jonade

// Find Device which made MDO SafeLinks click
let Hosts = AlertEvidence
| where Title in ("A potentially malicious URL click was detected","A user clicked through to a potentially malicious URL​") | where EntityType == "Url"
| extend RemoteHost = parse_url(RemoteUrl).Host
| distinct tostring(RemoteHost);
DeviceEvents
| where ActionType == "BrowserLaunchedToOpenUrl"
| extend RemoteHost = tostring(parse_url(RemoteUrl).Host)
| where RemoteHost in (Hosts)
| project Timestamp, ActionType, DeviceId, DeviceName, InitiatingProcessId, InitiatingProcessCommandLine, ReportId, RemoteUrl, RemoteHost

jonade

$Thumbprint = (Get-ChildItem -Path cert:\LocalMachine\My | Where-Object {$_.Issuer -Match "Let's Encrypt"} | Sort NotBefore -Descending | Select-Object -First 1).Thumbprint
$WMIpath = (Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'").__path
Set-WmiInstance -Path $WMIpath -Arguments @{SSLCertificateSHA1Hash=$Thumbprint}

jonade

// Blocked Phish and Malware in mailflow
let _startTime = datetime(2024-03-22T00:00:00Z);
let _endTime = datetime(2024-04-04T23:59:59Z);
EmailEvents
| where Timestamp between (_startTime .. _endTime)
| extend MDO_detection = parse_json(DetectionMethods)
| extend FirstDetection = iif(isempty(MDO_detection), "Clean", tostring(bag_keys(MDO_detection)[0]))
| extend FirstSubcategory = iif(FirstDetection != "Clean" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, ": ", tostring(MDO_detection[FirstDetection][0])), "No Detection (clean)")
| where FirstSubcategory contains "Malware" or FirstSubcategory contains "Phish"
| summarize count(NetworkMessageId)

jonade

// Blocked Phish and Malware in mailflow let _startTime = datetime(2024-03-21T11:22:15Z); let _endTime = datetime(2024-04-04T11:22:15Z); EmailEvents | where Timestamp between (_startTime .. _endTime) | extend MDO_detection = parse_json(DetectionMethods) | extend FirstDetection = iif(isempty(MDO_detection), "Clean", tostring(bag_keys(MDO_detection)[0])) | extend FirstSubcategory = iif(FirstDetection != "Clean" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, ": ", tostring(MDO_detection[FirstDetection][0])), "No Detection (clean)") | where FirstSubcategory contains "Malware" or FirstSubcategory contains "Phish" | summarize count(NetworkMessageId)

jonade

Defender for Identity - API access

Load MSAL

$ExoModule = Get-Module -Name "ExchangeOnlineManagement" -ListAvailable | Sort-Object Version -Descending | Select-Object -First 1
$MSAL = Join-Path $ExoModule.ModuleBase "NetFramework\Microsoft.Identity.Client.dll"
Try {Add-Type -LiteralPath $MSAL | Out-Null} Catch {}

Basic Token and API access

jonade

$handles = handle.exe "C:\Program Files\WindowsPowerShell\Modules\Microsoft.Graph.Authentication\2.4.0" -nobanner -v | ConvertFrom-Csv

ForEach ($handle in $handles) {
    handle.exe -nobanner -c $handle.handle -p $handle.PID -y
}

jonade

$WorkspaceID = "<WorkspaceID>"
$WorkspaceKey = "<WorkspaceKey>"
$mma = New-Object -ComObject 'AgentConfigManager.MgmtSvcCfg'
$mma.AddCloudWorkspace($WorkspaceID, $WorkspaceKey, 1)
$mma.ReloadConfiguration()

jonade

Implementing MTA-STS for a domain

• 1. Create a DNS record for MTA-STS
• 2. Hosting a MTA-STS policy file via HTTP
  • 2.1. MTA-STS file hosted in Cloudflare Worker

1. Create a DNS record for MTA-STS

$STSRecord = "v=STSv1; id=$(Get-Date -UFormat +%Y%m%d%H%M%SZ)"
Add-DnsServerResourceRecord -Name "_mta-sts" -Txt -DescriptiveText $STSRecord -ZoneName "contoso.com" -TimeToLive 0:1:0:0

jonade

Configuring a Ubiquiti EdgeRouter to automatically update static route for KPN/XS4ALL IPTV platform

*https://kriegsman.io/

sudo vbash -c 'cat > /config/scripts/tvroute.sh' << EOF
#!/bin/vbash
  
# configured static route target
CUR_IP=$(cat /config/config.boot | grep 213.75.112.0/21 -A1 | grep next-hop | awk '{ print $2}');

jonade

Exchange Online - On-Demand Assessment

General result queries

ExchangeOnlineAssessmentRecommendation | where RecommendationResult == "Failed"

ExchangeOnlineAssessmentRecommendation | where RecommendationResult == "Failed" | sort by TimeGenerated desc

Search for errors

Look for issues with collection, likely due to MFA