Frequently Asked Questions (FAQ)

• How can I verify the digital signature of a script file?
• How can I check a suspicious IP address?

How can I verify the digital signature of a script file?

All PowerShell scripts of the Microsoft-Analyzer-Suite are digitally signed with a valid code signing certificate.

You can check the code signature of a script file on Windows with following PowerShell command:

Get-AuthenticodeSignature -FilePath "C:\Tools\Microsoft-Analyzer-Suite\UAL-Analyzer.ps1"

You can check the code signatures of all script files with following PowerShell command:

Get-ChildItem -Path "C:\Microsoft-Analyzer-Suite" | Where-Object {$_.Extension -eq ".ps1"} | Get-AuthenticodeSignature

How can I check a suspicious IP address?

Here is a list of websites/services recommended for VPN & Proxy detection during M365 investigations:

• IPinfo.io
• SPUR - Context Search → Sign up
• IP2Proxy
• VPNAPI.io
• AbuseIPDB
• Scamalytics
• VirusTotal