gundog – PowerShell based guided hunting in Microsoft 365 Defender
Gundog provides you with guided hunting in Microsoft 365 Defender. Especially (if not only) for Email and Endpoint Alerts at the moment.
Functionality
You provide an AlertID (you might received via Email notification) and gundog will then hunt for as much as possible associated data. It does not give you the flexibility of advanced hunting like you have in the portal, but it will give you a quick, first overview of the alert, all associated entities and some enrichment.
All the hunting it does is based on the alert timestamp – so we only care about events shortly before, or after the alert.
It also provides you with PowerShell objects for each entity it hunted for – like $Network for everything it found related to this alert in the Microsoft 365 Defender DeviceNetworkEvents table.
gundog also comes up with some other features that make your life easier:
After first evaluations with gundog, you can continue in the portal to dig deeper into the rabbit hole.
Feel free to extend gundog and send me pull requests! For the best psychodelic experience, use Windows Terminal Dracula theme with gundog.
Quick Usage
mandatory parameters:
– TenantID
– ClientID
– ClientSecret
Optional parameters:
– forgetIncidents
(Background: the first thing gundog is doing is to query all incidents and alerts from the incident API from the last 30 days. These are
saved to a global variable. If you restart gundog, it will not query all incidents again, unless you set forgetIncidents to true.)
Requirements
Register an new App in AAD and give it the following permission: (How to register an app)
Microsoft Graph
– Directory.Read.All
– IdentityRiskEvent.Read.All
– IdentityRiskyUser.Read.All
– SecurityEvents.Read.All
– User.Read
Microsoft Threat Protection
– AdvancedHunting.ReadAll
– Incident.Read.All
Windows Defender ATP
– AdvancedQuery.Read.All
– Alert.Read.All
– File.Read.All
– Ip.Read.All
– Url.Read.All
– User.Read.All
– Vulnerability.Read.All
A tool crafted with simplicity in mind but harboring its own set of flaws. Despite…
CyberSentry is a robust automated scanning tool designed for web applications. It helps security professionals, ethical…
Delve into the world of DARKARMY, a potent arsenal of cybersecurity tools designed to empower…
Evade (Evasion) - this feature helps you to evade spells of enemies directed at you…
Step into the world of bug hunting with Cazador, a powerful toolkit designed to equip…
Prepare to take your Among Us gaming experience to the next level with the latest…