hawk
Business-Email-Compromise-Guide
Our great sponsors
| hawk | Business-Email-Compromise-Guide | |
|---|---|---|
| 14 | 6 | |
| 651 | 210 | |
| - | - | |
| 3.9 | 0.0 | |
| 3 months ago | about 3 years ago | |
| PowerShell | ||
| MIT License | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
hawk
- Hawk Repo
-
Message Trace O365
I recommend checking this out btw https://github.com/T0pCyber/hawk
-
Office 365 Outlook rules automatically generating
run HAWK against the mailbox and it should surface something useful.
- Useful Email Compromise resource
- Compromised Email HOW?
-
Crazy Email Hacking
Use https://github.com/T0pCyber/hawk on the mailbox, it will show you everything you need to know. it knows what to look for, and produces a report on all the suss activities. Ive learnt best from letting it do its job then seeing what it found.
-
What do you use for your office 365 security routines and what routines do you perform?
HAWK is a great tool to investigate for suspicious activity. Its no silver bullet, but it does even dump a list of suspect accounts when you run the Tenant Investigation command. Probably with a little bit of work you could script HAWK to run automatically in bulk.
- User got phished. I asked her to think back and try to remember if she'd got an attachment that required login.
- Track down how account was compromised.
-
Office 365 audit log for compromised account
Have you ran the Powershell HAWK Tool ? https://github.com/T0pCyber/hawk
Business-Email-Compromise-Guide
-
Help me describe this type of "attack"
you may find this helpful: https://github.com/PwC-IR/Business-Email-Compromise-Guide
- Useful Email Compromise resource
-
What is the standard practice of dealing with a successful phishing attempt in O365?
This one is also really good imo PWC BEC Guide
- Office 365 audit log for compromised account
-
Do you have a data breach response plan for your clients?
I've written my own internal business email compromise plan, which just covers e-mail - but may be a good start for you. I can't share my own plan, but I found a very good guide from PwC that's publicly available on GitHub: https://github.com/PwC-IR/Business-Email-Compromise-Guide
-
Protect O365-users against phishing?
A while ago someone from PwC posted the PwC BEC handbook. I can't remember who it was again, so I'm sorry to not give credits to him right now! I've made a BEC handbook for myself in the past, but I'm thinking of using the PwC one instead since it's so incredibly detailed. I think it's very useful. You can find it here.
What are some alternatives?
PowerShell - PowerShell functions and scripts (Azure, Active Directory, SCCM, SCSM, Exchange, O365, ...)
O365-InvestigationTooling
o365recon - retrieve information via O365 and AzureAD with a valid cred
monkey365 - Monkey365 provides a tool for security consultants to easily conduct not only Microsoft 365, but also Azure subscriptions and Microsoft Entra ID security configuration reviews.
office365 - Repo for containing and managing office 365 scripts for my customers, techs and others. If you have any questions please feel free to hit me up.
CrpUsernameStuffing - PS Script to stuff usernames into NPS Connection Request Policies
Export-RecipientPermissions - Document, filter and compare Exchange permissions: Mailbox access rights, mailbox folder permissions, public folder permissions, send as, send on behalf, managed by, moderated by, linked master accounts, forwarders, sender restrictions, resource delegates, group members, management role group members
BadZure - BadZure orchestrates the setup of Azure AD tenants, populating them with diverse entities while also introducing common security misconfigurations to create vulnerable tenants with multiple attack paths.
gophish - Open-Source Phishing Toolkit
orca - The Microsoft Defender for Office 365 Recommended Configuration Analyzer (ORCA)
SophosCentral - Sophos Central PowerShell module
PSKoans - A simple, fun, and interactive way to learn the PowerShell language through Pester unit testing.