We’re considering moving RMM systems, and that means reevaluating parts of our stack. One of the pain points in our current stack is the monitoring of anti-virus, we often felt like there is not enough transparency and data returned via our RMM system. Either the system does not return the current state of alerts or forces us to use separate portals.

So I’ve built this for any potential RMM system, decreasing the need to switch a lot between applications, get alerted earlier and allow reporting directly from the RMM system on any threats you’ve encountered.

Quarantine monitoring

To monitor the quarantine we grab the information from the SQLLite Database that Bitdefender creates. To do that we’ll need to download the SQLLite dll that allows us access via Powershell. Remember to host this yourself somewhere. 🙂

if (!$SQLLite) {
    Invoke-WebRequest -uri "https://cyberdrain.com/wp-content/uploads/2021/02/System.Data.SQLite.dll" -UseBasicParsing -OutFile "C:\Programdata\System.Data.SQLite.dll"
}

try {
    add-type -path "C:\Programdata\System.Data.SQLite.dll"
}
catch {
    Write-Host "Could not load database components."
    exit 1
}
$con = New-Object -TypeName System.Data.SQLite.SQLiteConnection
$con.ConnectionString = "Data Source=C:\Program Files\Bitdefender\Endpoint Security\Quarantine\cache.db"
$con.Open()
$sql = $con.CreateCommand()
$sql.CommandText = "select * from entries"
$adapter = New-Object -TypeName System.Data.SQLite.SQLiteDataAdapter $sql
$data = New-Object System.Data.DataSet
[void]$adapter.Fill($data)
$sql.Dispose()
$con.Close()

$CurrentQ = foreach ($row in $Data.Tables.rows) {
    [PSCustomObject]@{
        Path               = $row.path
        Threat             = $row.threat
        Size               = $row.Size
        'Quarantined On'   = [timezone]::CurrentTimeZone.ToLocalTime(([datetime]'1/1/1970').AddSeconds($row.quartime))
        'Last accessed On' = [timezone]::CurrentTimeZone.ToLocalTime(([datetime]'1/1/1970').AddSeconds($row.acctime))
        'Last Modified On' = [timezone]::CurrentTimeZone.ToLocalTime(([datetime]'1/1/1970').AddSeconds($row.modtime))
    }
}

if ($CurrentQ) {
    write-host $CurrentQ
}
else {
    write-host "Healthy - No infections found."
}

Scan Result monitoring

Of course just monitoring the quarantine is not enough, we also want to know the results of each scan and pick that up, For that we have the next script; this checks the last scan XML file for any aberrant behaviour such as infected files or deleted ones.

$LastScanResult = (get-childitem "C:\Program Files\Bitdefender\Endpoint Security\logs\system" -Recurse -Filter "*.xml" | Sort-Object -Property LastWriteTime | Select-Object -last 1 | get-content -raw)

if (!$LastScanResult) {
    write-host "Unhealthy - could not retrieve last scan result."
    exit 1
}
$ScanResults = [PSCustomObject]@{
    Scanned       = ($LastScanResult.ScanSession.ScanSummary.TypeSummary.Scanned | measure-object -sum).Sum
    Infected      = ($LastScanResult.ScanSession.ScanSummary.TypeSummary.Infected | measure-object -sum).Sum
    suspicious    = ($LastScanResult.ScanSession.ScanSummary.TypeSummary.suspicious | measure-object -sum).Sum
    Disinfected   = ($LastScanResult.ScanSession.ScanSummary.TypeSummary.Disinfected | measure-object -sum).Sum
    Deleted       = ($LastScanResult.ScanSession.ScanSummary.TypeSummary.deleted | measure-object -sum).Sum
    Moved         = ($LastScanResult.ScanSession.ScanSummary.TypeSummary.moved | measure-object -sum).Sum
    Moved_reboot  = ($LastScanResult.ScanSession.ScanSummary.TypeSummary.moved_reboot | measure-object -sum).Sum
    Delete_reboot = ($LastScanResult.ScanSession.ScanSummary.TypeSummary.delete_reboot | measure-object -sum).Sum
    Renamed       = ($LastScanResult.ScanSession.ScanSummary.TypeSummary.renamed | measure-object -sum).Sum
}

$Alertresult = $ScanResults | Select-Object -Property * -ExcludeProperty Scanned | Where-Object { $_.psobject.properties.value -gt 0 }

if ($Alertresult) {
    write-host "Unhealthy - Last scan found issues"
    $ScanResults
}
else {
    write-host "Healthy - Last scan found no issues."
    $ScanResults
}

And that’s it! as always, Happy PowerShelling!

In one of the online communities I follow someone encountered an issue with application listeners and ports being in use. The use case is that users have a Autocad type application installed that launches a server on a specific port; the users also run a remote control application that at times steals the port.

We’ve seen this all before – IIS being installed on a server and a new application also wanting to use port 443 or port 80, so I figured I’d help by creating him a monitoring script. This script is multifunctional; you can have it alert on changed listeners, you can have it alert on a specific one you expect to be there, or you can alert on applications that should not be listening.

The Script

Change the script to your own wishes, you can either remove the if statements at the bottom, or change the variables at top. 🙂

$ExpectedApplication = "vmms"
$NotAllowedApplication = "Teamviewer"
$CompareToPrevious = $true


$Connections = Get-NetTCPConnection |  Where-Object { $_.LocalAddress -eq "0.0.0.0" -and $_.State -eq "Listen" } 
$Processes = Get-Process

$CurrentListeners = foreach ($Connection in $Connections) {
   [PSCustomObject]@{
      Process = ($Processes | Where-Object id -eq $Connection.OwningProcess).Name
      Port    = ($Connection.LocalPort)
      Path    = ($Processes | Where-Object id -eq $Connection.OwningProcess).Path
   }
}


if ($ExpectedApplication -notin $CurrentListeners.Process) {
   write-host "Unhealthy - The expected application was not found in the current process list"
}
else {
   write-host "Healthy - The expected application was found in the current process list"
}

if ($NotAllowedApplication -in $CurrentListeners.Process) {
   write-host "Unhealthy - The non-allowed application was found in the current process list"
}
else {
   write-host "Healthy - The non-allowed application was not found in the current process list"
}

if ($CompareToPrevious -eq $true) {
   $PreviousResult = Get-content -Path "C:\ProgramData\ListenerMonitor.txt" | ConvertFrom-Json
   $Result = Compare-Object $CurrentListeners $PreviousResult -Property Process,Port,Path
   if ($Result) {
      write-host "Unhealthy - The Listener list has changed."
      $Result
   }
   else {
      write-host "Healthy - The Listener list is still the same."
   }
   $CurrentListeners | ConvertTo-Json |out-file "C:\ProgramData\ListenerMonitor.txt" 
}

and that’s it! as always, Happy PowerShelling.

So this blog was requested a lot lately – I’m not a big fan of using Windows RAID anywhere but Storage Spaces is becoming more relevant each day, with S2D and larger deployments. Storage Spaces is Microsoft’s successor to the classical Windows Software RAID options.

I’ve made some scripts for both options, but I sure advise to look into Storage Spaces over classical Windows software RAID in any case.

Windows RAID Monitoring

So let’s start with the one I do not prefer, just to get it out of the way 😉 Monitoring Windows RAID is not really as straightforward as you’d expect. The issue is that it’s quite OS dependent on what data is returned via the wmi instances. To avoid using WMI/CIM we’re using diskpart instead. Diskpart prints to the console and the content is not easily converted into a PowerShell object.

So in comes regex. I found another blogger that had a visual basic script to monitor Windows RAID and used his regular expression, but converted to PowerShell instead;

try {
    $volumes = "list volume" | diskpart | Where-Object { $_ -match "^  [^-]" } | Select-Object -skip 1

    $RAIDState = foreach ($row in $volumes) {
        if ($row -match "\s\s(Volume\s\d)\s+([A-Z])\s+(.*)\s\s(NTFS|FAT)\s+(Mirror|RAID-5|Stripe|Spanned)\s+(\d+)\s+(..)\s\s([A-Za-z]*\s?[A-Za-z]*)(\s\s)*.*") {
            $disk = $matches[2] 		
            if ($row -match "OK|Healthy") { $status = "OK" }
            if ($row -match "Rebuild") { $Status = 'Rebuilding' }
            if ($row -match "Failed|At Risk") { $status = "CRITICAL" }
	
            [pscustomobject]@{
                Disk   = $Disk
                Status = $status
            }
        }
    }
    $RAIDState = $RAIDState | Where-Object { $_.Status -ne "OK" }
}
catch {
    write-output "Command has Failed: $($_.Exception.Message)"

}

if ($RAIDState) {
    write-ouput"Check Diagnostics. Possible RAID failure."
    write-ouput $RAIDState
}
else {
    write-output "Healthy - No RAID Mirror issues found"
}

And that’s it for this one. This will show the state of each disk and alert is if it anything but OK.

Monitoring Storage Spaces and physical disks

So monitoring Storage Spaces is a lot easier; the cmdlets are the same everywhere and it doesn’t require extracting information from other sources. All you need is to monitor both the physical disk, and the storage pool;

try {
    $Disks = get-physicaldisk | Where-Object { $_.HealthStatus -ne "Healthy" }
}
catch {
    write-output "Command has Failed: $($_.Exception.Message)"
    exit 1
}

if ($disks) {
    write-output "Check Diagnostics. Possible disk failure."
    write-output $disks
    exit 1
}
else {
    write-output "Healthy - No Physical Disk issues found"
}

This script would show the current physical disk health status, this is a combination of write-endurance on SSDs, SMART status for HDDs and other info that windows collects by default. You don’t need storage spaces for that portion, really.

try {
    $RAIDState = Get-VirtualDisk | where-object { $_.OperationalStatus -ne "OK"}
    }
    catch {
        write-output "Command has Failed: $($_.Exception.Message)"
        exit 1
    }
    
    if ($RAIDState) {
        write-output "Check Diagnostics. Possible RAID failure."
        write-output $RAIDState
        exit 1
    }
    else {
        write-output "Healthy - No StorageSpace issues found"
    }

And this one reports on the exact state of the virtual drive, thus if anything is wrong you’ll get an alert stating what happened. And that’s it for now! I hope you enjoyed and as always, Happy PowerShelling and I hope to see some of you at the #CyberDrainCTF!

I’ve written about monitoring BSODs some years ago. Back then I simply used a event log lookup as an example how to monitor BSODs. I never really liked that method because it did not give me all the verbosity I would’ve liked. Moments after I published that blog I’ve actually made a better monitoring set that I did not share; so I figured others might benefit from it now.

I don’t like event log based monitoring as it can get rather resource intensive and you don’t really have a way of getting all the required information out of the events; a good example is which driver actually caused the BSOD. This always meant that after a device experiences a BSOD you’d have to go to the device to check the exact reason. Boo for manual labour! 😉

So to solve this I’ve implemented NirSoft Bluescreenview.exe as a solution. Nir Sofer’s tools are freeware and fantastic for administration at MSPs. Bluescreenview.exe allows us to export all BSODs that occured in the past and displays which specific reason the blue screen had without having to go to the device.

The Script

We’re downloading Bluescreenview from Nir directly in this case, for security reason I would highly recommend hosting the zip file somewhere yourself, of course.

try {
    Invoke-WebRequest -Uri "https://www.nirsoft.net/utils/bluescreenview.zip" -OutFile "$($ENV:Temp)\bluescreeview.zip"
    Expand-Archive "$($ENV:Temp)\bluescreeview.zip" -DestinationPath "$($ENV:Temp)" -Force
    Start-Process -FilePath "$($ENV:Temp)\Bluescreenview.exe" -ArgumentList "/scomma `"$($ENV:Temp)\Export.csv`"" -Wait

}
catch {
    Write-Host "BSODView Command has Failed: $($_.Exception.Message)"
    exit 1
}

$BSODs = get-content "$($ENV:Temp)\Export.csv" | ConvertFrom-Csv -Delimiter ',' -Header Dumpfile, Timestamp, Reason, Errorcode, Parameter1, Parameter2, Parameter3, Parameter4, CausedByDriver | foreach-object { $_.Timestamp = [datetime]::Parse($_.timestamp, [System.Globalization.CultureInfo]::CurrentCulture); $_ }
Remove-item "$($ENV:Temp)\Export.csv" -Force

$BSODFilter = $BSODs | where-object { $_.Timestamp -gt ((get-date).addhours(-24)) }

if (!$BSODFilter) {
    write-host "Healthy - No BSODs found in the last 24 hours"
}
else {
    write-host "Unhealthy - BSOD found. Check Diagnostics"
    $BSODFilter 
    exit 1
}

And that’s it! this should give you a bit clearer BSODs monitoring where you can see which driver or application caused it, with just a glance. As always, Happy PowerShelling.

So let’s start with the great news first; PowerShell protect is now open-source and free to use! PowerShell Protect is a AMSI Provider for PowerShell, now technically this sounds rather complex but it pretty much means that PowerShell Protect is able to secure the PowerShell host in the same way your antivirus does.

The great thing about PowerShell Protect is that it allows you to monitor exactly which commands have been executed, but also catch them and block them for usage if you don’t trust it.

This means you can block so called LoLBas and LolBin via Powershell with relative ease. In this blog I’ll show you to do deploy PowerShell Protect, and how to monitor activity generated by it. So let’s start getting our clients more secure and less prone to persistence attacks.

Installing PowerShell Protect

Installing PowerShell Protect is done from the PowerShell gallery, the moment you install the module nothing happens yet, and you’ll need to add rules and install the actual AMSI provider. We’re using the default rules, but are also adding some rules for logging entries we want to see, as an example I’ll add logging for invoke-restmethod

This means we’ll block the following list;

• Block AMSI Bypass Protection
• Block Module and Script Block Logging Bypass Protection
• Block Assembly Load from Memory
• Block Disabling Defender
• Block Use of the System.Reflection.Emit Namespace
• Block PowerSploit(Invoke-mimikatz and derivatives.)
• Block the Marshal Class
• Block WMI Event Subscription persistance
• Block Bloodhound
• Block Kerberoasting
• Block invoke-expression

All of these rules heighten our protection against bad actors, while still allowing enough flexibility to actually use PowerShell for our day to day operations with our RMM system, so let’s deploy shall we?

 
write-host "Getting the PowerShellProtect Module" -ForegroundColor Green
If (Get-Module -ListAvailable -Name "PowerShellProtect") { 
    Import-module PowerShellProtect
}
Else { 
    Install-Module PowerShellProtect -Force
    Import-Module PowerShellProtect
}
Write-Host "Applying PowerShellProtect default settings" -ForegroundColor Green
Install-PowerShellProtect

$Condition = New-PSPCondition -Property "command" -Contains -Value "Invoke-RestMethod"
$WriteToFile = New-PSPAction -File -Path "C:\Programdata\PowerShellProtect\Log.txt" -Format "{timestamp},{rule},{ApplicationName},{UserName},{ContentPath},{Script}" -Name 'AdminFile'
$Rule = New-PSPRule -Name "LogToFile" -Action $WriteToFile -Condition $Condition

$Config = New-PSPConfiguration -Rule $Rule -Action $WriteToFile

Set-PSPConfiguration -Configuration $Config -FileSystem 

So now all invoke-restmethod requests are logged to C:\Programdata\PowershellProtect\Log.txt, and all those things up there get blocked by PowerShell too! Let’s move on to a bit of monitoring:

Monitoring the PowerShell Protect log

Because we’re outputting the log in a CSV form, it becomes easy to monitor in PowerShell, we load the file as a CSV and filter only events that happened in the last 5 minutes.

$AllEvents = import-csv 'C:\Programdata\PowerShellProtect\Log.txt' -Header timestamp, rule, ApplicationName, UserName, ContentPath  -Delimiter ',' | ForEach-Object { $_.Timestamp = [datetime]::ParseExact($_.timestamp, "dd/MM/yyyy HH:mm:ss", $null); $_ }

$FilteredEvents = $AllEvents | Where-Object { $_.timestamp -gt (Get-Date).ToUniversalTime().AddMinutes(-5) }

if ($FilteredEvents) {
    write-host "Unhealthy - Events found. "
    $FilteredEvents
} else {
    Write-Host "Healty - No events found."
}

So this outputs if there are no events found, or when there are events it’ll output exactly what was found, the time and date, which executable ran the script and to top it off which user executed the command.

And that’s it! there’s a lot more to PowerShell protect and I’ll probably make a second blog about it soon, right after I assist the project with some changes 😉

As always, Happy PowerShelling!

We’re in the middle of WVD deployment at my MSP. This client is located all over the world and needed an easy way to manage virtual desktops over many regions. This deployment actually got me thinking about how monitoring the WVD environment should be done.

We found that the WVD agent on the VMs at times did not finish the upgrade correctly, or that session hosts became unavailable at inopportune times such as when there is a high logon load. Of course we could’ve setup some Azure Alerts for this but that would be forgoing our RMM system as the single source of alerts, so as always; in comes PowerShell.

As you can’t directly retrieve the information if a session host is available from the VMs themselves I’ve made a script that checks their status via the Azure management plane, it picks up if the updates have been installed correctly, heartbeats aren’t missed, and of course if the session host is actually available. As we’ve also had issues in the past with people forgetting to remove Drain Mode from a WVD pool I’ve also added this.

The Script

The script checks all tenants that are in Lighthouse, if you haven’t configured lighthouse yet, check out my manual here. You can change the alerts to whichever you’d like.

######### Secrets #########S
$ApplicationId = 'AppID'
$ApplicationSecret = 'ApplicationSecret' | ConvertTo-SecureString -Force -AsPlainText
$TenantID = 'YourTenantID'
$RefreshToken = 'yourrefreshtoken'
$UPN = "UPN-Used-To-Generate-Tokens"
######### Secrets #########
If (Get-Module -ListAvailable -Name Az.DesktopVirtualization) { 
    Import-module Az.DesktopVirtualization
}
Else { 
    Install-PackageProvider NuGet -Force
    Set-PSRepository PSGallery -InstallationPolicy Trusted
    Install-Module -Name Az.DesktopVirtualization -force
}
$credential = New-Object System.Management.Automation.PSCredential($ApplicationId, $ApplicationSecret)
$azureToken = New-PartnerAccessToken -ApplicationId $ApplicationID -Credential $credential -RefreshToken $refreshToken -Scopes 'https://management.azure.com/user_impersonation' -ServicePrincipal -Tenant $TenantId
$graphToken = New-PartnerAccessToken -ApplicationId $ApplicationID -Credential $credential -RefreshToken $refreshToken -Scopes 'https://graph.microsoft.com/.default' -ServicePrincipal -Tenant $TenantId
 
Connect-Azaccount -AccessToken $azureToken.AccessToken -GraphAccessToken $graphToken.AccessToken -AccountId $upn -TenantId $tenantID
$Subscriptions = Get-AzSubscription  | Where-Object { $_.State -eq 'Enabled' } | Sort-Object -Unique -Property Id
$SessionHostState = foreach ($Sub in $Subscriptions) {
    $null = $Sub | Set-AzContext

    $WVDHostPools = Get-AzResource -ResourceType 'Microsoft.DesktopVirtualization/hostpools'
    if (!$WVDHostpools) {
        write-host "No hostpool found for tenant $($Sub.name)"
        continue
    }
    write-host "Found hostpools. Checking current availibility status"
    foreach ($HostPool in $WVDHostPools) {
        $AllHPState = get-AzWvdsessionhost -hostpoolname $Hostpool.name -resourcegroupname $hostpool.resourcegroupname 
        Foreach ($State in $AllHPState) {
            [PSCustomObject]@{
                HostName         = $State.Name
                Available        = $State.Status
                Heartbeat        = $State.LastHeartBeat
                UpdateState      = $State.UpdateState
                LastUpdate       = $State.LastUpdateTime
                AllowNewSessions = $State.AllowNewSession
                Subscription     = $Sub.Name
            
            }
        }
    }

}

#Check for WVD Session hosts that have issues updating the agent:

if (($SessionHostState | Where-Object { $_.UpdateState -ne 'Succeeded' })) {
    write-host "Unhealthy - Some session hosts have not updated the Agent correctly."
    $SessionHostState | Where-Object { $_.UpdateState -ne 'Succeeded' }
}
else {
    write-host "Healthy - Session hosts all updated."   
}


#Check for unavailable hosts
if (($SessionHostState | Where-Object { $_.Available -ne 'Available' })) {
    write-host "Unhealthy - Some session hosts are unavailable."
    $SessionHostState | Where-Object { $_.Available -ne 'Available' }
}
else {
    write-host "Healthy - Session hosts all updated."   
}

#Check for hosts in drain mode
if (($SessionHostState | Where-Object { $_.AllowNewSessions -eq $false })) {
    write-host "Unhealthy - Some session hosts are in drain mode"
    $SessionHostState | Where-Object { $_.AllowNewSessions -eq $false }
}
else {
    write-host "Healthy - No sessionhosts in drain mode."   
}

And that’s it. As always, Happy PowerShelling!

So Microsoft offers a lot of cool tools for Microsoft 365 users, even if you aren’t using the complete suite. One of these is potential phishing detection, by default Microsoft does an analysis of each received e-mail to check if they are potential phishing attempts. You can check these via the interface by going to protection.office.com, Threat Management and clicking on the dashboard.

Of course that’s nice to do a one-off check, but we like getting alerted whenever we see these phishing attempts get above a specific number. For this, we can of course use PowerShell.

By using the PowerShell cmdlet ‘Get-ATPTotalTrafficReport’ (Don’t worry, you don’t need ATP.) we can get the reports from the interface in text format. This allows us to alert whenever a phishing campaign is started and exceeds a threshold we set.

For these scripts you’ll need the Secure Application Model first, to be able to login securely and according to Microsoft’s partner standards. There’s two different versions of the script; one for a single tenant, and another for all tenants under your administration.

Single tenant version

All you have to do for the single tenant version is to enter your credentials, and set what you believe is the maximum phishing attempts for 2 weeks.

######### Secrets #########
$ApplicationId = 'YourAPPID'
$ApplicationSecret = 'Applicationsecret' | ConvertTo-SecureString -AsPlainText -Force
$TenantID = 'YourTenantID'
$RefreshToken = 'RefreshToken'
$ExchangeRefreshToken = 'ExchangeRefreshToken'
$UPN = "UPN-Used-To-Generate-Tokens"
$TenantToCheck = 'testtenant.onmicrosoft.com'
$MaximumPhishingAttempts = 100
######### Secrets #########

$credential = New-Object System.Management.Automation.PSCredential($ApplicationId, $ApplicationSecret)

$aadGraphToken = New-PartnerAccessToken -ApplicationId $ApplicationId -Credential $credential -RefreshToken $refreshToken -Scopes 'https://graph.windows.net/.default' -ServicePrincipal -Tenant $tenantID 
$graphToken = New-PartnerAccessToken -ApplicationId $ApplicationId -Credential $credential -RefreshToken $refreshToken -Scopes 'https://graph.microsoft.com/.default' -ServicePrincipal -Tenant $tenantID 
$token = New-PartnerAccessToken -ApplicationId 'a0c73c16-a7e3-4564-9a95-2bdf47383716'-RefreshToken $ExchangeRefreshToken -Scopes 'https://outlook.office365.com/.default' -Tenant $TenantToCheck -erroraction SilentlyContinue

$tokenValue = ConvertTo-SecureString "Bearer $($token.AccessToken)" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($upn, $tokenValue)
write-host "Proccessing $TenantToCheck"
$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://ps.outlook.com/powershell-liveid?DelegatedOrg=$($TenantToCheck)&BasicAuthToOAuthConversion=true" -Credential $credential -Authentication Basic -AllowRedirection -ErrorAction SilentlyContinue
$null = Import-PSSession $session -AllowClobber -CommandName 'Get-ATPTotalTrafficReport' -ErrorAction SilentlyContinue
$Reports = Get-ATPTotalTrafficReport -ErrorAction SilentlyContinue
$TenantReports = [PSCustomObject]@{
    TenantDomain       = $TenantToCheck
    TotalSafeLinkCount = ($Reports | where-object { $_.EventType -eq 'TotalSafeLinkCount' }).Messagecount
    TotalSpamCount     = ($Reports | where-object { $_.EventType -eq 'TotalSpamCount' }).Messagecount
    TotalBulkCount     = ($Reports | where-object { $_.EventType -eq 'TotalBulkCount' }).Messagecount
    TotalPhishCount    = ($Reports | where-object { $_.EventType -eq 'TotalPhishCount' }).Messagecount
    TotalMalwareCount  = ($Reports | where-object { $_.EventType -eq 'TotalMalwareCount' }).Messagecount
    DateOfReports      = "$($Reports.StartDate | Select-Object -Last 1) - $($Reports.EndDate | Select-Object -Last 1)"
}
#end of commands
Remove-PSSession $session -ErrorAction SilentlyContinue

$TenantReports | Where-Object {$_.TotalPhishCount -gt $MaximumPhishingAttempts}

Multiple tenant version

This version does the same as above, but then for all tenants under your administration as Microsoft Partner.

######### Secrets #########
$ApplicationId = 'YourAPPID'
$ApplicationSecret = 'Applicationsecret' | ConvertTo-SecureString -AsPlainText -Force
$TenantID = 'YourTenantID'
$RefreshToken = 'RefreshToken'
$ExchangeRefreshToken = 'ExchangeRefreshToken'
$UPN = "UPN-Used-To-Generate-Tokens"
$MaximumPhishingAttempts = 100
######### Secrets #########


$credential = New-Object System.Management.Automation.PSCredential($ApplicationId, $ApplicationSecret)
$aadGraphToken = New-PartnerAccessToken -ApplicationId $ApplicationId -Credential $credential -RefreshToken $refreshToken -Scopes 'https://graph.windows.net/.default' -ServicePrincipal -Tenant $tenantID 
$graphToken = New-PartnerAccessToken -ApplicationId $ApplicationId -Credential $credential -RefreshToken $refreshToken -Scopes 'https://graph.microsoft.com/.default' -ServicePrincipal -Tenant $tenantID 

Connect-MsolService -AdGraphAccessToken $aadGraphToken.AccessToken -MsGraphAccessToken $graphToken.AccessToken
$customers = Get-MsolPartnerContract -All
$TenantReports = foreach ($customer in $customers) {
    $token = New-PartnerAccessToken -ApplicationId 'a0c73c16-a7e3-4564-9a95-2bdf47383716'-RefreshToken $ExchangeRefreshToken -Scopes 'https://outlook.office365.com/.default' -Tenant $customer.TenantId -erroraction SilentlyContinue
    $tokenValue = ConvertTo-SecureString "Bearer $($token.AccessToken)" -AsPlainText -Force
    $credential = New-Object System.Management.Automation.PSCredential($upn, $tokenValue)
    $customerId = $customer.DefaultDomainName
    write-host "Proccessing $customerid"
    $session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://ps.outlook.com/powershell-liveid?DelegatedOrg=$($customerId)&BasicAuthToOAuthConversion=true" -Credential $credential -Authentication Basic -AllowRedirection -ErrorAction SilentlyContinue
    $null = Import-PSSession $session -AllowClobber -CommandName 'Get-ATPTotalTrafficReport' -ErrorAction SilentlyContinue
    #From here you can enter your own commands
    $Reports = Get-ATPTotalTrafficReport -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        TenantID           = $customer.TenantId
        TenantName         = $customer.name
        TenantDomain       = $customer.DefaultDomainName
        TotalSafeLinkCount = ($Reports | where-object { $_.EventType -eq 'TotalSafeLinkCount' }).Messagecount
        TotalSpamCount     = ($Reports | where-object { $_.EventType -eq 'TotalSpamCount' }).Messagecount
        TotalBulkCount     = ($Reports | where-object { $_.EventType -eq 'TotalBulkCount' }).Messagecount
        TotalPhishCount    = ($Reports | where-object { $_.EventType -eq 'TotalPhishCount' }).Messagecount
        TotalMalwareCount  = ($Reports | where-object { $_.EventType -eq 'TotalMalwareCount' }).Messagecount
        DateOfReports      = "$($Reports.StartDate | Select-Object -Last 1) - $($Reports.EndDate | Select-Object -Last 1)"
    }
    #end of commands
    Remove-PSSession $session -ErrorAction SilentlyContinue
}

$TenantReports | Where-Object {$_.TotalPhishCount -gt $MaximumPhishingAttempts}

And that’s it! as always, Happy PowerShelling.

So let’s talk about Storage Sense. Storage Sense is a new-ish feature in Windows 10 which should replace the standard disk cleanup utilities. It has a lot more power than just disk cleanup as it can detect how long files have been in use and react based on age.

Storage Sense is pretty easy to use and can save a lot of disk space for modern clients, especially when they use OneDrive too. Storage Sense has support for OneDrive files on demand. By default it does not clear anything, but it could be setup to clear the local cache if files have not been in use for days, weeks, or even months. This helps with those pesky OneDrive database size limits.

So the first blog about Storage Senses will be monitoring its optimal settings. We’re using the RunAsUser Module for this, because the registry keys will be located in the HKEY_Current_User hive.

Monitoring script

#Settings
$PrefSched = 'Low Diskspace'
$ClearTemporaryFiles = $true
$ClearRecycler = $true
$ClearRecyclerDays = '60'
$ClearDownloads = $true
$ClearDownloadsDays = '60'
$AllowClearOneDriveCache = $true
#

If (Get-Module -ListAvailable -Name "RunAsUser") { 
    Import-module RunAsUser
}
Else { 
    Install-PackageProvider NuGet -Force
    Set-PSRepository PSGallery -InstallationPolicy Trusted
    Install-Module RunAsUser -force -Repository PSGallery
}


$ExpectedSettings = [PSCustomObject]@{
    'Storage Sense Enabled'         = $true
    'Clear Temporary Files'         = $ClearTemporaryFiles
    'Clear Recycler'                = $ClearRecycler
    'Clear Downloads'               = $ClearDownloads
    'Allow Clearing Onedrive Cache' = $AllowClearOneDriveCache
    'Storage Sense schedule'        = $PrefSched
    'Clear Downloads age (Days)'    = $ClearDownloadsDays
    'Clear Recycler age (Days)'     = $ClearRecyclerDays
} 

$ScriptBlock = {
    $StorageSenseKeys = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\StoragePolicy\'

    $StorageSenseSched = switch ($StorageSenseKeys.'2048') {
        1 { 'Weekly' }
        7 { 'Every week' }
        30 { 'Every Month' }
        0 { 'Low Diskspace' }
        Default { 'Unknown - Could not retrieve.' }
    }

    [PSCustomObject]@{
        'Storage Sense Enabled'         = [boolean]$StorageSenseKeys.'01'
        'Clear Temporary Files'         = [boolean]$StorageSenseKeys.'04'
        'Clear Recycler'                = [boolean]$StorageSenseKeys.'08'
        'Clear Downloads'               = [boolean]$StorageSenseKeys.'32'
        'Allow Clearing Onedrive Cache' = [boolean]$StorageSenseKeys.CloudfilePolicyConsent
        'Storage Sense schedule'        = $StorageSenseSched
        'Clear Downloads age (Days)'    = $StorageSenseKeys.'512'
        'Clear Recycler age (Days)'     = $StorageSenseKeys.'256'
    } | ConvertTo-Json | Out-File "C:\windows\Temp\CurrentStorageSenseSettings.txt" -Force

 
}

$null = Invoke-AsCurrentUser -ScriptBlock $ScriptBlock -UseWindowsPowerShell -NonElevatedSession
$CurrentSettings = Get-Content  "C:\windows\Temp\CurrentStorageSenseSettings.txt" | ConvertFrom-Json

$ComparedObjects = Compare-Object $CurrentSettings $ExpectedSettings -Property $CurrentSettings.PsObject.Properties.name

if ($ComparedObjects) {
    Write-Host "Unhealthy - The Storage Sense settings are not the same as the expected settings."
}
else {
    write-host "Healthy - Storage Sense Settings are set correctly."
}

And that’s it. Next week I’ll be demonstrating how to setup Storage Sense automatically, including adding OneDrive sites. As always, Happy PowerShelling!

One of my team members was following Blackhat today and showed me a pretty cool tool they demonstrated during the conference. The presenters showed a method of checking if your O365 domain was being Typosquated. The tool can be found here. The presenters made a Python tool, and I figured to create an alternative in PowerShell.

I’ve checked their method and found they use two different typosquating detection techniques; they’ve applied homoglyphs and BitSquating. These two techniques are most common in Typosquats, its either replacing characters with similar looking ones, or minor typos in the URL.

In my version, I’ve also introduced pluralization and omission, just to get a bit more domain names, I’m not saying this is a 100% extensive list. If you have any suggested changes feel free to make a GitHub PR here.

The script

To run the script, simply change the domain name at the end of the script and execute it. The script contains two functions; New-TypoSquatDomain which generate a list of typosquated domains and Get-O365TypoSquats which checks if the .onmicrosoft.com, .sharepoint.com and the domain itself are available.

So what can you do with this information? if the .onmicrosoft.com version exists, you can add this to your spamfilter to prevent spam, If the .sharepoint.com version exist people might be phishing you using SharePoint online URLS, and if the domain exists you could add it to the spamfilter or check what’s running there and notify your users.

function New-TypoSquatDomain {
    param (
        $DomainName
    )
    $ReplacementGylph = [pscustomobject]@{
        0  = 'b', 'd' 
        1  = 'b', 'lb' 
        2  = 'c', 'e'
        3  = 'd', 'b'
        4  = 'd', 'cl'
        5  = 'd', 'dl' 
        6  = 'e', 'c' 
        7  = 'g', 'q' 
        8  = 'h', 'lh' 
        9  = 'i', '1'
        10 = 'i', 'l' 
        11 = 'k', 'lk'
        12 = 'k', 'ik'
        13 = 'k', 'lc' 
        14 = 'l', '1'
        15 = 'l', 'i' 
        16 = 'm', 'n'
        17 = 'm', 'nn'
        18 = 'm', 'rn'
        19 = 'm', 'rr' 
        20 = 'n', 'r'
        21 = 'n', 'm'
        22 = 'o', '0'
        23 = 'o', 'q'
        24 = 'q', 'g' 
        25 = 'u', 'v' 
        26 = 'v', 'u'
        27 = 'w', 'vv'
        28 = 'w', 'uu' 
        29 = 'z', 's' 
        30 = 'n', 'r' 
        31 = 'r', 'n'
    }
    $i = 0

    $TLD = $DomainName -split '\.' | Select-Object -last 1
    $DomainName = $DomainName -split '\.' | Select-Object -First 1
    $HomoGlyph = do {
        $NewDomain = $DomainName -replace $ReplacementGylph.$i
        $NewDomain
        $NewDomain + 's'
        $NewDomain + 'a'
        $NewDomain + 't'
        $NewDomain + 'en'
        $i++
    } while ($i -lt 29)

    $i = 0
    $BitSquatAndOmission = do {
        $($DomainName[0..($i)] -join '') + $($DomainName[($i + 2)..$DomainName.Length] -join '')
        $($DomainName[0..$i] -join '') + $DomainName[$i + 2] + $DomainName[$i + 1] + $($DomainName[($i + 3)..$DomainName.Length] -join '')
        $i++
    } while ($i -lt $DomainName.Length)
    $Plurals = $DomainName + 's'; $DomainName + 'a'; $domainname + 'en' ;  ; $DomainName + 't'

    $CombinedDomains = $HomoGlyph + $BitSquatAndOmission + $Plurals | ForEach-Object { "$($_).$($TLD)" }
    return ( $CombinedDomains | Sort-Object -Unique | Where-Object { $_ -ne $DomainName })
}

function Get-O365TypoSquats {
    param (
        $TypoSquatedDomain
    )
    $DomainWithoutTLD = $TypoSquatedDomain -split '.' | Select-Object -First 1
    $DomainTest = Resolve-DnsName -Type A "$($TypoSquatedDomain)" -ErrorAction SilentlyContinue
    $Onmicrosoft = Resolve-DnsName -Type A "$($DomainWithoutTLD).onmicrosoft.com" -ErrorAction SilentlyContinue
    $Sharepoint = Resolve-DnsName -Type A "$($DomainWithoutTLD).sharepoint.com" -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        'Onmicrosoft test' = [boolean]$Onmicrosoft
        'Sharepoint test'  = [boolean]$Sharepoint
        'Domain test'      = [boolean]$DomainTest
        Domain             = $TypoSquatedDomain
    }
}

New-TypoSquatDomain -DomainName 'Google.com' | ForEach-Object { Get-O365TypoSquats -TypoSquatedDomain $_ }

You can load this script into your RMM system and alert whenever results are found.

And that’s it! as always, Happy PowerShelling!