Git Product home page Git Product logo

kitt-o365-tool's Introduction

KITT-O365-Tool

KITT - An Open Source PowerShell O365 Business Email Compromise Investigation Tool

Welcome to KITT - This is a tool designed to make working O365 Business Email Compromise investigations easier and more efficient for DFIR and SOC analysts by pairing the power of PowerShell cmdlets with the ease of use of a GUI. KITT was built using Sapien's PowerShell Studio. Dates are set to UTC.

Powershell Cmdlet limitations limit the pulling of AzureAD SignIn Logs to 30 days, and Message Trace Logs to 10 days. By default, the timepickers are set to those values.


BEFORE YOU BEGIN:

  1. You'll need to install the following PS modules in order to run this:

    1. AzureADPreview
    2. ExchangeOnlineManagement
    3. MSOnline
  2. Please search for "CHANGE_ME" to find two values you will need to change. These are:

    1. You'll need to add your email address after Connect-ExchangeOnline -UserPrincipalName.
    2. You'll need to change the variable $script:DomainName to be your domain. That will allow the script to get the password policy for your domain to calculate the password expiration date for a user.

Feedback can be left on my Github or sent to the following contact details:

  1. @IntrepidTechie on Twitter
  2. [email protected]

Please feel free to contribute to this tool by fixing bugs or providing feedback. I'm not a developer by trade, and would gladly accept feedback from seasoned devs/PowerShell Gurus.

Special thanks to my wonderful wife Kait for constantly supporting me.

Dedicated to @HumanMalware. RIP bro, you are gone too soon.

kitt-o365-tool's People

Contributors

intrepidtechie avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

kitt-o365-tool's Issues

Get-MessageTrace : The term 'Get-MessageTrace' is not recognized as the name of a cmdlet....

Hi there,

I have the necessary modules installed. But when I ran your script and try to use the message trace, I get this:

Get-MessageTrace : The term 'Get-MessageTrace' is not recognized as the name of a cmdlet, function, script file, or 
operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try 
again.

I've made sure to do a import-module * before running your script and I don't quite understand why it's not working.

I've installed the necessary modules using the below:

Install-Module PowerShellGet -Force
Install-Module –Name ExchangeOnlineManagement
Install-Module -Name MSOnline
Install-Module -Name AzureADPreview 

UPDATE:

I think I know what the issue is, but I don't know how to fix it.

If I run this:

Connect-ExchangeOnline -UserPrincipalName <UPN> -ShowProgress $true

I will then connect to EXO and then I can run Get-MessageTrace just fine.

But if I then immediately run your script, it will prompt twice for my login and during this process, it will remove my EXO session:

image

After that, Get-MessageTrace will not be recognized as a cmdlet. So I'm guessing your script is trying to connect to EXO and to MSO (hence why I get 2 login prompts) and somehow one session removes the other...?

UUPDATE 2:

Nevermind, nothing wrong with your script. The account I used for "change_me" did not have correct permissions in Azure and O365. I then tested a global admin account but I simply used "connect-exchangeonline" to connect to the global admin account, instead of changing the "change_me" to the global admin account.

It would be nice if your script prompted for the username and domain instead of hardcoding it into the script.

UPDATE 3:

I've modified your script a bit to make it easier to use without having to constantly modify the "change_me" parameter. Just chuck the code below to the start of your script:


$GlobalAdminAccount = $(Write-Host "Enter the global admin email address: " -ForegroundColor Magenta -NoNewline; Read-Host)

$ClientDomain = $GlobalAdminAccount.split("@")[1]

$ClientDomainChoice = $(Write-Host "Press Enter to use '$ClientDomain', otherwise type your own client domain: " -ForegroundColor Magenta -NoNewline; Read-Host)

if ([string]::IsNullOrWhiteSpace($ClientDomainChoice)){

}else{

	$ClientDomain = $ClientDomainChoice
}

Then replace change_me with $GlobalAdminAccount and $ClientDomain respectively. Everytime you run the script, it'll prompt you to enter a global admin account and it will by default take the domain of that account and use it as the domain. If you don't want to use that domain, just type the domain you'd like to use in the prompt.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.