```
+Inatarajiwa: `OK`
+
+#### 9) Azure CLI jaribio
+```bash
+az account get-access-token --resource=https://management.azure.com/
+```
+Ikiwa tayari umeingia, inapaswa kurudisha JSON yenye `accessToken`.
+
+</details>
+
 ### Az PowerShell
 
-Azure PowerShell ni module yenye cmdlets za kusimamia Azure resources moja kwa moja kutoka kwenye PowerShell command line.
+Azure PowerShell ni module yenye cmdlets za kusimamia rasilimali za Azure moja kwa moja kutoka kwenye mstari wa amri wa PowerShell.
 
-Fuata kiunga hiki kwa ajili ya [**installation instructions**](https://learn.microsoft.com/en-us/powershell/azure/install-azure-powershell).
+Tembelea kiungo hiki kwa [**maelekezo ya usanikishaji**](https://learn.microsoft.com/en-us/powershell/azure/install-azure-powershell).
 
 Amri katika Azure PowerShell AZ Module zimeundwa kama: `<Action>-Az<Service> <parameters>`
 
 #### Debug | MitM Az PowerShell
 
-Ukikitumia parameter **`-Debug`**, inawezekana kuona maombi yote yanayotumwa na zana:
+Kutumia parameter **`-Debug`** inawezekana kuona maombi yote ambayo zana inatuma:
 ```bash
 Get-AzResourceGroup -Debug
 ```
-Ili kufanya **MitM** kwenye zana na **kuangalia maombi yote** inayotumwa kwa mikono, unaweza kuweka vigezo vya mazingira `HTTPS_PROXY` na `HTTP_PROXY` kulingana na [**docs**](https://learn.microsoft.com/en-us/powershell/azure/az-powershell-proxy).
+Ili kufanya **MitM** kwa zana na **kuangalia maombi yote** inayotumwa kwa mkono, unaweza kuweka vigezo vya mazingira `HTTPS_PROXY` na `HTTP_PROXY` kulingana na [**docs**](https://learn.microsoft.com/en-us/powershell/azure/az-powershell-proxy).
 
 ### Microsoft Graph PowerShell
 
-Microsoft Graph PowerShell ni SDK ya kuvuka-majukwaa inayowawezesha kufikia Microsoft Graph APIs zote, ikijumuisha huduma kama SharePoint, Exchange, na Outlook, kwa kutumia endpoint moja. Inasaidia PowerShell 7+, uthibitishaji wa kisasa kupitia MSAL, vitambulisho vya nje, na query za hali ya juu. Kwa kuzingatia upatikanaji wa least privilege, inahakikisha operesheni salama na hupokea masasisho ya mara kwa mara ili kuendana na vipengele vya hivi karibuni vya Microsoft Graph API.
+Microsoft Graph PowerShell ni SDK inayofanya kazi kwenye majukwaa mbalimbali inayowezesha upatikanaji wa Microsoft Graph APIs zote, ikiwa ni pamoja na huduma kama SharePoint, Exchange, na Outlook, kwa kutumia endpoint moja. Inaunga mkono PowerShell 7+, authentication ya kisasa kupitia MSAL, vitambulisho vya nje, na maulizo ya juu. Kwa kuzingatia kanuni ya least privilege, inahakikisha operesheni salama na hupokea sasisho za mara kwa mara ili kuendana na vipengele vipya vya Microsoft Graph API.
 
-Follow this link for the [**installation instructions**](https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation).
+Fuata kiungo hiki kwa [**installation instructions**](https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation).
 
-Commands in Microsoft Graph PowerShell are structured like: `<Action>-Mg<Service> <parameters>`
+Amri katika Microsoft Graph PowerShell zimepangwa kama: `<Action>-Mg<Service> <parameters>`
 
 #### Debug Microsoft Graph PowerShell
 
-Kwa kutumia parameter **`-Debug`**, inawezekana kuona maombi yote ambayo zana inayotuma:
+Kwa kutumia parameter **`-Debug`** unaweza kuona maombi yote ambayo zana inayotuma:
 ```bash
 Get-MgUser -Debug
 ```
 ### ~~**AzureAD Powershell**~~
 
-Module ya Azure Active Directory (AD), sasa **deprecated**, ni sehemu ya Azure PowerShell kwa kusimamia rasilimali za Azure AD. Inatoa cmdlets kwa kazi kama kusimamia watumiaji, vikundi, na usajili wa programu ndani ya Entra ID.
+Module ya Azure Active Directory (AD), sasa **imepitwa na wakati**, ni sehemu ya Azure PowerShell kwa kusimamia rasilimali za Azure AD. Inatoa cmdlets kwa kazi kama kusimamia watumiaji, vikundi, na usajili wa programu katika Entra ID.
 
 > [!TIP]
 > Hii imebadilishwa na Microsoft Graph PowerShell
 
-Tumia kiunga hiki kwa [**installation instructions**](https://www.powershellgallery.com/packages/AzureAD).
+Fuata kiungo hiki kwa [**installation instructions**](https://www.powershellgallery.com/packages/AzureAD).
 
 
-## Zana za Uchunguzi wa Otomatiki na Uzingatiaji
+## Vyombo vya Otomatiki vya Recon na Compliance
 
 ### [turbot azure plugins](https://github.com/orgs/turbot/repositories?q=mod-azure)
 
-Turbot pamoja na steampipe na powerpipe huwasaidia kukusanya taarifa kutoka Azure na Entra ID na kufanya ukaguzi wa uzingatiaji na kugundua mipangilio isiyo sahihi. Moduli za Azure zinazopendekezwa kwa sasa kuendesha ni:
+Turbot pamoja na steampipe na powerpipe huruhusu kukusanya taarifa kutoka Azure na Entra ID, kufanya ukaguzi wa uzingatiaji, na kugundua mipangilio isiyofaa. Moduli za Azure zinazopendekezwa kwa sasa kuendesha ni:
 
 - [https://github.com/turbot/steampipe-mod-azure-compliance](https://github.com/turbot/steampipe-mod-azure-compliance)
 - [https://github.com/turbot/steampipe-mod-azure-insights](https://github.com/turbot/steampipe-mod-azure-insights)
@@ -179,9 +343,9 @@ powerpipe server
 ```
 ### [Prowler](https://github.com/prowler-cloud/prowler)
 
-Prowler ni zana ya usalama ya Chanzo Huria ya kufanya tathmini za mbinu bora za usalama za AWS, Azure, Google Cloud na Kubernetes, ukaguzi, majibu ya matukio, ufuatiliaji wa kuendelea, hardening na maandalizi ya forensics.
+Prowler ni zana ya usalama ya Chanzo Huria kwa ajili ya kutekeleza tathmini za mbinu bora za usalama kwa AWS, Azure, Google Cloud na Kubernetes, ukaguzi, majibu ya matukio, ufuatiliaji wa kuendelea, kuimarisha usalama na maandalizi ya forensics.
 
-Inatupa uwezo wa kuendesha mamia ya ukaguzi dhidi ya mazingira ya Azure ili kugundua mipangilio isiyo sahihi ya usalama na kukusanya matokeo katika json (na miundo mingine ya maandishi) au kuyaangalia kwenye wavuti.
+Kimsingi inatuwezesha kuendesha mamia ya vipimo dhidi ya mazingira ya Azure kutafuta mipangilio isiyofaa ya usalama na kukusanya matokeo katika json (na fomati nyingine za maandishi) au kuangalia kwenye mtandao.
 ```bash
 # Create a application with Reader role and set the tenant ID, client ID and secret in prowler so it access the app
 
@@ -203,9 +367,9 @@ docker run --rm -e "AZURE_CLIENT_ID=<client-id>" -e "AZURE_TENANT_ID=<tenant-id>
 ```
 ### [Monkey365](https://github.com/silverhack/monkey365)
 
-Inaruhusu kufanya kwa kiotomatiki mapitio ya usanidi wa usalama wa Azure subscriptions na Microsoft Entra ID.
+Inaruhusu kufanya mapitio ya usanidi wa usalama wa Azure subscriptions na Microsoft Entra ID kiotomatiki.
 
-Ripoti za HTML zinahifadhiwa ndani ya saraka `./monkey-reports` ndani ya repository ya github.
+Ripoti za HTML zimehifadhiwa ndani ya saraka `./monkey-reports` ndani ya github repository folder.
 ```bash
 git clone https://github.com/silverhack/monkey365
 Get-ChildItem -Recurse monkey365 | Unblock-File
@@ -226,7 +390,7 @@ Invoke-Monkey365 -TenantId <tenant-id> -ClientId <client-id> -ClientSecret $Secu
 ```
 ### [ScoutSuite](https://github.com/nccgroup/ScoutSuite)
 
-Scout Suite hukusanya data za usanidi kwa ajili ya uchunguzi wa mikono na kuonyesha maeneo hatarishi. Ni chombo cha ukaguzi wa usalama cha multi-cloud, kinachowawezesha tathmini ya mkao wa usalama wa mazingira ya cloud.
+Scout Suite hukusanya data za usanidi kwa uchunguzi wa mkono na kuonyesha maeneo yenye hatari. Ni chombo cha ukaguzi wa usalama kwa multi-cloud, kinachoruhusu tathmini ya hali ya usalama ya mazingira ya wingu.
 ```bash
 virtualenv -p python3 venv
 source venv/bin/activate
@@ -242,18 +406,18 @@ python scout.py azure --cli
 ```
 ### [Azure-MG-Sub-Governance-Reporting](https://github.com/JulianHayward/Azure-MG-Sub-Governance-Reporting)
 
-Ni script ya powershell inayokusaidia **kuonyesha rasilimali zote na ruhusa ndani ya Management Group na Entra ID** tenant na kugundua mapungufu ya usanidi wa usalama.
+Ni script ya PowerShell inayokusaidia **kuonyesha rasilimali zote na ruhusa ndani ya Management Group na Entra ID** tenant na kugundua makosa ya usanidi wa usalama.
 
-Inafanya kazi kwa kutumia Az PowerShell module, hivyo njia yoyote ya uthibitishaji inayoungwa mkono na zana hii inasaidiwa.
+Inafanya kazi kwa kutumia Az PowerShell module, hivyo aina yoyote ya uthibitishaji inayoungwa mkono na chombo hiki itaungwa mkono.
 ```bash
 import-module Az
 .\AzGovVizParallel.ps1 -ManagementGroupId <management-group-id> [-SubscriptionIdWhitelist <subscription-id>]
 ```
-## Automated Post-Exploitation tools
+## Vifaa vya Automated Post-Exploitation
 
 ### [**ROADRecon**](https://github.com/dirkjanm/ROADtools)
 
-Uorodheshaji wa ROADRecon hutoa taarifa kuhusu usanidi wa Entra ID, kama watumiaji, makundi, majukumu, sera za upatikanaji zenye masharti...
+Uorodheshaji wa ROADRecon unatoa taarifa kuhusu usanidi wa Entra ID, kama watumiaji, vikundi, majukumu, sera za upatikanaji za masharti...
 ```bash
 cd ROADTools
 pipenv shell
@@ -266,14 +430,14 @@ roadrecon gui
 ```
 ### [**AzureHound**](https://github.com/BloodHoundAD/AzureHound)
 
-AzureHound ni collector ya BloodHound kwa Microsoft Entra ID na Azure. Ni binary moja thabiti ya Go kwa Windows/Linux/macOS inayozungumza moja kwa moja na:
+AzureHound ni mkusanyaji wa BloodHound kwa Microsoft Entra ID na Azure. Ni binary moja ya Go static kwa Windows/Linux/macOS inayozungumza moja kwa moja na:
 - Microsoft Graph (Entra ID directory, M365) na
 - Azure Resource Manager (ARM) control plane (subscriptions, resource groups, compute, storage, key vault, app services, AKS, etc.)
 
-Key traits
-- Inaweza kuendeshwa kutoka mahali popote kwenye intaneti ya umma dhidi ya tenant APIs (hakuna ufikiaji wa mtandao wa ndani unahitajika)
-- Inatoa JSON kwa BloodHound CE ili kuonyesha attack paths kati ya identities na cloud resources
-- User-Agent ya default iliyobainika: azurehound/v2.x.x
+Sifa kuu
+- Inafanya kazi kutoka mahali popote kwenye internet ya umma dhidi ya tenant APIs (hakuna ufikiaji wa mtandao wa ndani unahitajika)
+- Inatoa JSON kwa ajili ya ingestion ya BloodHound CE ili kuonyesha njia za mashambulio kati ya vitambulisho na rasilimali za cloud
+- Default User-Agent iliyotambuliwa: azurehound/v2.x.x
 
 Chaguzi za uthibitishaji
 - Jina la mtumiaji + nywila: -u <upn> -p <password>
@@ -318,36 +482,36 @@ azurehound list web-apps -t "<tenant-id>" -o webapps.json
 azurehound list function-apps -t "<tenant-id>" -o funcapps.json
 ```
 What gets queried
-- Graph endpoints (mifano):
+- Graph endpoints (examples):
 - /v1.0/organization, /v1.0/users, /v1.0/groups, /v1.0/roleManagement/directory/roleDefinitions, directoryRoles, owners/members
-- ARM endpoints (mifano):
+- ARM endpoints (examples):
 - management.azure.com/subscriptions/.../providers/Microsoft.Storage/storageAccounts
 - .../Microsoft.KeyVault/vaults, .../Microsoft.Compute/virtualMachines, .../Microsoft.Web/sites, .../Microsoft.ContainerService/managedClusters
 
 Preflight behavior and endpoints
-- Each azurehound list <object> typically performs these test calls before enumeration:
+- Kila azurehound list <object> kwa kawaida hufanya simu hizi za mtihani kabla ya enumeration:
 1) Identity platform: login.microsoftonline.com
 2) Graph: GET https://graph.microsoft.com/v1.0/organization
 3) ARM: GET https://management.azure.com/subscriptions?api-version=...
-- Cloud environment base URLs differ for Government/China/Germany. See constants/environments.go in the repo.
+- Base URLs za Cloud environment zinatofautiana kwa Government/China/Germany. Angalia constants/environments.go katika repo.
 
 ARM-heavy objects (less visible in Activity/Resource logs)
-- The following list targets predominantly use ARM control plane reads: automation-accounts, container-registries, function-apps, key-vaults, logic-apps, managed-clusters, management-groups, resource-groups, storage-accounts, storage-containers, virtual-machines, vm-scale-sets, web-apps.
-- These GET/list operations are typically not written to Activity Logs; data-plane reads (e.g., *.blob.core.windows.net, *.vault.azure.net) are covered by Diagnostic Settings at the resource level.
+- Orodha ifuatayo inalenga kusoma kwa njia ya ARM control plane: automation-accounts, container-registries, function-apps, key-vaults, logic-apps, managed-clusters, management-groups, resource-groups, storage-accounts, storage-containers, virtual-machines, vm-scale-sets, web-apps.
+- Operesheni hizi za GET/list kwa kawaida hazinaandikwa kwenye Activity Logs; data-plane reads (mfano: *.blob.core.windows.net, *.vault.azure.net) zinaripotiwa kupitia Diagnostic Settings katika ngazi ya resource.
 
 OPSEC and logging notes
-- Microsoft Graph Activity Logs are not enabled by default; enable and export to SIEM to gain visibility of Graph calls. Expect the Graph preflight GET /v1.0/organization with UA azurehound/v2.x.x.
-- Entra ID non-interactive sign-in logs record the identity platform auth (login.microsoftonline.com) used by AzureHound.
-- ARM control-plane read/list operations are not recorded in Activity Logs; many azurehound list operations against resources won’t appear there. Only data-plane logging (via Diagnostic Settings) will capture reads to service endpoints.
-- Defender XDR GraphApiAuditEvents (preview) can expose Graph calls and token identifiers but may lack UserAgent and have limited retention.
+- Microsoft Graph Activity Logs hazizimwi kwa default; wezesha na export kwa SIEM ili kupata mwonekano wa Graph calls. Tarajia Graph preflight GET /v1.0/organization yenye UA azurehound/v2.x.x.
+- Entra ID non-interactive sign-in logs zinarekodi authentication ya identity platform (login.microsoftonline.com) iliyotumika na AzureHound.
+- ARM control-plane read/list operations hazirekodiwi katika Activity Logs; operesheni nyingi za azurehound list dhidi ya resources hazitaonekana hapo. Logging pekee ya data-plane (kupitia Diagnostic Settings) itarekodi reads kwa service endpoints.
+- Defender XDR GraphApiAuditEvents (preview) inaweza kufichua Graph calls na token identifiers lakini inaweza kukosa UserAgent na kuwa na retention ndogo.
 
-Tip: When enumerating for privilege paths, dump users, groups, roles, and role assignments, then ingest in BloodHound and use prebuilt cypher queries to surface Global Administrator/Privileged Role Administrator and transitive escalation via nested groups and RBAC assignments.
+Tip: Wakati wa kufanya enumeration ili kutafuta privilege paths, toa dump ya users, groups, roles, na role assignments, kisha ingiza (ingest) kwenye BloodHound na tumia prebuilt cypher queries ili kuonyesha Global Administrator/Privileged Role Administrator na transitive escalation kupitia nested groups na RBAC assignments.
 
 Launch the BloodHound web with `curl -L https://ghst.ly/getbhce | docker compose -f - up` and import the `output.json` file. Then, in the EXPLORE tab, in the CYPHER section you can see a folder icon that contains pre-built queries.
 
 ### [**MicroBurst**](https://github.com/NetSPI/MicroBurst)
 
-MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping. It is intended to be used during penetration tests where Azure is in use.
+MicroBurst inajumuisha functions na scripts ambazo zinaunga mkono Azure Services discovery, weak configuration auditing, na post exploitation actions kama credential dumping. Imekusudiwa kutumika wakati wa penetration tests ambapo Azure inatumika.
 ```bash
 Import-Module .\MicroBurst.psm1
 Import-Module .\Get-AzureDomainInfo.ps1
@@ -355,9 +519,9 @@ Get-AzureDomainInfo -folder MicroBurst -Verbose
 ```
 ### [**PowerZure**](https://github.com/hausec/PowerZure)
 
-PowerZure ilitengenezwa kutokana na hitaji la mfumo unaoweza kufanya reconnaissance na exploitation ya Azure, EntraID, na rasilimali zinazohusiana.
+PowerZure ilianzishwa kutokana na hitaji la mfumo unaoweza kufanya reconnaissance na exploitation ya Azure, EntraID, na rasilimali zinazohusiana.
 
-Inatumia moduli ya **Az PowerShell**, hivyo aina yoyote ya uthibitishaji inayoungwa mkono na moduli hii inasaidiwa na zana.
+Inatumia module ya **Az PowerShell**, hivyo authentication yoyote inayoungwa mkono na module hii inaungwa mkono na zana hii.
 ```bash
 # Login
 Import-Module Az
@@ -388,7 +552,7 @@ Invoke-AzureRunCommand -Command <command> -VMName <vmname>
 ```
 ### [**GraphRunner**](https://github.com/dafthack/GraphRunner/wiki/Invoke%E2%80%90GraphRunner)
 
-GraphRunner ni seti ya zana za post-exploitation kwa kuingiliana na Microsoft Graph API. Inatoa zana mbalimbali kwa kutekeleza reconnaissance, persistence, na kupora data kutoka kwenye akaunti ya Microsoft Entra ID (Azure AD).
+GraphRunner ni seti ya zana za post-exploitation za kuingiliana na Microsoft Graph API. Inatoa zana mbalimbali za kutekeleza reconnaissance, persistence, na pillaging of data kutoka kwa akaunti ya Microsoft Entra ID (Azure AD).
 ```bash
 #A good place to start is to authenticate with the Get-GraphTokens module. This module will launch a device-code login, allowing you to authenticate the session from a browser session. Access and refresh tokens will be written to the global $tokens variable. To use them with other GraphRunner modules use the Tokens flag (Example. Invoke-DumpApps -Tokens $tokens)
 Import-Module .\GraphRunner.ps1
@@ -432,9 +596,9 @@ Invoke-GraphRunner -Tokens $tokens
 ```
 ### [Stormspotter](https://github.com/Azure/Stormspotter)
 
-Stormspotter huunda “attack graph” ya rasilimali katika Azure subscription. Inawawezesha red teams na pentesters kuona attack surface na pivot opportunities ndani ya tenant, na inawapa defenders nguvu ya ziada kujielekeza haraka na kuweka vipaumbele kwa kazi za incident response.
+Stormspotter huunda “attack graph” ya rasilimali katika usajili wa Azure. Inawawezesha red teams na pentesters kuona attack surface na pivot opportunities ndani ya tenant, na inawapa defenders nguvu ya ziada ili kwa haraka kujielekeza na kuipa kipaumbele kazi za incident response.
 
-**Kwa bahati mbaya, inaonekana haifanyiwi matengenezo**.
+**Kwa bahati mbaya, inaonekana haijatunzwa.**
 ```bash
 # Start Backend
 cd stormspotter\backend\