Skip to content

Commit

Permalink
Fix pester test results.
Browse files Browse the repository at this point in the history
  • Loading branch information
jonnybottles committed Dec 8, 2024
1 parent f6e5c09 commit d7a046c
Show file tree
Hide file tree
Showing 3 changed files with 34 additions and 36 deletions.
1 change: 0 additions & 1 deletion Hawk/functions/Tenant/Get-HawkTenantAZAdmin.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,6 @@
Out-LogFile "Gathering Azure AD Administrators"

Test-GraphConnection
Send-AIEvent -Event "CmdRun"
}

PROCESS {
Expand Down
67 changes: 33 additions & 34 deletions Hawk/functions/Tenant/Get-HawkTenantConsentGrant.ps1
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
Function Get-HawkTenantConsentGrant {
<#
<#
.SYNOPSIS
Gathers application grants using Microsoft Graph
Expand All @@ -22,36 +22,35 @@
- Application.Read.All
- Directory.Read.All
#>
[CmdletBinding()]
param()

Out-LogFile "Gathering OAuth / Application Grants"

Test-GraphConnection
Send-AIEvent -Event "CmdRun"

# Gather the grants using the internal Graph-based implementation
[array]$Grants = Get-AzureADPSPermission -ShowProgress
[bool]$flag = $false

# Search the Grants for the listed bad grants that we can detect
if ($Grants.ConsentType -contains 'AllPrincipals') {
Out-LogFile "Found at least one 'AllPrincipals' Grant" -notice
$flag = $true
}
if ([bool]($Grants.Permission -match 'all')) {
Out-LogFile "Found at least one 'All' Grant" -notice
$flag = $true
}

if ($flag) {
Out-LogFile 'Review the information at the following link to understand these results' -notice
Out-LogFile 'https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants' -notice
}
else {
Out-LogFile "To review this data follow:"
Out-LogFile "https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants"
}

$Grants | Out-MultipleFileType -FilePrefix "Consent_Grants" -csv -json
}
[CmdletBinding()]
param()

Out-LogFile "Gathering OAuth / Application Grants"

Test-GraphConnection

# Gather the grants using the internal Graph-based implementation
[array]$Grants = Get-AzureADPSPermission -ShowProgress
[bool]$flag = $false

# Search the Grants for the listed bad grants that we can detect
if ($Grants.ConsentType -contains 'AllPrincipals') {
Out-LogFile "Found at least one 'AllPrincipals' Grant" -notice
$flag = $true
}
if ([bool]($Grants.Permission -match 'all')) {
Out-LogFile "Found at least one 'All' Grant" -notice
$flag = $true
}

if ($flag) {
Out-LogFile 'Review the information at the following link to understand these results' -notice
Out-LogFile 'https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants' -notice
}
else {
Out-LogFile "To review this data follow:"
Out-LogFile "https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants"
}

$Grants | Out-MultipleFileType -FilePrefix "Consent_Grants" -csv -json
}
2 changes: 1 addition & 1 deletion Hawk/functions/Tenant/Start-HawkTenantInvestigation.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@
Get-HawkTenantAppAndSPNCredentialDetail
}

if ($PSCmdlet.ShouldProcess("Azure AD Users", "Get Azure AD user list")) {
if ($PSCmdlet.ShouldProcess("Entra ID Users", "Get Entra ID user list")) {
Out-LogFile "Running Get-HawkTenantEntraIDUser" -action
Get-HawkTenantEntraIDUser
}
Expand Down

0 comments on commit d7a046c

Please sign in to comment.