You phished a token, found a leaked PAT, or popped a single low-privilege identity. Now you're staring at an Azure DevOps organization wondering what's actually within reach. This is the part that never makes the breach report: what an operator does in the hours after initial access.

Azure DevOps is a pivot that most defenders overlook. It's a CI/CD plane wired straight into the cloud tenant it deploys to. It's full of secrets and standing trust nobody watches. We'll walk a full post-exploitation chain the way real intrusion sets run it: enumeration, credential harvesting, privilege escalation, and OPSEC-aware exfiltration. You'll see secrets pulled out of pipeline variables and variable groups, a misconfigured repo turned into lateral movement, and service connections abused until one forgotten environment variable bridges a single project into tenant-wide control.

All of it runs on Beachhead, an open-source toolkit we're releasing at the talk. It takes "I wonder what this does" on one resource and turns it into a foothold across the whole tenant.

This isn't offense for its own sake. It's adversary emulation. Every technique gets mapped to the groups already using it in the wild and paired with the telemetry it generates. Red teamers get a playbook they can actually reuse. Defenders get the detection side: what every step looks like in the logs.

Beachhead came out of real engagements where Azure DevOps turned out to be the fastest path to compromise. Enumeration frameworks lean hard on Entra ID and Azure Resource Manager, but ADO sits off to the side holding pipeline secrets, variable groups, and service connections that are wired straight into the cloud it deploys to. Defenders rarely watch it closely and operators rarely have tooling for it. Beachhead fills that gap.

Beachhead takes a single Azure DevOps personal access token, the kind you get from a phished session, a leaked PAT in a repo, or a low-privilege identity, and turns it into a full picture of the organization. It enumerates orgs, projects, repositories, pipelines, service connections, and variable groups, then harvests secrets out of pipeline variables and variable groups, flags repos and service connections that are misconfigured or over-privileged, and maps the privilege escalation and lateral movement paths between them. The end state is the chain from the talk: one token in, tenant-wide leverage out, with OPSEC-aware exfiltration at the end.

The toolkit is written mainly in Python and PowerShell. Everything authenticates with a standard ADO PAT, so there are no extra credentials to plant and nothing unusual for the service to see. Results are emitted as JSON by default, so each stage feeds cleanly into the next. Beachhead is built to stay quiet rather than smash through. Requests are rate-limited with jitter so the call pattern doesn't read as a script running flat out, and most of the calls it makes are ordinary user behavior against the standard ADO REST API, so they don't stand out in the logs. It is read-only by default and avoids failed-auth and access-denied events, which are some of the loudest signals in ADO and Entra telemetry, by respecting the PAT's actual scope instead of blindly probing. Enumeration is targeted by project and by date/time window rather than sweeping the whole org, which keeps both the request volume and the audit footprint down.

What makes Beachhead worth adding to your kit is that it treats Azure DevOps as a complete attack surface rather than a single trick. Existing tools might dump a pipeline variable or list projects; Beachhead chains the whole thing, from first enumeration through service-connection abuse into tenant-wide control. This is not theoretical. Team PCP run this exact pattern in the wild, and Beachhead is built to emulate it faithfully so red teams can reproduce it and defenders can see it.

Every module documents the telemetry it generates, mapped to Azure DevOps audit streams, Azure activity logs, and sign-in logs, so the toolkit ships detection content alongside the offense. That is the point: the demo is as useful to the blue team as the red. Beachhead has been tested on live engagements and is being hardened and polished ahead of DEF CON. It will be public and open-source by the talk