Microsoft-Analyzer-Suite v1.4.0
[1.4.0] - 2025-02-24
Added
- UAL-Analyzer: Detection of suspicious Inbox Rules via RegEx (incl. Conditional Formatting)
- UAL-Analyzer: MoveToFolder-Blacklist.csv
- UAL-Analyzer: UniqueTokenId and IssuedAtTime added to Hunt View → correlate with SignInLogs
- UAL-Analyzer: RecordType / Id (Stats)
- UAL-Analyzer: Line Charts - SharePoint (Workload), OneDrive (Workload), and FileDownloaded (SharePoint and OneDrive)
- OAuthPermissions-Analyzer: Microsoft Graph Edition
- OAuthPermissions-Analyzer: Detection of suspicious OAuth Apps (Anomalous ReplyUrls, Common Naming Patterns)
Fixed
- Minor fixes and improvements
Fig 1: OAuthPermissions-Analyzer → Find suspicious M365 OAuth applications
Fig 2: OAuthPermissions-Analyzer → Detect blacklisted M365 OAuth applications (Traitorware)
Fig 3: OAuthPermissions-Analyzer → 'AppOwnerOrganizationId' helps to identify the 'ApplicationType'
Fig 4: OAuthPermissions-Analyzer → OAuthPermissions (Hunt View)
Fig 5: OAuthPermissions-Analyzer → Anomalous ReplyUrls (Hunt View)