|
4 | 4 | # @copyright: Copyright (c) 2025 Martin Willing. All rights reserved. Licensed under the MIT license. |
5 | 5 | # @contact: Any feedback or suggestions are always welcome and much appreciated - mwilling@lethal-forensics.com |
6 | 6 | # @url: https://lethal-forensics.com/ |
7 | | -# @date: 2025-05-15 |
| 7 | +# @date: 2025-06-03 |
8 | 8 | # |
9 | 9 | # |
10 | 10 | # ██╗ ███████╗████████╗██╗ ██╗ █████╗ ██╗ ███████╗ ██████╗ ██████╗ ███████╗███╗ ██╗███████╗██╗ ██████╗███████╗ |
|
25 | 25 | # https://github.com/ipinfo/cli |
26 | 26 | # |
27 | 27 | # |
28 | | -# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.5737) and PowerShell 5.1 (5.1.19041.5737) |
29 | | -# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.5737) and PowerShell 7.5.1 |
| 28 | +# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.5854) and PowerShell 5.1 (5.1.19041.5848) |
| 29 | +# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.5854) and PowerShell 7.5.1 |
30 | 30 | # |
31 | 31 | # |
32 | 32 | ############################################################################################################################################################################################# |
|
39 | 39 | .DESCRIPTION |
40 | 40 | EntraAuditLogs-Analyzer.ps1 is a PowerShell script utilized to simplify the analysis of Microsoft Entra ID Audit Logs extracted via "Microsoft Extractor Suite" by Invictus-IR. |
41 | 41 |
|
42 | | - https://github.com/invictus-ir/Microsoft-Extractor-Suite (Microsoft-Extractor-Suite v3.0.3) |
| 42 | + https://github.com/invictus-ir/Microsoft-Extractor-Suite (Microsoft-Extractor-Suite v3.0.4) |
43 | 43 |
|
44 | 44 | https://microsoft-365-extractor-suite.readthedocs.io/en/latest/functionality/Azure/AzureActiveDirectoryAuditLog.html |
45 | 45 |
|
@@ -385,8 +385,8 @@ Write-Output "[Info] Total Lines: $Rows" |
385 | 385 | # Time Frame |
386 | 386 | $Last = ($Data | Sort-Object { $_.activityDateTime -as [datetime] } -Descending | Select-Object -Last 1).activityDateTime |
387 | 387 | $First = ($Data | Sort-Object { $_.activityDateTime -as [datetime] } -Descending | Select-Object -First 1).activityDateTime |
388 | | -$StartDate = (Get-Date $Last).ToString("yyyy-MM-dd HH:mm:ss") |
389 | | -$EndDate = (Get-Date $First).ToString("yyyy-MM-dd HH:mm:ss") |
| 388 | +$StartDate = (Get-Date $Last).ToUniversalTime().ToString("yyyy-MM-dd HH:mm:ss") |
| 389 | +$EndDate = (Get-Date $First).ToUniversalTime().ToString("yyyy-MM-dd HH:mm:ss") |
390 | 390 | Write-Output "[Info] Log data from $StartDate UTC until $EndDate UTC" |
391 | 391 |
|
392 | 392 | # Processing Microsoft Entra ID Audit Log |
@@ -417,7 +417,7 @@ ForEach($Record in $Data) |
417 | 417 | $ActivityDateTime = $Record | Select-Object -ExpandProperty activityDateTime |
418 | 418 |
|
419 | 419 | $Line = [PSCustomObject]@{ |
420 | | - "ActivityDateTime" = (Get-Date $ActivityDateTime).ToString("yyyy-MM-dd HH:mm:ss.fff") # Indicates the date and time the activity was performed. The Timestamp type is always in UTC time. |
| 420 | + "ActivityDateTime" = (Get-Date $ActivityDateTime).ToUniversalTime().ToString("yyyy-MM-dd HH:mm:ss.fff") # Indicates the date and time the activity was performed. The Timestamp type is always in UTC time. |
421 | 421 | "InitiatedBy (UPN)" = ($Record | Select-Object -ExpandProperty initiatedBy | Select-Object -ExpandProperty $ActorType | Select-Object userPrincipalName).userPrincipalName # The userPrincipalName attribute of the user. |
422 | 422 | "TargetResources (UPN)" = ($Record | Select-Object -ExpandProperty targetResources | Select-Object userPrincipalName | Select-Object -Index 0).userPrincipalName # When type is set to User, this includes the user name that initiated the action; null for other types. |
423 | 423 | "UserId" = ($Record | Select-Object -ExpandProperty initiatedBy | Select-Object -ExpandProperty $ActorType | Select-Object id).id # Unique identifier for the identity. |
@@ -758,7 +758,7 @@ if ($Total -ge "1") |
758 | 758 | New-Item "$OUTPUT_FOLDER\EntraAuditLogs\Stats\LineCharts" -ItemType Directory -Force | Out-Null |
759 | 759 |
|
760 | 760 | # ActivityDisplayName --> Activity |
761 | | -$Import = Import-Csv -Path "$OUTPUT_FOLDER\EntraAuditLogs\CSV\Untouched.csv" -Delimiter "," -Encoding UTF8 | Select-Object @{Name="ActivityDateTime";Expression={((Get-Date $_.ActivityDateTime).ToString("yyyy-MM-dd"))}},ActivityDisplayName | Group-Object{($_.ActivityDateTime)} | Select-Object Count,@{Name='ActivityDateTime'; Expression={ $_.Values[0] }} | Sort-Object { $_.ActivityDateTime -as [datetime] } |
| 761 | +$Import = Import-Csv -Path "$OUTPUT_FOLDER\EntraAuditLogs\CSV\Untouched.csv" -Delimiter "," -Encoding UTF8 | Select-Object @{Name="ActivityDateTime";Expression={((Get-Date $_.ActivityDateTime).ToUniversalTime().ToString("yyyy-MM-dd"))}},ActivityDisplayName | Group-Object{($_.ActivityDateTime)} | Select-Object Count,@{Name='ActivityDateTime'; Expression={ $_.Values[0] }} | Sort-Object { $_.ActivityDateTime -as [datetime] } |
762 | 762 | $ChartDefinition = New-ExcelChartDefinition -XRange ActivityDateTime -YRange Count -Title "Activity" -ChartType Line -NoLegend -Width 1200 |
763 | 763 | $Import | Export-Excel -Path "$OUTPUT_FOLDER\EntraAuditLogs\Stats\LineCharts\Activity.xlsx" -Append -WorksheetName "Line Chart" -AutoNameRange -ExcelChartDefinition $ChartDefinition |
764 | 764 |
|
@@ -2252,8 +2252,8 @@ if ($Result -eq "OK" ) |
2252 | 2252 | # SIG # Begin signature block |
2253 | 2253 | # MIIrywYJKoZIhvcNAQcCoIIrvDCCK7gCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB |
2254 | 2254 | # gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR |
2255 | | -# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUVyy1Mmsb+Q0AFWRGiZ5hvJAp |
2256 | | -# d5eggiUEMIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B |
| 2255 | +# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQULbiZMVFmXPArRhBKOiH2c2d9 |
| 2256 | +# 15aggiUEMIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B |
2257 | 2257 | # AQwFADB7MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVy |
2258 | 2258 | # MRAwDgYDVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEh |
2259 | 2259 | # MB8GA1UEAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTIxMDUyNTAwMDAw |
@@ -2455,33 +2455,33 @@ if ($Result -eq "OK" ) |
2455 | 2455 | # Z28gUHVibGljIENvZGUgU2lnbmluZyBDQSBSMzYCEQCMQZ6TvyvOrIgGKDt2Gb08 |
2456 | 2456 | # MAkGBSsOAwIaBQCgeDAYBgorBgEEAYI3AgEMMQowCKACgAChAoAAMBkGCSqGSIb3 |
2457 | 2457 | # DQEJAzEMBgorBgEEAYI3AgEEMBwGCisGAQQBgjcCAQsxDjAMBgorBgEEAYI3AgEV |
2458 | | -# MCMGCSqGSIb3DQEJBDEWBBSsNao3xY30Zynpptv95PNFdO2C3zANBgkqhkiG9w0B |
2459 | | -# AQEFAASCAgCqp1JCsdKyeWTJOK6S4vBSaaTW5uvMgTmX/sNiupGHX9dSd973rWrC |
2460 | | -# FxoQjAWqIbtXGN4Q1Ymq9Pq9MYjgr89zbl5o5F8+UdlQC6LM/1t/bX4gj4anVhAL |
2461 | | -# xOnU0qzPoaW72q6fi1knYWLwO5ijRodPSZIxMFpWYm07mZOAsEI1XCiAYTYwoE+Y |
2462 | | -# wy6wMrG8iKGYLulR+HnvUjwHkguSaHyJauK4G4bOqisqB1y03vKZ0qNPUkd0a7Pm |
2463 | | -# 3oD2yKoFWV6nqkcKf/eerehOaG8ZA5dWnkgd0FeIE32wECHo9BO5OV8r3FlUhFu3 |
2464 | | -# EghaTQJAJVjvypPm6EOikndwwqFPl+BQK+b8BtAHLz71WiZGOMJ+8vtC2KeMQAnQ |
2465 | | -# An6MrWY5RnVMyZjW3QxbWgn3dEScrUiX18OlQsGVLYpADSCLnqnYdJ49EmaGoteq |
2466 | | -# ZhY1FVgFqqHgtylrCUQ+w/GCdWoLvyLIZmzvwTp4p5wRQfzJM5Dcud3r4vxt/GLs |
2467 | | -# PgC2cXu1mA5TEwfkoXQlrROcbGZjwnb2yJF8TDP8NzbmKiztsNFOtOvtTN3z7/UP |
2468 | | -# f4b0Z7Qz7e6ZhGc+ZEMD9SI2XsHurEAb4SL4p1otPDk+By1s5pex6mDpAWVaj0LI |
2469 | | -# HjLAkUeABsV8+3Q210HiSkBUH7GCcY0FFmy+Y4LIu5pRg8zzrObIq6GCAyMwggMf |
| 2458 | +# MCMGCSqGSIb3DQEJBDEWBBSMacbMCUXou+xfVVqvY3DSPRV6dTANBgkqhkiG9w0B |
| 2459 | +# AQEFAASCAgCYXodlNRkb4ZXUCcYb+dOfXUmGbHHDg8wxyWYLqpuZH13PJ/Sjt/Aw |
| 2460 | +# 7MA/N5debgiKyqGDiIjYwAAIBmUHIw+IkjNddPNRypMJtyV9Ok4lG7qX3I5cd8Em |
| 2461 | +# BqcIExbc8N1CwQpeCV6GeR9Ti8M26t6IWSD5kAJwwtruZ1+pdxMgsLITPjygA8K0 |
| 2462 | +# KzcfY61F652IrxHlNjaXQXmVMeYDA0tLkPmw/uygcEW4RrKBm13rxuq83VsGLwcN |
| 2463 | +# pnbxIJvdSN0JQAiAzfGQi50u49yKSxYUUDuJC6LQRvQq0XMcV7BBZD8ltTLHfY3V |
| 2464 | +# AS9gkuYeamsfTZSJG2Z/EwfWC86TGsTj7wW6PzDRuwm/l2svARJaMjjtjxFj0EnU |
| 2465 | +# G+gZsm6XsHcCgfFj3AD/IJ38xSGWppnedmybw5UZHbWdXANkXdhJUT78xFnTB/ap |
| 2466 | +# bHjieW6mphfs4866zzBmldkerf2JXhDxuVlwCvxFqd0pOA7K7AEIxTlPnNBYUnbN |
| 2467 | +# xYEQeYm2Vdl/RrX9/bI+SB/c0jQtEOd+GmbquTrEtXJ56EtsNPsR2VPvI8FxkGfg |
| 2468 | +# hSqmz8uRGbTUCOaxT6BqTD/S2f8LRa3WQ3zTbRIbcM4tiZgFeOzg8h3/MJCsbwqq |
| 2469 | +# W777l6hZfiqFsmxcyVoDIDJZdHLQVJLIo8YvB2XMbZHoyOyqyfTwNqGCAyMwggMf |
2470 | 2470 | # BgkqhkiG9w0BCQYxggMQMIIDDAIBATBqMFUxCzAJBgNVBAYTAkdCMRgwFgYDVQQK |
2471 | 2471 | # Ew9TZWN0aWdvIExpbWl0ZWQxLDAqBgNVBAMTI1NlY3RpZ28gUHVibGljIFRpbWUg |
2472 | 2472 | # U3RhbXBpbmcgQ0EgUjM2AhEApCk7bh7d16c0CIetek63JDANBglghkgBZQMEAgIF |
2473 | 2473 | # AKB5MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI1 |
2474 | | -# MDUxNTA0NDcwNVowPwYJKoZIhvcNAQkEMTIEMAaAARZv/lqW8Wyy5a6ShDuiHtSi |
2475 | | -# lt+jUg56vApDSlcFvG8Gx5EjaR4U+vYqyVjN+zANBgkqhkiG9w0BAQEFAASCAgA4 |
2476 | | -# fvk8uq5V3iF/DDj/N28ZvYIHciCYTcLWI00QSdZ3uUNDNg+L2kVAOFRfC2ns5AQR |
2477 | | -# u1TBuKaXneLK50e4HPXuqQ+8DwN9rjyn6MvdtX6U5ZW9XMX8fGwLUtyqgtHTWurZ |
2478 | | -# NUcwJwA7XLxqLFVWRJNhXFhYs24XTrCouG+nGPETkKmqcdUCrteDSlAGkEEYLP9y |
2479 | | -# viQy57V5Ag25CQUzvwC+sd45sQ0zYJonb59qW35YJUxB1jTwFO4GaIk3QsVcTViY |
2480 | | -# HI6vIBdcyitcJXuww1jxecPxhXExBbIfdFkASkwLIq5yf0lwbVynln2fYtMke9Zc |
2481 | | -# 8qZeQP1o6L2BUN/z6q2EjHNdsI9gBy9pa+0VuV0hM6nF7ZHslvOqXpjYf1pPlDyJ |
2482 | | -# 5BTL5eRSoYMuC0xDyWykzi98LLF5ELUrQK9rHPfIeyHeINegygMvHm02VgmPBsZi |
2483 | | -# qiT85PU5wModp018n1WUY1kmHPvMSYOJpZLjoLz+skdd1AaZrEWVtXXNFNw0O0rK |
2484 | | -# M+ujMDsp2c1hVP0FunfFymjqMzjzsD/wfsGbWIvVKRaD8l5qrb88AbGke7CEi23F |
2485 | | -# EHZ/B4maMAlY9AE1upsG/mmLkWimFEDlyIzQzg5d4imMpOY/OuX9fjNUWMvRy7QM |
2486 | | -# fq6BF6RS4ZTpq7NNwHd/2h5ZkKUc4nalFZ3M1J2hMw== |
| 2474 | +# MDYwMzA3NDUzNVowPwYJKoZIhvcNAQkEMTIEMIPSULrzxr6B9qtBi+JYd2SlEG9B |
| 2475 | +# vzQoB2ZciZ2cF8riBVrX3pEk/8L0soVlH3tiMTANBgkqhkiG9w0BAQEFAASCAgDQ |
| 2476 | +# +M7uXD4kVQLJVz/HmNgmEqbZoQrZ8ztczkzeVsYL7yVf/PPxA1rMl0YRvRCID4eL |
| 2477 | +# cH2j0fHsdDQbmSNkgJzH91jcmlVBwX6t+MIO1Vt+3Ys1iSc+Ed97vadXyscgBZuA |
| 2478 | +# XzcBd0nZjqZkc5zlkZnuTsq/ZA8v100K39mpawJ11aBi9MtbHVaxEA6PJij8pefh |
| 2479 | +# bygXkW6m5522ZnWf9tIFHDAY6TgzOuDA6hsBOfUmbBzX3ecY/0RXt3FdrX3Sy+Nc |
| 2480 | +# gdtym4lt1rSH2QT5hjlvPd6BVVW6doEUb4urvfY1NZ5UeqI0Kb3nqYDFHdXLxPyx |
| 2481 | +# b8dSFtynM6uPIYT8ExeeW7KU81xRbL47IMrQb3RqBtft5D8AIL5nNoSBk6bwwQea |
| 2482 | +# QjvMR5Eo2jDA8m2Gh+OrHp1ZWI60haYQM7+CxgGVBhEDUFgM/PRpgX50AZu64PxG |
| 2483 | +# AoU78HBe8Y2MzmT6J2jKFs2pGSw+IsJRkPoNyhVFiGnmAZVB/QK+voWItH31jx8n |
| 2484 | +# JWo0Yu0e75pnbwa+KVupXhCvQKB675kOL2kBzG3i1Rb+oo7SXPv+BhwCQz+ZllBK |
| 2485 | +# +Deyk3gUcm+yprkVYl3klpLVqRQclCk8Md7QiXAL40ohm/4VhWNjVSf3t33+QrpU |
| 2486 | +# bTJXKBtxiwnKyRzz7fPHLEOnkHJWKPVgrcbso8gS8g== |
2487 | 2487 | # SIG # End signature block |
0 commit comments