Skip to content

Commit ca32126

Browse files
evild3adevild3ad
committed
2025-09-18
1 parent 29d03d6 commit ca32126

17 files changed

Lines changed: 1066 additions & 409 deletions

‎Admins-Analyzer.ps1‎

Lines changed: 644 additions & 0 deletions
Large diffs are not rendered by default.

‎CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22

33
All changes to the Microsoft-Analyzer-Suite will be documented in this file.
44

5+
## [1.6.1] - 2025-09-18
6+
### Added
7+
- Admins-Analyzer
8+
9+
### Fixed
10+
- Minor fixes and improvements
11+
512
## [1.6.0] - 2025-07-24
613
### Added
714
- EntraSignInLogs-Analyzer: UniqueTokenIdentifier

‎Devices-Analyzer.ps1‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# @copyright: Copyright (c) 2025 Martin Willing. All rights reserved. Licensed under the MIT license.
55
# @contact: Any feedback or suggestions are always welcome and much appreciated - mwilling@lethal-forensics.com
66
# @url: https://lethal-forensics.com/
7-
# @date: 2025-07-24
7+
# @date: 2025-09-18
88
#
99
#
1010
# ██╗ ███████╗████████╗██╗ ██╗ █████╗ ██╗ ███████╗ ██████╗ ██████╗ ███████╗███╗ ██╗███████╗██╗ ██████╗███████╗
@@ -21,8 +21,8 @@
2121
# https://github.com/dfinke/ImportExcel
2222
#
2323
#
24-
# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.6093) and PowerShell 5.1 (5.1.19041.6093)
25-
# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.6093) and PowerShell 7.5.2
24+
# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.6332) and PowerShell 5.1 (5.1.19041.6328)
25+
# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.6332) and PowerShell 7.5.3
2626
#
2727
#
2828
#############################################################################################################################################################################################
@@ -35,7 +35,7 @@
3535
.DESCRIPTION
3636
Devices-Analyzer.ps1 is a PowerShell script utilized to simplify the analysis of Microsoft Entra ID Device Information extracted via "Microsoft-Extractor-Suite" by Invictus Incident Response.
3737
38-
https://github.com/invictus-ir/Microsoft-Extractor-Suite (Microsoft-Extractor-Suite v3.0.4)
38+
https://github.com/invictus-ir/Microsoft-Extractor-Suite (Microsoft-Extractor-Suite v4.0.0)
3939
4040
https://microsoft-365-extractor-suite.readthedocs.io/en/latest/functionality/Azure/Devices.html
4141
@@ -555,8 +555,8 @@ $Host.UI.RawUI.WindowTitle = "$DefaultWindowsTitle"
555555
# SIG # Begin signature block
556556
# MIIrywYJKoZIhvcNAQcCoIIrvDCCK7gCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB
557557
# gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR
558-
# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUU0eX2egUetdTV7O97kBteB+x
559-
# iPaggiUEMIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B
558+
# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUdELZjH+1fli3OWnC/B/AU2BN
559+
# vGSggiUEMIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B
560560
# AQwFADB7MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVy
561561
# MRAwDgYDVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEh
562562
# MB8GA1UEAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTIxMDUyNTAwMDAw
@@ -758,33 +758,33 @@ $Host.UI.RawUI.WindowTitle = "$DefaultWindowsTitle"
758758
# Z28gUHVibGljIENvZGUgU2lnbmluZyBDQSBSMzYCEQCMQZ6TvyvOrIgGKDt2Gb08
759759
# MAkGBSsOAwIaBQCgeDAYBgorBgEEAYI3AgEMMQowCKACgAChAoAAMBkGCSqGSIb3
760760
# DQEJAzEMBgorBgEEAYI3AgEEMBwGCisGAQQBgjcCAQsxDjAMBgorBgEEAYI3AgEV
761-
# MCMGCSqGSIb3DQEJBDEWBBTwvJE96mYSEcUNHHwfQSqFqHyy2jANBgkqhkiG9w0B
762-
# AQEFAASCAgA7Oo7AhLoircmkkjNsBOsdIA9r1ulxVq+CclOXNvQx4kZaMgHlrxz4
763-
# 4M6VedWQsAsBgagC1CY8+BBjzIsJ5AG2CskFH10R6nhE9rFSxafgNOio/7utb8eq
764-
# nwOwgzsNcx1j62tVbWUAZ+IattIpksi8ANRvfq2Smvou2c2FLnlu/g9hiilhgR/Y
765-
# UvnBLe/SBSRGVqUlMDZSgdK8Eae2cfj9FXtoj4SOnunoeCCd+f7kcXoZYzOsJdjh
766-
# Kg5/1x1xgjrtfJJ9SsLg6J/yK3YPq8YHVCBNoPsK4sItmHqd/o7hghlat3GclMCD
767-
# UWntnAV2rFnXxoFxaBiUcZD86f8rdiiypNRgW8jdNfG5CL62TENxW07FxLt0yYMQ
768-
# VZvOi1KxF8hOZF2U+uEyNUIbwS99pTR84f7+m0m3Oxh1cY1yZYW/z78A8/jDsoAL
769-
# IYspTNinZBMTWz9PoGtRZYlo5Ash6zRLB6GM1zoFnWgop8QaXQeNN/MHsQwktgn8
770-
# gzm5S7s51Zl0hAd7sYqnZ2DFaI34J9S5icHQ+NfW1gcsmS64Kmj7R/2Csa2bPMjO
771-
# s9IVxpJpMQGSeltuoNJ/HxBkxx8jYCNi4g2HCi9hiqFS2WPOXxZTzA2sKnlbLiF4
772-
# E8nVvTrdPff+4rn/C/JXKAiyLefBfOqTbehq3S+T7MvQeh/ixsXCL6GCAyMwggMf
761+
# MCMGCSqGSIb3DQEJBDEWBBQIxlNRsTaJ0mfplJnU5QRQVKGw6zANBgkqhkiG9w0B
762+
# AQEFAASCAgBqvno10KBGHYKJr5wR2Zfdlql66J90wUgy9oafVpCE5y8yUKPyWer0
763+
# e6JEHPmmy2U+OGOFx4FrZh0NMp1dGZYMIWZo5WgO8xVSih2fgvt7I691JGgz3fTy
764+
# Uxn0ktVbi7YJTNIsdKxu9s0LxOYCHFfRg7tEeicwgb/4P4KT7t8hzQkw/hyGZrvF
765+
# vH7/b6uqNI8zTtFUmSxyry/Bk8s3LTG5fTM3XgJNjhVX/HOCDLMgn5ygBZAQ/ekF
766+
# mnJQ8QJXsNO2mgPaQbdn+cAsJ7fGr6cCiP3Bd+yBwG98/Fo579GefRW+61Q4kn4G
767+
# GMj3BrLUArgqDQcRKTlT2HIqHox1fgHNa+0uD/O14MFukkvXoUqpty3dXcUI16WZ
768+
# 1V4NCQMi4HW9ohW0lZEwrBanMCOu5ulX7vZcDqNQdVRLiuZFdWp2EaFJf3+O9FGt
769+
# fAEvaup84Y5kceuJXUHeG57f1R/UNBI5ZKjENkSPYkD80qojBVali6GEG5cN0I+X
770+
# ye6cg2y+LCQpBMHEQwx/O+wDOMC1yrD6/83+mcGtAJsRPGFsdrGFx1NrWfGdn2H+
771+
# 2JIjgU1NQKQ75Z71khb6s7Dpx+Ga1D0lL2WU8k4Fjom7ITSfnt9SXLmdVqXj2C5Y
772+
# LD7OZSCeE7ZnnPvNs94lZAg+HxL44xV4A5LgjYfp4s6Zq9miL+JD9KGCAyMwggMf
773773
# BgkqhkiG9w0BCQYxggMQMIIDDAIBATBqMFUxCzAJBgNVBAYTAkdCMRgwFgYDVQQK
774774
# Ew9TZWN0aWdvIExpbWl0ZWQxLDAqBgNVBAMTI1NlY3RpZ28gUHVibGljIFRpbWUg
775775
# U3RhbXBpbmcgQ0EgUjM2AhEApCk7bh7d16c0CIetek63JDANBglghkgBZQMEAgIF
776776
# AKB5MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI1
777-
# MDcyNDA0NTI0N1owPwYJKoZIhvcNAQkEMTIEMMRaHN1y+Olijo+Hejyq5svDqso/
778-
# jmvy1meixidaGHOyQmubPYa4tTkjjGJRIUc1gjANBgkqhkiG9w0BAQEFAASCAgAr
779-
# qSvuu9cybN6W3GPBqsEzZDm6pqyJUsYPBpbgdttXcwGULj07K3f9tdKbD9I76bvp
780-
# MmgGfNMBNc4MUd8QOYH8Xz2I9j3AeMvM2Gq/VyKK1KGhSHwdZ0T+Vcjmwq6NPgZ3
781-
# 5ZL5UPbd1E1WoFMHJ1NqRNow48wZOhHDDn6cTY7edm15E8NnonCY+mqaSadAnl1e
782-
# iE3RbP+gtB5uEkj3hbcFItwu/WdCcvYTeNuBhZMI11MDuyB56LBu0SQgjo6gAt9f
783-
# RG5pPQvfT1sUe5GeIm7dQjs/91H3Ggl2sZytv8lH40Ct4TDM8Q64X4ZUuRZChXYc
784-
# HJxyUkTs3syxeoi+UmZViwxLv+JJYeHpdkVjxq8igfjTL7DeCEK8Ib+LdDap/t/o
785-
# P3f4r00sjdqrtt83IhoL1IoqfitK1fnI2Ow/IvXvtCD05t5a8eY4Y0OuxxJC4wAF
786-
# QyHwT3wlvouPdbxV4cG0Z6o6v+7rzpjv/ul3OeNcZfru3r0bBF+87+2yRWb+OwFl
787-
# 7HeB9Xs0/5bbbvLOO8Jm656W/Z7ZnxEnMfuJujucMRQrW3JReEbem8x2LWVIJHGO
788-
# lsfvaSYlIGnFw20ua1tOGytr6Wx69gNWE2OQSCiYCbhiC9CEZG2hwecCnmfqrPeP
789-
# F3Vc+U3SJdWOD6Y53e+2CM1eKrS5uMfBmjJ9YVvctg==
777+
# MDkxODA1MDkzMlowPwYJKoZIhvcNAQkEMTIEMOnJ4fvLNAn+wH5fmv6G+1Siftja
778+
# OCSd6A3t/s7KEhLIgTrwun9aUGzpDMfvjLlUnTANBgkqhkiG9w0BAQEFAASCAgCv
779+
# 9QHAQVCVV88Pdw8/M2z6D1Jf/2AsGSICYqnpEzSBw35J64WmiAL7UrgOed85eYfI
780+
# FeNyHWBBNSW3onwpOvS5k/BvIRlPStOkq/d1IBHiqooUY4Qhg5r0YfpzpXXqauIG
781+
# B21M47fw1eM7gpIbb5BAjKZpv9+jEHDsxniox7q6AuFpnV3gblMOAo9UzQrU5bIk
782+
# mqR4l0pnlMbujuqqkXbjFmavFBE4XvcZ+DRYvQhDP5+T/Ow/UhJGo2KaKIHa0WPB
783+
# wVHG+f16Q0vnMmpz4S9GCvFTWGoNNdD/yrw/STZ2s6J3fnDua7mvl4QfEAckdJ9m
784+
# etZKAyT1l3NGhJjxXffsgy37YZncgelfdIXmK62OWrm6T/2i+f2tCH8liy/MjG/s
785+
# Vo3CqffUT01/BQhjyD8MiSa7sRC0gn65u5sqT1nM4M8dfJKvJUg4pAHbGT8X3hPA
786+
# B1pc/rXp/n1wSGBD5D/u2w53gTzInFy4YytFbQx3IzgtqOx0EwLksXtLEqQ2H+NI
787+
# IP0rKDUH5K/yR7W55RKvq3eiJqPtSHijU8NlaLk4VQqbdNZiwHOYEHOHEAb2nQh+
788+
# N5Lclk8wt0d5AH1i+veEp9GHPzLK8nEcTp1fFgaBqqJGOQF8CYMzD63ZvGjvzOy4
789+
# OhZRFD0jEPusM8wDtqDuYdSdiGlPriTHYK/tQAsODQ==
790790
# SIG # End signature block

‎EntraAuditLogs-Analyzer.ps1‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# @copyright: Copyright (c) 2025 Martin Willing. All rights reserved. Licensed under the MIT license.
55
# @contact: Any feedback or suggestions are always welcome and much appreciated - mwilling@lethal-forensics.com
66
# @url: https://lethal-forensics.com/
7-
# @date: 2025-07-24
7+
# @date: 2025-09-18
88
#
99
#
1010
# ██╗ ███████╗████████╗██╗ ██╗ █████╗ ██╗ ███████╗ ██████╗ ██████╗ ███████╗███╗ ██╗███████╗██╗ ██████╗███████╗
@@ -25,8 +25,8 @@
2525
# https://github.com/ipinfo/cli
2626
#
2727
#
28-
# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.6093) and PowerShell 5.1 (5.1.19041.6093)
29-
# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.6093) and PowerShell 7.5.2
28+
# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.6332) and PowerShell 5.1 (5.1.19041.6328)
29+
# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.6332) and PowerShell 7.5.3
3030
#
3131
#
3232
#############################################################################################################################################################################################
@@ -39,7 +39,7 @@
3939
.DESCRIPTION
4040
EntraAuditLogs-Analyzer.ps1 is a PowerShell script utilized to simplify the analysis of Microsoft Entra ID Audit Logs extracted via "Microsoft Extractor Suite" by Invictus-IR.
4141
42-
https://github.com/invictus-ir/Microsoft-Extractor-Suite (Microsoft-Extractor-Suite v3.0.4)
42+
https://github.com/invictus-ir/Microsoft-Extractor-Suite (Microsoft-Extractor-Suite v4.0.0)
4343
4444
https://microsoft-365-extractor-suite.readthedocs.io/en/latest/functionality/Azure/AzureActiveDirectoryAuditLog.html
4545
@@ -2376,8 +2376,8 @@ if ($Result -eq "OK" )
23762376
# SIG # Begin signature block
23772377
# MIIrywYJKoZIhvcNAQcCoIIrvDCCK7gCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB
23782378
# gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR
2379-
# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUucX8Y10CqaX2tevFscAIS/Er
2380-
# yYqggiUEMIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B
2379+
# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvCEP+uwQogJk0/cg55uDhl0C
2380+
# hDaggiUEMIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B
23812381
# AQwFADB7MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVy
23822382
# MRAwDgYDVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEh
23832383
# MB8GA1UEAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTIxMDUyNTAwMDAw
@@ -2579,33 +2579,33 @@ if ($Result -eq "OK" )
25792579
# Z28gUHVibGljIENvZGUgU2lnbmluZyBDQSBSMzYCEQCMQZ6TvyvOrIgGKDt2Gb08
25802580
# MAkGBSsOAwIaBQCgeDAYBgorBgEEAYI3AgEMMQowCKACgAChAoAAMBkGCSqGSIb3
25812581
# DQEJAzEMBgorBgEEAYI3AgEEMBwGCisGAQQBgjcCAQsxDjAMBgorBgEEAYI3AgEV
2582-
# MCMGCSqGSIb3DQEJBDEWBBTJijAxsbU8bR3OEOVYbMqvgdfwZjANBgkqhkiG9w0B
2583-
# AQEFAASCAgA1JdjfSjh8sgZkCkJ1Qj3CP2SLtB6Rp1u3z99PLOncrX3Lby+uU2Gb
2584-
# eom2QJUUKlk+yUHqA37hc8c+W9aN8AR/mVi2XfR41MnFd/bBCldeqXSE+p2xUM87
2585-
# 5kioYx0+XOATPAtbQxXrHmwfcXVTtdZzZ3x6cvUDZ3TtWTFhLX+L33oXvMbhAfkl
2586-
# 0t6nWzVNJHb1tAbssaAiOSqh7Htbzu2aJ2sD2cboi9E5LXDqlXtDIzHdfpYiMa5O
2587-
# PMwUByRwtfvkoY0cjADwWnCK6Qw1ibQbC6WfsjvEoWGeQsMPzYB3V4omQwaBjtXp
2588-
# B+WkdsP4tN34Jk6rFEQFFLre8i8IpshwiVzcCiU6rgthQh4wZJALH/BfqDmSwC5i
2589-
# CTvtVdtNnFf1tXIZzh5OTWiiZOPAgVSPwduvQa93MeGzuncrQ73mDsrNF87XHTjF
2590-
# k4sT4FtTASS1ZuCXm058nUZMwcEZjZ5CLKnzHz/krGrS1Pwof05+8ZUr1YCVoOY9
2591-
# 2C+vnElEKbN1Butkc7Z/0Jdxmuf4cuAt9kBhPYk1+WOhgcz9Htj42IMVOpyd69o0
2592-
# jgBpTVN5kFJTT21RRdzUrlQLucYG4c5rydwHzWHQb38cG6gC8qaGsvsrwMJ6SfI0
2593-
# M2sfWopBEmOkaVEHMpX6qIrAXNopB3b5LUB4PRRfmKjoxDFrVdwH3KGCAyMwggMf
2582+
# MCMGCSqGSIb3DQEJBDEWBBRr1lFXsYH/h8BDIsDc1F9qtBB3MjANBgkqhkiG9w0B
2583+
# AQEFAASCAgBj/YYzmkKIqFDUwtm0BkVWaTsA3M/L8kshRLLSg9j7AIXIMSZYDDJj
2584+
# Z5/YxFgnsdW2i9BAxqdsGyG39co4FlKUAsHb6180p75nYD9SMHb7RQnOf3VEO8vL
2585+
# qORw5/7jIgOCe7oUVV6vhttf4PVietgH/v/3Xyu9wBVMSbnrcl9J10tTS3acFhGa
2586+
# WYk8AavJYC3wXsq7zoK6/FR/+B0XOmP9fKwnWtfklxxg+i/Jlmv/26bO1er0fMb/
2587+
# G7flqGHnofS86ky9rckqpe52CVI4AimVHdX6ZcO/9nxO2mp6LoVeA53hxI/NCvOF
2588+
# 23GTaTfvnmMt1RQFuXmpz38tminiNybw9o+aPXCro2D61lSWdT8etPXynTevn/Y0
2589+
# gdv44Dv0QQQDBoaEDFdVJ/LnpOZSGp5BleZovxDFCMgf2xw4f/WHMeFqDZ3QzsYN
2590+
# 17QVbBLY9xnrjAyEuoRI6fxvsq2JK+UQV9sOFpiATlj1ZA7JyU+gzDrLeXwUuhE8
2591+
# Y5+01MyaQfBQKDNyCDNxfuDwKwzlpSIU9j3nrBEOGNHStzflXMlz3AHJwd2BVRq7
2592+
# AYlX7t2EC0rEG9PIuPaLwgH2du5wOgMEmxNlnUwFDJTzM8mbqxc3ArMtOariqXvS
2593+
# 7cqn2YGXxzLqReJx345DaFo9600fIqiDQt6FNGPiiYi98kyrGRREEqGCAyMwggMf
25942594
# BgkqhkiG9w0BCQYxggMQMIIDDAIBATBqMFUxCzAJBgNVBAYTAkdCMRgwFgYDVQQK
25952595
# Ew9TZWN0aWdvIExpbWl0ZWQxLDAqBgNVBAMTI1NlY3RpZ28gUHVibGljIFRpbWUg
25962596
# U3RhbXBpbmcgQ0EgUjM2AhEApCk7bh7d16c0CIetek63JDANBglghkgBZQMEAgIF
25972597
# AKB5MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI1
2598-
# MDcyNDA0NTI1MVowPwYJKoZIhvcNAQkEMTIEMIXQ6B6DpZdOcVkjrJVB894O+ltQ
2599-
# bIuYQFobunvB4OqePmU4MoRkV+rAmJT46KfPWTANBgkqhkiG9w0BAQEFAASCAgCe
2600-
# RMMdJDOttPmFqqZ9WnnViD0Yazg3ptf1Sgk5iXMqyGkuvaNd60lh9sSx8skN4Sw4
2601-
# LtqCfUneuoWDJMF5bw7vyQUPQkmOxJT8kFrhvQGrmcNBmMUZwCUw9HHUPecID4TX
2602-
# jJJ1gVOXtu7evpngbZefOspoP0QfhnYt11MajfjNUxVbuYv2whFDfO9f3RYOcasY
2603-
# 6q4NohTDqWJC2n4VsbYvnHuSKSYHzRcgIEdafVG7kdFh7H8ArhZzqnOkNDnZXNuE
2604-
# Yx+kZChpq5pDzbWs1QXuW0kDdNJhO7sKxyNDOy9yUy8AdUV0YDdDdS6+H3cmPLe4
2605-
# cri3xtOdS7LSF5WgXMR2IVlDLSbX4hBdhk/tlYOd8etD+mMljQNAzlHlIvylCiio
2606-
# orKe0DlUfUEfYaoKEWVK7zlbDoV3Z4T6Lymd5Dml8zKt63a1eJFd6RDvKTdgWC4X
2607-
# hXsBMwdPsWVVjV49E0E05y2eHkLluOLjrdFgqZC4+ANqdglG4aSMIg75FbWymmT6
2608-
# MoJS+Th5wrAawYC+pcFfEdgikLZ+kb4lWE0F9WqhkGWKVT3Ex5wRq0r2Cap5tI8Y
2609-
# 96m9zq8pPAiNdxhgHi7iGGZEZ9P7xq1TNNSv4r7PdgCOyXwmvKfxFxX2sxIDyiKa
2610-
# ptacrjicjBhHNKXASHXKbejwuuDOEiTL0HtqpCXu0w==
2598+
# MDkxODA1MDkzNVowPwYJKoZIhvcNAQkEMTIEMEf1004QrG76SmtTfPwGKW3ILW+i
2599+
# OCSWlZeV0/MNBoAIsIV1Sftljm7by/dsDWy1KjANBgkqhkiG9w0BAQEFAASCAgAt
2600+
# WjcNo/450rEiewUogiK0ya8UNMrFL+Fb4UI6pgm2j80xzQfhUlUvEvDlqBrY3unm
2601+
# iBgvY1vhh2I7hDLvGgE35teanaf55ql0LwMivNlGhbRx2ZLeEPn8kt6yNO8g8ybr
2602+
# dd2egd2px+HNIJUX01CCtLyPpegrthnzE0PATiK5PvYvwjhngJm5PyTHDDfUKyG7
2603+
# n+zWA6Kwtwgy7MjZZ8Jg8zeJGmDwKxGrylp9HMjfxrepqmtC0KFnAJpbekK1iDJh
2604+
# 8VL+4vWkvzpWyCLgmT9qc7P8L6TajR+e+R0ZRosgzq8LucjgcxZpDZR7LxsQmKv4
2605+
# /qtMLJLWvqXDO1wf43bHtaRlJ+4C9fMsWQs9+nVs3TnEB5ER+IYSii7bodJcd18T
2606+
# cTJlTmUOq8yctG2V4jWfYRzTn5xM8CHimrLbLFutMGs9oEMlOsVA8wDGBPqBRKq7
2607+
# TCrCCsX9mVoNOVMcMwg1mXYFeufQumnmLitGO3RBOb/DvDdiLKOmqBTyQlIVNvuQ
2608+
# nlwfgQin0OkMElQZocVfaE/d6pHu9izUl5sunztmPeB+/6no5dy8yPsfGPfbGrv8
2609+
# Or12s5xrfPS5ydDYrbF6mj1eDDkyjlpfu5/OYRH13+AqlaXWogDKOmNPxtsjz+mc
2610+
# TwGZ/AePBc321yz4AxgnuntcJ24Sh64zd5/9AYq+MA==
26112611
# SIG # End signature block

‎EntraSignInLogs-Analyzer.ps1‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# @copyright: Copyright (c) 2025 Martin Willing. All rights reserved. Licensed under the MIT license.
55
# @contact: Any feedback or suggestions are always welcome and much appreciated - mwilling@lethal-forensics.com
66
# @url: https://lethal-forensics.com/
7-
# @date: 2025-07-24
7+
# @date: 2025-09-18
88
#
99
#
1010
# ██╗ ███████╗████████╗██╗ ██╗ █████╗ ██╗ ███████╗ ██████╗ ██████╗ ███████╗███╗ ██╗███████╗██╗ ██████╗███████╗
@@ -25,8 +25,8 @@
2525
# https://github.com/ipinfo/cli
2626
#
2727
#
28-
# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.6093) and PowerShell 5.1 (5.1.19041.6093)
29-
# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.6093) and PowerShell 7.5.2
28+
# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.6332) and PowerShell 5.1 (5.1.19041.6328)
29+
# Tested on Windows 10 Pro (x64) Version 22H2 (10.0.19045.6332) and PowerShell 7.5.3
3030
#
3131
#
3232
#############################################################################################################################################################################################
@@ -39,7 +39,7 @@
3939
.DESCRIPTION
4040
EntraSignInLogs-Analyzer.ps1 is a PowerShell script utilized to simplify the analysis of Microsoft Entra ID Sign-In Logs extracted via "Microsoft Extractor Suite" by Invictus Incident Response.
4141
42-
https://github.com/invictus-ir/Microsoft-Extractor-Suite (Microsoft-Extractor-Suite v3.0.4)
42+
https://github.com/invictus-ir/Microsoft-Extractor-Suite (Microsoft-Extractor-Suite v4.0.0)
4343
4444
https://microsoft-365-extractor-suite.readthedocs.io/en/latest/functionality/Azure/AzureActiveDirectorysign-inlogs.html
4545
@@ -3067,8 +3067,8 @@ if ($Result -eq "OK" )
30673067
# SIG # Begin signature block
30683068
# MIIrywYJKoZIhvcNAQcCoIIrvDCCK7gCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB
30693069
# gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR
3070-
# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUnYRV5nrkidhjqGzoxhFvGKZg
3071-
# dquggiUEMIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B
3070+
# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUeGQ+6kgnwq9D3EJMD57dtJE1
3071+
# vo6ggiUEMIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B
30723072
# AQwFADB7MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVy
30733073
# MRAwDgYDVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEh
30743074
# MB8GA1UEAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTIxMDUyNTAwMDAw
@@ -3270,33 +3270,33 @@ if ($Result -eq "OK" )
32703270
# Z28gUHVibGljIENvZGUgU2lnbmluZyBDQSBSMzYCEQCMQZ6TvyvOrIgGKDt2Gb08
32713271
# MAkGBSsOAwIaBQCgeDAYBgorBgEEAYI3AgEMMQowCKACgAChAoAAMBkGCSqGSIb3
32723272
# DQEJAzEMBgorBgEEAYI3AgEEMBwGCisGAQQBgjcCAQsxDjAMBgorBgEEAYI3AgEV
3273-
# MCMGCSqGSIb3DQEJBDEWBBQqZdiYiqsaOD5jUMU2UXuBHioK+TANBgkqhkiG9w0B
3274-
# AQEFAASCAgCBbgd/ZhI7pgAoijwwT9/uGr4wOLu0rZURQ1gvC9PXV1KksEFeK7sC
3275-
# rXDoefHs81dOuoPbIIk+UULbEkEEUTjnrX5M6KAy3/OxujkefzicFTiSpQNtgC6K
3276-
# gScyO0901g81xFfivsdF6vkk7Yi1Er50z65/SHk4bMl2GHf5l6xa+T+9N3vwL/0l
3277-
# WGikACgf8csysA30+Q7wB263GlzjCDkXKWk0mYo+MYmBUVZqUSamRUrshSlARkVw
3278-
# vASG/ULm7q4oi58yHXyL1z+PnpLrTOJMTpyAuY/13BNayf4fZWoDmplBvymwEwoK
3279-
# 0HBrC/25tmJRvdGIfMGncn9TJ4lEX7RXlCLAF42gPE6ceHQCtagFY3WLTxgovhOk
3280-
# Tqu5ZvgMupbdoIXYSFnWB8qTcmKti0FjqkysRRSVJIvDa51K2r3HVG/eBjc5ON9F
3281-
# CLznhoIx8c59yBEPf6mHT1lqK+ggUqDRDkre4JsIZybmC2Ok7w2NS1XpFudTLvOj
3282-
# 4O4tuUhBC7CExM5hslGSfe9JsKqff1C4aI2R0T4BlAY8PF/BmaOYSBvtBE27ehdQ
3283-
# reWGOErklGMlvGCjBMtzkue9aQjR7qNtgeVaOFKSSje2yKXov4Zxd3r3gV+Xfbwb
3284-
# F93FtK0AwVa2gnFKSIt0acjjxzklgsAP4b7Rs4+HSzSorn4BNfjfYKGCAyMwggMf
3273+
# MCMGCSqGSIb3DQEJBDEWBBRT/4F7rkX+7QAPIitUP1rIgpLVZTANBgkqhkiG9w0B
3274+
# AQEFAASCAgAzxA/3PKTlWBTauZuCQhBb5u28G8YQ/XfBGUn1nM/MuPRSUaUb3QAS
3275+
# uJYBiGIYLIlp8np9+TFg0nHk8o0NqnZBWZgqICZnk7m+fnnsE3Y27zUQxlvSYAFq
3276+
# VdFziBM1HxVrHwdH+4NaPyaYJjx7BF8aq5AU6ebgQUuhje5ejN0ZIPHa0sRWoVGH
3277+
# Nvx7S+mYumN5VrO9kzU81Tjxtr+li/CTrURK0DqUxDTAGl2HyPURjdY0HWRVqFmT
3278+
# MJPqIDFhE+3jc/NQM4YE6Fs7xRAT2tiPRfvI9uMj1e14UjueZOz8Xsa3vmsVOywG
3279+
# T70gmN5DRFqzJagxdKz17XVWrBYB9N/53Fl5Cy5OhX5z7qZSeJS9k6EULVD7WHNz
3280+
# 0bjjX7KC6YUsdRjM92HZ4W3dKeD3pDW09ZqSdI/0EhYvkckkm7ihvgDpCNn2kHFC
3281+
# /NJvJyAkARAjKgGqJ1PY+omyWU4HspOy6Ee/6vbgPbSiBEssIfnrrA5RcijV4Y9+
3282+
# svKXdftRFzaitsYh+OTRfDS4o3zJGfUXUItMg8qsDYNdMao0HHEDHTKX7OxKU53C
3283+
# caG1uXTvopnEJM/elzas2PSlhpOViIbbU1EYjuZzRJXn3ZuHCF03oOgZZHOPnDlW
3284+
# fIdOqlLL+6CPuunILZzjWkfaDkAgqZwKmh58z3jKMZHViGSCvmp70aGCAyMwggMf
32853285
# BgkqhkiG9w0BCQYxggMQMIIDDAIBATBqMFUxCzAJBgNVBAYTAkdCMRgwFgYDVQQK
32863286
# Ew9TZWN0aWdvIExpbWl0ZWQxLDAqBgNVBAMTI1NlY3RpZ28gUHVibGljIFRpbWUg
32873287
# U3RhbXBpbmcgQ0EgUjM2AhEApCk7bh7d16c0CIetek63JDANBglghkgBZQMEAgIF
32883288
# AKB5MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI1
3289-
# MDcyNDA0NTI1NFowPwYJKoZIhvcNAQkEMTIEMLM4hbOAHyn0G3C3Ugi4cCDo1QN2
3290-
# 5eeHmNp55WFN9Rv5yjIWtbBjMwQwvVHdL4Vy4zANBgkqhkiG9w0BAQEFAASCAgBo
3291-
# 1wmaT8ilZzZ3lnJR9pfY7X30xeAx1yGOHm+GXbT+sj8FqSNqW1h+zNLBU1vLKXsQ
3292-
# L/gAgJU9WeznJC+Fhb9Y4eVncX9/NVTMD6Mtgwt52bXAJmN30CGrxgZEZS2ZQnHI
3293-
# A8k6AfYhCnAr0E5f/XNVXiFsjWcTh1VrmauwAQuHcwykFbG6NcTAXhHJhDUVN01d
3294-
# dHsLrsscxnFS5b0azGxdgwtYPCMCWnXG6lnj/n3PVZdPW+f2cxf8LjE6almcd0Tl
3295-
# tt5nytt/TZkFQaEpSteVdWi3MYAmehT9YGO3O/Re1vlJntSq9aXYhJf1w57D1533
3296-
# mWQ7vv37MyhpfnLnXhgm1visj3MIXhl3FaNsWMK/08CrJMX67zoqkOsNh3vD88QQ
3297-
# sOSj9jQNTXUl+04zUnMj0GNpz+zIEfKpGLG1UzIYeh8tiwB+xrWlHgRJSj2lsG81
3298-
# pAYRYFqkyBXxEhG1I3sVXK+OEvdETp/ssjKJ/XUT7wR4iOpbyInJS6oVz2aRyVZ8
3299-
# E2LgR2wRllX/SZIvUuQdeuyhi9dV42scQeMjfO5MrZ5JV6n4fUSWYd5JNHZpnoxP
3300-
# Hdhfjz8nDLnok/bgDLwpVI1C4NthTmSVQs6BgbmLwtW+Kf9YoO6z0f+vpcO0HjuR
3301-
# 8foNk60ahX83xKupXK8vEqwmsTmWnpCT4qRVL7/nxw==
3289+
# MDkxODA1MDkzOFowPwYJKoZIhvcNAQkEMTIEMFFZ3k1CsQ2WjoIVl9+md72YswLy
3290+
# xRPCAoDsfqhMjguyF+ROXnzFXA7JGIqjJPz1MzANBgkqhkiG9w0BAQEFAASCAgC6
3291+
# w8CucIG3LYdWIAr8j8yyRo9JA2K9AdAlxDGnfnvUAqZJu+E9oQIyfyb0/QKxyMEd
3292+
# AHvE/BHGTmzQPRaOtN5A1bJyEUPkL4TnDgpVWpmB0WRABpnVbiU8IRD9f1uxeRE9
3293+
# KW49HeRoLH3WD+a/469hBOXdeE13afw5b0a17x4hmWYwZIhSMQBMEEcVCdUNRsMm
3294+
# cd+2uhU3gYHNYykeuNXrJNkt1GmWHEGwQp6Nmhmu6wzIr+2VgDY97fOKFCPjFYsf
3295+
# D9sU4iPnirFh1ahJA5qG5kS3Iy/16qCCiiGGv5ocbXieRc3lw8BPBPL8w5K9t7B2
3296+
# dxaJmquSBhZqUWs2eeftfSbP6eTxTXRPe+vG6DrKZBdggAPp1thfQtZp33dtP7cT
3297+
# YLWQb/+jxXSeqFGizwtx2WQRBh9+8eYRAl4MRHK82ME4HRr1mJGVOr0Rk/PZ95FN
3298+
# U/LlO0rlKI5IHUsMqcr6O2ns8KzWwIUc5QdDdmftAo0JaStRvGjlR98yYaHd4EPJ
3299+
# dz+UWiqnIcioYeLq+1RPwWW7j88wWewkTUDTDeTiPGkXbNAkn3vCixxq2G2cLqkT
3300+
# IaIkpc4U7s00MJC6tFOkfN9PvjxBpz7FkTGOtq2VSgGwT5tFzu8TOykmjJc5K2Se
3301+
# MLWkjP9HAXXbpoph9k9+vUj1vmVWVBpyLYIv/AnvyQ==
33023302
# SIG # End signature block

‎Helper-Scripts/Updater.ps1‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -782,9 +782,12 @@ if ($PSVersionTable.PSVersion.Major -eq "7")
782782
# Get-InstalledPSResource Az -Scope CurrentUser
783783
# Find-PSResource -Name Az --> Check for the newest version in PSGallery
784784
# Find-Module -Name Az --> Check for the newest version in PSGallery
785-
# Update-PSResource Az -Repository 'PSGallery' -TrustRepository
785+
# Update-PSResource Az -Repository 'PSGallery' -TrustRepository --> Install newest version of AZ next to the old one :-(
786+
# Uninstall-PSResource -Name Az
787+
# Uninstall-PSResource -Name Az -Version 14.2.0
786788

787789
# Set-PSResourceRepository -Name PSGallery -Trusted
790+
# Get-PSResourceRepository
788791

789792
#############################################################################################################################################################################################
790793

0 commit comments

Comments
 (0)