Beyond the Portal: Navigating Entra ID with Gemini CLI

2026.03.15 SUBJECT: AUTONOMOUS IR Kali_Linux BEC_Forensics

In this drop, we transition from hunter to responder. When investigating a Business Email Compromise (BEC) within a massive Microsoft 365 tenant, the standard Azure Portal GUI is simply too slow and abstracted. We need raw data and automation. Using the Gemini CLI as an autonomous, LLM-backed copilot, we'll navigate the complex identity surface of Microsoft Entra ID via direct REST API calls to dissect an attack in record time.

Setting Up the Command Center

During an active incident, your environment dictates your speed. Deploying the Gemini CLI on a hardened Kali node provides a frictionless interface where your natural language commands are translated directly into operational shell scripts or Azure CLI execution strings. It's like having a senior Cloud Engineer paired with you, constantly suggesting the right flags.

INSTALL_COMMANDS.SH
# Install Gemini CLI globally on the forensic node sudo npm install -g @google/gemini-cli # Initialize the autonomous assistant and authenticate gemini login

The Tactical Toolbox: Entra Audit

The immediate priority in any BEC is mapping the blast radius. We must aggressively audit the tenant's surface to identify if the adversary has escalated privileges by modifying role assignments or inviting rogue Guest users. Waiting for the portal to load these lists is unacceptable; we use the Azure CLI for immediate, JSON-formatted output.

ENTRA_AUDIT.SH
# Audit all directory role assignments to find potential backdoor admins az role assignment list --all --query "[?targetObjectType=='User']" # Identify recently added Guest users that might be attacker-controlled az ad user list --filter "userType eq 'Guest'" --query "[].{Name:displayName, UPN:userPrincipalName, Created:createdDateTime}"

Interrogating the Graph Surface

The Azure CLI has limits; the Microsoft Graph API does not. Direct API access via `az rest` allows us to query deep configuration states, such as modified Conditional Access policies. The challenge is remembering the exact endpoints and OData filter syntax. Here, Gemini excels—you tell it what you need ("Get me the CA policies modified today"), and it constructs the precise `az rest` invocation.

GRAPH_INTERROGATION.SH
# Using Graph API via az rest to check for tampered Conditional Access policies az rest --method get --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" # Querying specific user metadata using OData filters constructed by Gemini az rest --method get --url "https://graph.microsoft.com/v1.0/users?$filter=startsWith(displayName,'finctice')&$select=userPrincipalName,accountEnabled,signInActivity"

Hunting the Initial Access with KQL

Finally, we pivot from identity modifications to the initial ingress vector: the phishing email. Using KQL in Microsoft Defender, we trace the compromised user's timeline backwards to find the specific message network ID that delivered the malicious payload, establishing the root cause.

MAIL_FORENSICS.KQL
// Tracing the initial BEC phishing payload EmailEvents | where RecipientEmailAddress contains "finctice" | where Timestamp between (datetime(2026-03-08) .. datetime(2026-03-09)) | where DeliveryAction == "Delivered" // Extracting crucial metadata for further sweeping | project Timestamp, SenderMailFromAddress, Subject, NetworkMessageId, AttachmentCount | order by Timestamp desc