T0pCyber / Hawk

Hawk is an open-source, PowerShell-driven, community-developed tool network defenders can use to quickly and easily gather data from O365 and Azure for security investigations. Incident responders and network defenders can investigate specific user principals or the entire tenant. Data it provides include IP addresses and sign-in data. Additionally, Hawk can track IP usage for concurrent login situations.

Hawk users can review login details for administrator accounts and take the following steps.

1. Investigate high-value administrative accounts to detect anomalous.
2. Enable PowerShell logging.
3. Look for users with unusual sign-in locations, dates, and times.
4. Check permissions of service principals and applications in M365/Azure AD.
5. Detect the frequency of resource access from unusual places.
6. Review mailbox rules and recent mailbox rule changes.
   

Links:

• https://github.com/T0pCyber/hawk 
• https://myseq.blogspot.com/2021/03/crowdstrike-crt.html
• https://myseq.blogspot.com/2021/03/cisagov-sparrow.html
• Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments
• Detecting Abuse of Authentication Mechanisms