Osprey

1.0.1

Microsoft 365 Incident Response and Threat Hunting PowerShell tool.
   Osprey is designed to ease the burden on M365 administrators who are performing Cloud forensic tasks for their organization.
   It accelerates the gathering of data from multiple sources in the service that be used to quickly identify malicious presence and activity.

Minimum PowerShell version

5.0

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name Osprey -RequiredVersion 1.0.1

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name Osprey -Version 1.0.1

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

Copyright (c) 2024 Damien Miller-McAndrews

Package Details

Author(s)

  • Damien Miller-McAndrews

Tags

O365 Security Audit Breach Investigation Exchange Forensics M365 Incident_Response HAWK BEC Business_Email_Compromise

Functions

Show-OspreyHelp Start-Osprey Update-OspreyModule Get-OspreyMessageHeader Get-OspreyTenantConfiguration Get-OspreyTenantDomainActivity Get-OspreyTenantEDiscoveryConfiguration Get-OspreyTenantEDiscoveryLogs Get-OspreyTenantEntraAdmins Get-OspreyTenantEntraUsers Get-OspreyTenantExchangeAdmins Get-OspreyTenantExchangeLogs Start-OspreyTenantInvestigation Get-OspreyTenantAppAndSPNCredentialDetails Get-OspreyTenantAuthHistory Get-OspreyTenantInboxRules Get-OspreyTenantMailItemsAccessed Search-OspreyTenantActivityByIP Get-OspreyUserAuthHistory Get-OspreyUserAutoReply Get-OspreyUserConfiguration Get-OspreyUserDevices Get-OspreyUserEmailActivity Get-OspreyUserEmailForwarding Get-OspreyUserInboxRule Get-OspreyUserMessageTrace Get-OspreyUserPWNCheck Start-OspreyUserInvestigation Get-OspreyUserFileAccess

Dependencies

Release Notes

## 1.0.1 (2024-08-16)
- Moved IP lookup API back to IPStack, intention is to eventually allow choice between a few different options.
- Added function Get-OspreyUserFileAccess to get file access and sharing records, and flag suspicious access and anonymous sharing.
- Updated Test-GraphConnection and added to functions it was missing from.

## 1.0.0 (2024-08-15)
- Forked Hawk module, renamed to Osprey.
- Removed JSON and XML export details from appearing in console output.
- Moved JSON output to specific folder.
- Added Start-Osprey function to remove need to connect to EXO and Graph ahead of time, allow for changing investigation parameters or tenant without exiting PowerShell.
- Temporarily deprecated Get-OspreyTenantAppAndSPNCredentialDetails.
- Merged Get-OspreyTenantAzureAppAuditLog and Get-OspreyTenantConsentGrants into one function called Get-OspreyTenantAppsAndConsents.
- Added function to pull list of known suspicious Azure applications from GitHub and flag if any exist in tenant.
- Migrated remaining functions that required deprecated Search-AdminAuditLog command to use output from the UAL, where possible.
- Replaced Azure with Entra, where applicable.
- Added ability for Get-OspreyTenantEntraUsers to get a list of all users created during the investigation period.
- Updated suspicious inbox rule flag to look for rules where emails are redirected into certain known-suspicious folders, or are deleted.
- Moved RBAC obtaining function to Get-ospreyTenantExchangeLogs.
- Moved IPStack API to free alternative temporarily.
- Deprecated Get-OspreyUserAdminAudit as no suitable way to properly migrate to UAL was found.
- Fixed Get-OspreyUserMessageTrace to get 10 days of email instead of 2
- Renamed Get-OspreyUserMobileDevices to Get-OspreyUserDevices and added ability to get Entra joined/registered devices and flag any recently added.
- Attempted to fix Get-OspreyUserEmailActivity. It sort of works but outputs into different CSVs for each activity.
- Moved majority of outputs that did appending into PSCustomObjects to reduce console output noise.
- Removed Get-OspreyUserHiddenRule as -Hidden flag is available in normal Get-InboxRule command.
- Updated Premium license detection to add additional SKUs
- Removed Known Microsoft IP check due to issues, will bring it back eventually.

FileList

Version History

Version Downloads Last updated
1.0.3 14 10/5/2024
1.0.2 29 9/2/2024
1.0.1 (current version) 20 8/16/2024