{
	"id": "80971f7f-0576-4577-b860-78b198876f39",
	"created_at": "2026-04-06T00:16:25.439891Z",
	"updated_at": "2026-04-10T03:21:26.690238Z",
	"deleted_at": null,
	"sha1_hash": "c3f8e4a5b97940089054ee195702c8ff72115c1a",
	"title": "GitHub - Script-Nomad/raindance: Reconnaissance tool for Microsoft Office 365",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 74283,
	"plain_text": "GitHub - Script-Nomad/raindance: Reconnaissance tool for\r\nMicrosoft Office 365\r\nBy Script-Nomad\r\nArchived: 2026-04-05 21:24:17 UTC\r\nA toolkit for enumerating and collecting information from Office 365\r\n \\ _( )_ \\ \\ _( )_ \\ \\\r\n _( )_ _( )_ ( ) \\ \\\r\n (_________) \\ _( )_(_ _)\r\n \\ \\ \\ (_________)________) \\ \\ \\\r\n\\ \\ \\ \\ \\ \\(__________) \\\r\n\\ \\ \\ \\ \\ \\ \\ \\ \\\r\n \\ . \\ \\ \\ \\ \\ \\ \\\r\n\\ \\_O/ \\ \\ , \\ \\ \\ \\\r\n \\ \\ \\ \\ / \\ \\O_\r\n /\\_ \\ \\_\\ ,/\\/ \\\r\n \\ , \\ \\ \\ / \\ \\\r\n ___ \\ __ /O\\ \\ \\ \\\r\n | _ \\ __ _(_)_ __ | _ \\ __ _ _ __ ___ ___\r\n | |_) / _ | | '_ \\| | | |/ _ | '_ \\ / __/ _ \\\r\n | _ \u003c (_| | | | | | |_| | (_| | | | | (_| __/\r\n |_| \\_\\__,_|_|_| |_|____/ \\__,_|_| |_|\\___\\___|\r\n - Office 365 Info-Gathering Toolkit\r\nLatest Updates\r\nSorry for the delay in updates. I've been working on a cross-platform/python implementation to replace this, but\r\nit's slow going as I am doing some cert-chasing and swamped with other projects. There are some tentatively\r\ntested changes in dev, but they haven't been thoroughly put through the wringer yet. Mileage may vary. Thanks for\r\nthe support 👍\r\nDescription\r\nRaindance uses built-in powershell modules, namely from the MSOnline \u0026 AzureAD powershell modules to log\r\ninto Office 365 tenants with legitimate credentials and pulls out the list of users, their mailing groups and distros,\r\nroles/permissions, and identify administrators in the tenant. This tool is intended to be used as an attack tool to\r\nassist penetration testers in enumerating users and select targets for offensive engagements.\r\nBSides Talk\r\nhttps://github.com/True-Demon/raindance\r\nPage 1 of 3\n\nI was given the opportunity to speak at BSides about my findings associated with my research into Office 365 that\r\nled to the development of Raindance. This video goes into some additional detail of how to use the tool\r\neffectively, along with plausible scenarios in which it can be useful. If you are interested in that talk, you can find\r\nit here.\r\nFeatures\r\nEnumerates domain information within O365\r\nGet the full list of users, including disabled accounts\r\nGet a list of the mailing/distribution groups in the tenant\r\nIdentify administrative users and highlight Global Administrators (Company Admins)\r\nIn the works\r\nSupport for Exchange Server \u0026 Office API login\r\nSearch and download emails (with administrator impersonation)\r\nAutomated password searcher (dig through mail \u0026 sharepoint for indicators of plaintext passwords)\r\nUpload/Download files to/from Sharepoint\r\nMalicious modification of Sharepoint/OneDrive files\r\nRemote deployment over psexec\r\nInstallation \u0026 Running\r\nRaindance runs like a powershell module, and does not require any installation. Simply clone it to a directory, and\r\nimport as a powershell module to gain access to its functions. It is recommended to run as administrator the first\r\ntime in order to enable it to install the necessary dependencies, or you may do so manually.\r\n# Open a Powershell Command Window as administrator\r\n# Ensure you have all the necessary dependencies for PowerShell\r\nSet-ExecutionPolicy RemoteSigned\r\n# Install Microsoft Online Services (office 365)\r\nInstall-Module MSOnline\r\n# Install AzureAD\r\nInstall-Module AzureAD\r\nhttps://github.com/True-Demon/raindance\r\nPage 2 of 3\n\n# Download \u0026 Run raindance\r\ngit clone https://github.com/true-demon/raindance.git C:\\Path\\to\\Raindance\r\ncd C:\\Path\\to\\Raindance\r\nImport-Module .\\raindance.ps1\r\nDependencies\r\nWindows Only (for now): Microsoft has promised to (eventually) add Linux support for the library\r\ndependencies.\r\nPowershell v5.0+: This is due to .NET dependencies\r\nLibrary - MSOnline: Download using powershell Install-Module msonline\r\nLibrary - AzureAD: Download using powershell Install-Module AzureAD\r\nOptional\r\nIt is recommended to install chocolatey for windows to assist with installing Powershell packages\r\nSource: https://github.com/True-Demon/raindance\r\nhttps://github.com/True-Demon/raindance\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://github.com/True-Demon/raindance"
	],
	"report_names": [
		"raindance"
	],
	"threat_actors": [],
	"ts_created_at": 1775434585,
	"ts_updated_at": 1775791286,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/c3f8e4a5b97940089054ee195702c8ff72115c1a.pdf",
		"text": "https://archive.orkl.eu/c3f8e4a5b97940089054ee195702c8ff72115c1a.txt",
		"img": "https://archive.orkl.eu/c3f8e4a5b97940089054ee195702c8ff72115c1a.jpg"
	}
}