gundog – PowerShell based guided hunting in Microsoft 365 Defender
Gundog provides you with guided hunting in Microsoft 365 Defender. Especially (if not only) for Email and Endpoint Alerts at the moment.
Functionality
You provide an AlertID (you might received via Email notification) and gundog will then hunt for as much as possible associated data. It does not give you the flexibility of advanced hunting like you have in the portal, but it will give you a quick, first overview of the alert, all associated entities and some enrichment.
All the hunting it does is based on the alert timestamp – so we only care about events shortly before, or after the alert.
It also provides you with PowerShell objects for each entity it hunted for – like $Network for everything it found related to this alert in the Microsoft 365 Defender DeviceNetworkEvents table.
gundog also comes up with some other features that make your life easier:
After first evaluations with gundog, you can continue in the portal to dig deeper into the rabbit hole.
Feel free to extend gundog and send me pull requests! For the best psychodelic experience, use Windows Terminal Dracula theme with gundog.
Quick Usage
mandatory parameters:
– TenantID
– ClientID
– ClientSecret
Optional parameters:
– forgetIncidents
(Background: the first thing gundog is doing is to query all incidents and alerts from the incident API from the last 30 days. These are
saved to a global variable. If you restart gundog, it will not query all incidents again, unless you set forgetIncidents to true.)
Requirements
Register an new App in AAD and give it the following permission: (How to register an app)
Microsoft Graph
– Directory.Read.All
– IdentityRiskEvent.Read.All
– IdentityRiskyUser.Read.All
– SecurityEvents.Read.All
– User.Read
Microsoft Threat Protection
– AdvancedHunting.ReadAll
– Incident.Read.All
Windows Defender ATP
– AdvancedQuery.Read.All
– Alert.Read.All
– File.Read.All
– Ip.Read.All
– Url.Read.All
– User.Read.All
– Vulnerability.Read.All
JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…
The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…
Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…
SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…
Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…
Cybersecurity tools play a critical role in safeguarding digital assets, systems, and networks from malicious…