Microsoft-Analyzer-Suite (Community Edition)

A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID.

TL;DR

Automated Processing of Microsoft 365 Logs and Microsoft Entra ID Logs extracted by Microsoft-Extractor-Suite.

The following Microsoft data sources are supported yet:

Output Files of Microsoft-Extractor-Suite v4.1.0 by Invictus-IR

• Get-AdminUsers → Admins-Analyzer
• Get-Devices → Devices-Analyzer
• Get-GraphEntraAuditLogs → EntraAuditLogs-Analyzer
• Get-GraphEntraSignInLogs (EventType: interactiveUser, nonInteractiveUser) → EntraSignInLogs-Analyzer
• Get-GraphEntraSignInLogs (EventType: servicePrincipal) → ServicePrincipal-Analyzer
• Get-MailboxAuditStatus → MailboxAuditStatus-Analyzer
• Get-MailboxPermissions → MailboxPermissions-Analyzer
• Get-MessageTraceLog → MTL-Analyzer
• Get-MFA → MFA-Analyzer
• Get-OAuthPermissionsGraph → OAuthPermissions-Analyzer
• Get-RiskyDetections → RiskyDetections-Analyzer
• Get-RiskyUsers → RiskyUsers-Analyzer
• Get-UAL → UAL-Analyzer
• Get-UALGraph → UALGraph-Analyzer
• Get-Users → Users-Analyzer
• Get-TransportRules → TransportRules-Analyzer

[!TIP] Check out the Wiki for additional documentation!

Fig 1: RiskyDetections-Analyzer

Fig 2: Risky Detections (1)

Fig 3: Risky Detections (2)

Fig 4: Risky Detections (Line Chart)

Fig 5: MITRE ATT&CK Techniques (Stats)

Fig 6: RiskEventType (Stats)

Fig 7: RiskLevel (Stats)

Fig 8: Source (Stats)

Fig 9: RiskyUsers-Analyzer

Fig 10: Risky Users

Fig 11: You can specify a file path or launch the File Browser Dialog to select your log file

Contributing

Contributions and suggestions are welcome! Please feel free to submit a Pull Request.
Note: If your change is larger, or adds a feature, please contact us beforehand so that we can discuss the change.

License

This project is licensed under the MIT License - see the LICENSE file for details.

Links

Microsoft-Extractor-Suite by Invictus-IR
Microsoft-Extractor-Suite Documentation
Microsoft 365 Artifact Reference Guide by the Microsoft Incident Response Team
Awesome BEC - Repository of attack and defensive information for Business Email Compromise investigations
M365_Oauth_Apps - Repository of suspicious Enterprise Applications (BEC)
RogueApps by Huntress Labs
Microsoft First Party App Name Lookup
Tenable - Dangerous Delegated Permissions Affecting the Tenant
Tenable - Dangerous Application Permissions Affecting the Tenant
OAuthSentry - OAuth Application Intelligence
DuckDB - Fast Interactive Analytics Database