import requests

import json

import sys

import base64

from tabulate import tabulate

from Graphpython.utils.helpers import print_yellow, print_green, print_red, get_user_agent, get_access_token

from Graphpython.utils.helpers import read_file_content, graph_api_get

#################################

# Post-Auth Intune Exploitation #

#################################

# dump-devicemanagementscripts

def dump_devicemanagementscripts(args):

print_yellow("[*] Dump-DeviceManagementScripts")

print("=" * 80)

api_url = "https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts"

if args.select:

api_url += "?$select=" + args.select

graph_api_get(get_access_token(args.token), api_url, args)

print("=" * 80)

# dump-windowsapps

def dump_windowsapps(args):

print_yellow("[*] Dump-WindowsApps")

print("=" * 80)

api_url = "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?$filter=(isof(%27microsoft.graph.win32CatalogApp%27)%20or%20isof(%27microsoft.graph.windowsStoreApp%27)%20or%20isof(%27microsoft.graph.microsoftStoreForBusinessApp%27)%20or%20isof(%27microsoft.graph.officeSuiteApp%27)%20or%20(isof(%27microsoft.graph.win32LobApp%27)%20and%20not(isof(%27microsoft.graph.win32CatalogApp%27)))%20or%20isof(%27microsoft.graph.windowsMicrosoftEdgeApp%27)%20or%20isof(%27microsoft.graph.windowsPhone81AppX%27)%20or%20isof(%27microsoft.graph.windowsPhone81StoreApp%27)%20or%20isof(%27microsoft.graph.windowsPhoneXAP%27)%20or%20isof(%27microsoft.graph.windowsAppX%27)%20or%20isof(%27microsoft.graph.windowsMobileMSI%27)%20or%20isof(%27microsoft.graph.windowsUniversalAppX%27)%20or%20isof(%27microsoft.graph.webApp%27)%20or%20isof(%27microsoft.graph.windowsWebApp%27)%20or%20isof(%27microsoft.graph.winGetApp%27))%20and%20(microsoft.graph.managedApp/appAvailability%20eq%20null%20or%20microsoft.graph.managedApp/appAvailability%20eq%20%27lineOfBusiness%27%20or%20isAssigned%20eq%20true)&$orderby=displayName&"

if args.select:

api_url += "$select=" + args.select # some fields will 400 whole req

if args.id:

api_url = f"https://graph.microsoft.com/beta/deviceAppManagement/mobileApps/{args.id}?$expand=assignments"

user_agent = get_user_agent(args)

headers = {

'Authorization': f'Bearer {get_access_token(args.token)}',

'User-Agent': user_agent

}

try:

response = requests.get(api_url, headers=headers)

response.raise_for_status()

json_data = response.json()

json_data.pop('@odata.context', None)

json_data.pop('assignments@odata.context', None)

for key, value in json_data.items():

if key == 'assignments':

if not value:

print_red("assignments: None")

else:

print_green("assignments:")

for assignment in value:

print(f" - ID: {assignment['id']}")

print(f" Intent: {assignment['intent']}")

if 'target' in assignment:

target = assignment['target']

odata_type = target.get('@odata.type', '').split('.')[-1]

print(f" Target:")

if odata_type == 'exclusionGroupAssignmentTarget':

group_id = target.get('groupId', 'N/A')

print(f" Excluded Group ID: {group_id}")

elif odata_type == 'allLicensedUsersAssignmentTarget':

print(" Assigned to all users")

elif odata_type == 'allDevicesAssignmentTarget':

print(" Assigned to all devices")

elif odata_type == 'groupAssignmentTarget':

group_id = target.get('groupId', 'N/A')

print(f" Assigned to Group ID: {group_id}")

else:

print(f" {odata_type}: {target}")

print()

else:

print(f"{key}: {value}")

except requests.exceptions.RequestException as ex:

print_red(f"[-] HTTP Error: {ex}")

print("=" * 80)

return

graph_api_get(get_access_token(args.token), api_url, args)

print("=" * 80)

# dump-iosapps

def dump_iosapps(args):

print_yellow("[*] Dump-iOSApps")

print("=" * 80)

api_url = "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?$filter=((isof(%27microsoft.graph.managedIOSStoreApp%27)%20and%20microsoft.graph.managedApp/appAvailability%20eq%20microsoft.graph.managedAppAvailability%27lineOfBusiness%27)%20or%20isof(%27microsoft.graph.iosLobApp%27)%20or%20isof(%27microsoft.graph.iosStoreApp%27)%20or%20isof(%27microsoft.graph.iosVppApp%27)%20or%20isof(%27microsoft.graph.managedIOSLobApp%27)%20or%20(isof(%27microsoft.graph.managedIOSStoreApp%27)%20and%20microsoft.graph.managedApp/appAvailability%20eq%20microsoft.graph.managedAppAvailability%27global%27)%20or%20isof(%27microsoft.graph.webApp%27)%20or%20isof(%27microsoft.graph.iOSiPadOSWebClip%27))%20and%20(microsoft.graph.managedApp/appAvailability%20eq%20null%20or%20microsoft.graph.managedApp/appAvailability%20eq%20%27lineOfBusiness%27%20or%20isAssigned%20eq%20true)&$orderby=displayName&"

if args.select:

api_url += "$select=" + args.select # some fields will 400 whole req

if args.id:

api_url = f"https://graph.microsoft.com/beta/deviceAppManagement/mobileApps/{args.id}?$expand=assignments"

user_agent = get_user_agent(args)

headers = {

'Authorization': f'Bearer {get_access_token(args.token)}',

'User-Agent': user_agent

}

try:

response = requests.get(api_url, headers=headers)

response.raise_for_status()

json_data = response.json()

json_data.pop('@odata.context', None)

json_data.pop('assignments@odata.context', None)

for key, value in json_data.items():

if key == 'assignments':

if not value:

print_red("assignments: None")

else:

print_green("assignments:")

for assignment in value:

print(f" - ID: {assignment['id']}")

print(f" Intent: {assignment['intent']}")

if 'target' in assignment:

target = assignment['target']

odata_type = target.get('@odata.type', '').split('.')[-1]

print(f" Target:")

if odata_type == 'exclusionGroupAssignmentTarget':

group_id = target.get('groupId', 'N/A')

print(f" Excluded Group ID: {group_id}")

elif odata_type == 'allLicensedUsersAssignmentTarget':

print(" Assigned to all users")

elif odata_type == 'allDevicesAssignmentTarget':

print(" Assigned to all devices")

elif odata_type == 'groupAssignmentTarget':

group_id = target.get('groupId', 'N/A')

print(f" Assigned to Group ID: {group_id}")

else:

print(f" {odata_type}: {target}")

print()

else:

print(f"{key}: {value}")

except requests.exceptions.RequestException as ex:

print_red(f"[-] HTTP Error: {ex}")

print("=" * 80)

return

graph_api_get(get_access_token(args.token), api_url, args)

print("=" * 80)

# dump-macosapps

def dump_macosapps(args):

print_yellow("[*] Dump-macOSApps")

print("=" * 80)

api_url = "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?$filter=(isof(%27microsoft.graph.macOSDmgApp%27)%20or%20isof(%27microsoft.graph.macOSPkgApp%27)%20or%20isof(%27microsoft.graph.macOSLobApp%27)%20or%20isof(%27microsoft.graph.macOSMicrosoftEdgeApp%27)%20or%20isof(%27microsoft.graph.macOSMicrosoftDefenderApp%27)%20or%20isof(%27microsoft.graph.macOSOfficeSuiteApp%27)%20or%20isof(%27microsoft.graph.macOsVppApp%27)%20or%20isof(%27microsoft.graph.webApp%27)%20or%20isof(%27microsoft.graph.macOSWebClip%27))%20and%20(microsoft.graph.managedApp/appAvailability%20eq%20null%20or%20microsoft.graph.managedApp/appAvailability%20eq%20%27lineOfBusiness%27%20or%20isAssigned%20eq%20true)&$orderby=displayName&"

if args.select:

api_url += "$select=" + args.select # some fields will 400 whole req

if args.id:

api_url = f"https://graph.microsoft.com/beta/deviceAppManagement/mobileApps/{args.id}?$expand=assignments"

user_agent = get_user_agent(args)

headers = {

'Authorization': f'Bearer {get_access_token(args.token)}',

'User-Agent': user_agent

}

try:

response = requests.get(api_url, headers=headers)

response.raise_for_status()

json_data = response.json()

json_data.pop('@odata.context', None)

json_data.pop('assignments@odata.context', None)

for key, value in json_data.items():

if key == 'assignments':

if not value:

print_red("assignments: None")

else:

print_green("assignments:")

for assignment in value:

print(f" - ID: {assignment['id']}")

print(f" Intent: {assignment['intent']}")

if 'target' in assignment:

target = assignment['target']

odata_type = target.get('@odata.type', '').split('.')[-1]

print(f" Target:")

if odata_type == 'exclusionGroupAssignmentTarget':

group_id = target.get('groupId', 'N/A')

print(f" Excluded Group ID: {group_id}")

elif odata_type == 'allLicensedUsersAssignmentTarget':

print(" Assigned to all users")

elif odata_type == 'allDevicesAssignmentTarget':

print(" Assigned to all devices")

elif odata_type == 'groupAssignmentTarget':

group_id = target.get('groupId', 'N/A')

print(f" Assigned to Group ID: {group_id}")

else:

print(f" {odata_type}: {target}")

print()

else:

print(f"{key}: {value}")

except requests.exceptions.RequestException as ex:

print_red(f"[-] HTTP Error: {ex}")

print("=" * 80)

return

graph_api_get(get_access_token(args.token), api_url, args)

print("=" * 80)

# dump-androidapps

def dump_androidapps(args):

print_yellow("[*] Dump-AndroidApps")

print("=" * 80)

api_url = "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?$filter=((isof(%27microsoft.graph.androidManagedStoreApp%27)%20and%20microsoft.graph.androidManagedStoreApp/isSystemApp%20eq%20true)%20or%20isof(%27microsoft.graph.androidLobApp%27)%20or%20isof(%27microsoft.graph.androidStoreApp%27)%20or%20(isof(%27microsoft.graph.managedAndroidStoreApp%27)%20and%20microsoft.graph.managedApp/appAvailability%20eq%20microsoft.graph.managedAppAvailability%27lineOfBusiness%27)%20or%20isof(%27microsoft.graph.managedAndroidLobApp%27)%20or%20(isof(%27microsoft.graph.managedAndroidStoreApp%27)%20and%20microsoft.graph.managedApp/appAvailability%20eq%20microsoft.graph.managedAppAvailability%27global%27)%20or%20(isof(%27microsoft.graph.androidManagedStoreApp%27)%20and%20microsoft.graph.androidManagedStoreApp/isSystemApp%20eq%20false)%20or%20isof(%27microsoft.graph.webApp%27))%20and%20(microsoft.graph.managedApp/appAvailability%20eq%20null%20or%20microsoft.graph.managedApp/appAvailability%20eq%20%27lineOfBusiness%27%20or%20isAssigned%20eq%20true)&$orderby=displayName&"

if args.select:

api_url += "$select=" + args.select # some fields will 400 whole req

if args.id:

api_url = f"https://graph.microsoft.com/beta/deviceAppManagement/mobileApps/{args.id}?$expand=assignments"

user_agent = get_user_agent(args)

headers = {

'Authorization': f'Bearer {get_access_token(args.token)}',

'User-Agent': user_agent

}

try:

response = requests.get(api_url, headers=headers)

response.raise_for_status()

json_data = response.json()

json_data.pop('@odata.context', None)

json_data.pop('assignments@odata.context', None)

for key, value in json_data.items():

if key == 'assignments':

if not value:

print_red("assignments: None")

else:

print_green("assignments:")

for assignment in value:

print(f" - ID: {assignment['id']}")

print(f" Intent: {assignment['intent']}")

if 'target' in assignment:

target = assignment['target']

odata_type = target.get('@odata.type', '').split('.')[-1]

print(f" Target:")

if odata_type == 'exclusionGroupAssignmentTarget':

group_id = target.get('groupId', 'N/A')

print(f" Excluded Group ID: {group_id}")

elif odata_type == 'allLicensedUsersAssignmentTarget':

print(" Assigned to all users")

elif odata_type == 'allDevicesAssignmentTarget':

print(" Assigned to all devices")

elif odata_type == 'groupAssignmentTarget':

group_id = target.get('groupId', 'N/A')

print(f" Assigned to Group ID: {group_id}")

else:

print(f" {odata_type}: {target}")

print()

else:

print(f"{key}: {value}")

except requests.exceptions.RequestException as ex:

print_red(f"[-] HTTP Error: {ex}")

print("=" * 80)

return

graph_api_get(get_access_token(args.token), api_url, args)

print("=" * 80)

# get-scriptcontent

def get_scriptcontent(args):

if not args.id:

print_red("[-] Error: --id argument is required for Get-ScriptContent command")

return

print_yellow("[*] Get-ScriptContent")

print("=" * 80)

api_url = f"https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts/{args.id}"

if args.select:

api_url += "&$select=" + args.select

user_agent = get_user_agent(args)

headers = {

'Authorization': f'Bearer {get_access_token(args.token)}',

'User-Agent': user_agent

}

try:

response = requests.get(api_url, headers=headers)

response.raise_for_status()

json_data = response.json()

json_data.pop('@odata.context', None)

script_content = json_data.get('scriptContent')

if script_content:

decoded_script_content = base64.b64decode(script_content).decode('utf-8')

json_data['scriptContent'] = decoded_script_content

json_data.pop('scriptContent', None)

for key, value in json_data.items():

print(f"{key} : {value}")

if script_content:

print("scriptContent :\n")

print(decoded_script_content)

except requests.exceptions.RequestException as ex:

print(f"[-] HTTP Error: {ex}")

print("=" * 80)

# display-avpolicyrules

def display_avpolicyrules(args):

if not args.id:

print_red("[-] Error: --id argument is required for Display-AVPolicyRules command")

return

print_yellow("[*] Display-AVPolicyRules")

print("=" * 80)

api_url = f"https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('{args.id}')/settings"

if args.select:

api_url += "?$select=" + args.select

user_agent = get_user_agent(args)

headers = {

'Authorization': f'Bearer {get_access_token(args.token)}',

'Content-Type': 'application/json',

'User-Agent': user_agent

}

settings_map = {

"device_vendor_msft_policy_config_defender_threatseveritydefaultaction_highseveritythreats": {

"description": "Remediation action for High severity threats",

"values": {

"4=1": "Clean (service tries to recover files and try to disinfect)",

"4=2": "Quarantine (moves files to quarantine)",

"4=3": "Remove (removes files from system)",

"4=6": "Allow (allows file/does none of the above actions)",

"4=8": "User defined (requires user to make a decision on which action to take)",

"4=10": "Block (blocks file execution)"

}

},

"device_vendor_msft_policy_config_defender_threatseveritydefaultaction_lowseveritythreats": {

"description": "Remediation action for Low severity threats",

"values": {

"1=1": "Clean (service tries to recover files and try to disinfect)",

"1=2": "Quarantine (moves files to quarantine)",

"1=3": "Remove (removes files from system)",

"1=6": "Allow (allows file/does none of the above actions)",

"1=8": "User defined (requires user to make a decision on which action to take)",

"1=10": "Block (blocks file execution)"

}

},

"device_vendor_msft_policy_config_defender_threatseveritydefaultaction_moderateseveritythreats": {

"description": "Remediation action for Moderate severity threats",

"values": {

"2=1": "Clean (service tries to recover files and try to disinfect)",

"2=2": "Quarantine (moves files to quarantine)",

"2=3": "Remove (removes files from system)",

"2=6": "Allow (allows file/does none of the above actions)",

"2=8": "User defined (requires user to make a decision on which action to take)",

"2=10": "Block (blocks file execution)"

}

},

"device_vendor_msft_policy_config_defender_threatseveritydefaultaction_severethreats": {

"description": "Remediation action for Severe threats",

"values": {

"5=1": "Clean (service tries to recover files and try to disinfect)",

"5=2": "Quarantine (moves files to quarantine)",

"5=3": "Remove (removes files from system)",

"5=6": "Allow (allows file/does none of the above actions)",

"5=8": "User defined (requires user to make a decision on which action to take)",

"5=10": "Block (blocks file execution)"

}

},

"device_vendor_msft_policy_config_defender_allowarchivescanning": {

"description": "Allow archive scanning",

"values": {

"0": "Not allowed (turns off scanning on archived files)",

"1": "Allowed (scans the archive files)"

}

},

"device_vendor_msft_policy_config_defender_allowbehaviormonitoring": {

"description": "Allow behavior monitoring",

"values": {

"0": "Not allowed (turns off behavior monitoring)",

"1": "Allowed (turns on real-time behavior monitoring)"

}

},

"device_vendor_msft_policy_config_defender_allowcloudprotection": {

"description": "Allow cloud protection",

"values": {

"0": "Not allowed (turns off Cloud Protection)",

"1": "Allowed (turns on Cloud Protection"

}

},

"device_vendor_msft_policy_config_defender_allowemailscanning": {

"description": "Allow email scanning",

"values": {

"0": "Not allowed (turns off email scanning)",

"1": "Allowed (turns on email scanning)"

}

},

"device_vendor_msft_policy_config_defender_allowfullscanonmappednetworkdrives": {

"description": "Allow full scan on mapped network drives",

"values": {

"0": "Not allowed (disables scanning on mapped network drives)",

"1": "Allowed (scans mapped network drives)"

}

},

"device_vendor_msft_policy_config_defender_allowfullscanremovabledrivescanning": {

"description": "Allow full scan on removable drives",

"values": {

"0": "Not allowed (turns off scanning on removable drives)",

"1": "Allowed (scans removable drives)"

}

},

"device_vendor_msft_policy_config_defender_allowintrusionpreventionsystem": {

"description": "Allow intrusion prevention system",

"values": {

"0": "Not allowed",

"1": "Allowed"

}

},

"device_vendor_msft_policy_config_defender_allowioavprotection": {

"description": "Allow IOAV protection",

"values": {

"0": "Not allowed",

"1": "Allowed"

}

},

"device_vendor_msft_policy_config_defender_allowrealtimemonitoring": {

"description": "Allow real-time monitoring",

"values": {

"0": "Not allowed",

"1": "Allowed"

}

},

"device_vendor_msft_policy_config_defender_allowscanningnetworkfiles": {

"description": "Allow scanning network files",

"values": {

"0": "Not allowed",

"1": "Allowed"

}

},

"device_vendor_msft_policy_config_defender_allowscriptscanning": {

"description": "Allow script scanning",

"values": {

"0": "Not allowed",

"1": "Allowed"

}

},

"device_vendor_msft_policy_config_defender_allowuseruiaccess": {

"description": "Allow user UI access",

"values": {

"0": "Not allowed",

"1": "Allowed"

}

},

"device_vendor_msft_policy_config_defender_checkforsignaturesbeforerunningscan": {

"description": "Check for signatures before running scan",

"values": {

"0": "Not required",

"1": "Required"

}

},

"device_vendor_msft_policy_config_defender_cloudblocklevel": {

"description": "Cloud block level",

"values": {

"0": "Disabled",

"1": "Basic",

"2": "High"

}

},

"device_vendor_msft_policy_config_defender_disablecatchupfullscan": {

"description": "Disable catch-up full scan",

"values": {

"0": "Enabled",

"1": "Disabled"

}

},

"device_vendor_msft_policy_config_defender_disablecatchupquickscan": {

"description": "Disable catch-up quick scan",

"values": {

"0": "Enabled",

"1": "Disabled"

}

},

"device_vendor_msft_policy_config_defender_enablelowcpupriority": {

"description": "Enable low CPU priority",

"values": {

"0": "Disabled",

"1": "Enabled"

}

},

"device_vendor_msft_policy_config_defender_enablenetworkprotection": {

"description": "Enable network protection",

"values": {

"0": "Disabled",

"1": "Enabled"

}

},

"device_vendor_msft_policy_config_defender_excludedextensions": {

"description": "Excluded extensions",

"values": {}

},

"device_vendor_msft_policy_config_defender_excludedpaths": {

"description": "Excluded paths",

"values": {}

},

"device_vendor_msft_policy_config_defender_excludedprocesses": {

"description": "Excluded processes",

"values": {}

},

"device_vendor_msft_policy_config_defender_puaprotection": {

"description": "PUA protection",

"values": {

"0": "Disabled",

"1": "Enabled"

}

},

"device_vendor_msft_policy_config_defender_realtimescandirection": {

"description": "Real-time scan direction",

"values": {

"0": "Both directions",

"1": "Inbound only",

"2": "Outbound only"

}

},

"device_vendor_msft_policy_config_defender_scanparameter": {

"description": "Scan parameter",

"values": {

"0": "Quick scan",

"1": "Full scan"

}

}

}

response = requests.get(api_url, headers=headers)

if response.status_code == 200:

response_json = response.json()

for setting in response_json.get('value', []):

if 'settingInstance' in setting:

setting_instance = setting['settingInstance']

setting_id = setting_instance.get('settingDefinitionId', '')

if setting_id in settings_map:

description = settings_map[setting_id]['description']

if setting_instance['@odata.type'] == '#microsoft.graph.deviceManagementConfigurationSimpleSettingCollectionInstance':

simple_setting_values = setting_instance.get('simpleSettingCollectionValue', [])

value_list = [simple_setting_value.get('value', '') for simple_setting_value in simple_setting_values if simple_setting_value.get('value')]

value = ', '.join(value_list)

print(f"{description} : {value}")

elif 'choiceSettingValue' in setting_instance:

value = setting_instance['choiceSettingValue'].get('value', '')

value_suffix = value[len(setting_id):].lstrip('_')

if value_suffix in settings_map[setting_id]['values']:

mapped_value = settings_map[setting_id]['values'][value_suffix]

elif value_suffix == 'block':

mapped_value = 'BLOCK'

elif value_suffix == 'allow':

mapped_value = 'ALLOW'

else:

mapped_value = value_suffix.upper()

print(f"{mapped_value:<10} : {description}")

# group setting collection values

for setting in response_json.get('value', []):

if 'settingInstance' in setting and 'groupSettingCollectionValue' in setting['settingInstance']:

group_settings = setting['settingInstance']['groupSettingCollectionValue']

for group_setting in group_settings:

for child in group_setting.get('children', []):

choice_setting_value = child.get('choiceSettingValue', {})

value = choice_setting_value.get('value', '')

setting_id = child.get('settingDefinitionId', '')

if setting_id in settings_map:

description = settings_map[setting_id]['description']

value_suffix = value[len(setting_id):].lstrip('_')

if value_suffix in settings_map[setting_id]['values']:

mapped_value = settings_map[setting_id]['values'][value_suffix]

elif value_suffix == 'block':

mapped_value = 'BLOCK'

elif value_suffix == 'allow':

mapped_value = 'ALLOW'

else:

mapped_value = value_suffix.upper()

print(f"{mapped_value:<10} : {description}")

else:

print_red(f"[-] Failed to retrieve settings: {response.status_code}")

print_red(response.text)

print("=" * 80)

# display-asrpolicyrules

def display_asrpolicyrules(args):

if not args.id:

print_red("[-] Error: --id argument is required for Display-ASRPolicyRules command")

return

print_yellow("[*] Display-ASRPolicyRules")

print("=" * 80)

api_url = f"https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('{args.id}')/settings"

if args.select:

api_url += "?$select=" + args.select

user_agent = get_user_agent(args)

headers = {

'Authorization': f'Bearer {get_access_token(args.token)}',

'Content-Type': 'application/json',

'User-Agent': user_agent

}

settings_map = {

"blockadobereaderfromcreatingchildprocesses": "Block Adobe Reader from creating child processes",

"blockprocesscreationsfrompsexecandwmicommands": "Block process creations from PSExec and WMI commands",

"blockexecutionofpotentiallyobfuscatedscripts": "Block execution of potentially obfuscated scripts",

"blockpersistencethroughwmieventsubscription": "Block persistence through WMI event subscription",

"blockwin32apicallsfromofficemacros": "Block Win32 API calls from Office macros",

"blockofficeapplicationsfromcreatingexecutablecontent": "Block Office applications from creating executable content",

"blockcredentialstealingfromwindowslocalsecurityauthoritysubsystem": "Block credential stealing from Windows local security authority subsystem",

"blockexecutablefilesrunningunlesstheymeetprevalenceagetrustedlistcriterion": "Block executable files running unless they meet prevalence age trusted list criterion",

"blockjavascriptorvbscriptfromlaunchingdownloadedexecutablecontent": "Block JavaScript or VBScript from launching downloaded executable content",

"blockofficecommunicationappfromcreatingchildprocesses": "Block Office communication app from creating child processes",

"blockofficeapplicationsfrominjectingcodeintootherprocesses": "Block Office applications from injecting code into other processes",

"blockallofficeapplicationsfromcreatingchildprocesses": "Block all Office applications from creating child processes",

"blockwebshellcreationforservers": "Block web shell creation for servers",

"blockuntrustedunsignedprocessesthatrunfromusb": "Block untrusted unsigned processes that run from USB",

"useadvancedprotectionagainstransomware": "Use advanced protection against ransomware",

"blockexecutablecontentfromemailclientandwebmail": "Block executable content from email client and webmail",

"blockabuseofexploitedvulnerablesigneddrivers": "Block abuse of exploited vulnerable signed drivers"

}

response = requests.get(api_url, headers=headers)

if response.status_code == 200:

response_json = response.json()

if "value" in response_json:

for item in response_json["value"]:

setting_instance = item.get("settingInstance", {})

group_settings = setting_instance.get("groupSettingCollectionValue", [])

for group in group_settings:

children = group.get("children", [])

for child in children:

choice_setting_value = child.get("choiceSettingValue", {})

value = choice_setting_value.get("value", "")

if value:

parts = value.split("_")

if len(parts) >= 2:

action = parts[-1].upper()

rule_name = "_".join(parts[:-1])

rule_name = rule_name.replace("device_vendor_msft_policy_config_defender_attacksurfacereductionrules_", "")

readable_rule = settings_map.get(rule_name, rule_name)

print(f"{action:<6}: {readable_rule}")

else:

print_red(f"[-] Failed to retrieve settings: {response.status_code}")

print_red(response.text)

print("=" * 80)

# display-diskencryptionpolicyrules

def display_diskencryptionpolicyrules(args):

if not args.id:

print_red("[-] Error: --id argument is required for Display-DiskEncryptionPolicyRules command")

return

print_yellow("[*] Display-DiskEncryptionPolicyRules")

print("=" * 80)

api_url = f"https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('{args.id}')/settings" #?$expand=settingDefinitions"

if args.select:

api_url += "?$select=" + args.select

user_agent = get_user_agent(args)

headers = {

'Authorization': f'Bearer {get_access_token(args.token)}',

'Content-Type': 'application/json',

'User-Agent': user_agent

}

settings_map = {

"device_vendor_msft_bitlocker_fixeddrivesencryptiontype": "Enforce drive encryption type on fixed data drives",

"device_vendor_msft_bitlocker_fixeddrivesrecoveryoptions": "Choose how BitLocker-protected fixed drives can be recovered",

"device_vendor_msft_bitlocker_fixeddrivesrequireencryption": "Deny write access to fixed drives not protected by BitLocker",

"device_vendor_msft_bitlocker_systemdrivesencryptiontype": "Enforce drive encryption type on operating system drives",

"device_vendor_msft_bitlocker_systemdrivesrequirestartupauthentication": "Require additional authentication at startup",

"device_vendor_msft_bitlocker_systemdrivesminimumpinlength": "Configure minimum PIN length for startup",

"device_vendor_msft_bitlocker_systemdrivesenhancedpin": "Allow enhanced PINs for startup",

"device_vendor_msft_bitlocker_systemdrivesdisallowstandarduserscanchangepin": "Disallow standard users from changing the PIN or password",

"device_vendor_msft_bitlocker_systemdrivesenableprebootpinexceptionondecapabledevice": "Allow devices compliant with InstantGo or HSTI to opt out of pre-boot PIN",

"device_vendor_msft_bitlocker_systemdrivesenableprebootinputprotectorsonslates": "Enable use of BitLocker authentication requiring preboot keyboard input on slates",

"device_vendor_msft_bitlocker_systemdrivesrecoveryoptions": "Choose how BitLocker-protected operating system drives can be recovered",

"device_vendor_msft_bitlocker_systemdrivesrecoverymessage": "Configure pre-boot recovery message and URL",

"device_vendor_msft_bitlocker_removabledrivesconfigurebde": "Control use of BitLocker on removable drives",

"device_vendor_msft_bitlocker_removabledrivesrequireencryption": "Deny write access to removable drives not protected by BitLocker",

"device_vendor_msft_bitlocker_encryptionmethodbydrivetype": "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)",

"device_vendor_msft_bitlocker_identificationfield": "Provide the unique identifiers for your organization",

"device_vendor_msft_bitlocker_requiredeviceencryption": "Require Device Encryption",

"device_vendor_msft_bitlocker_allowwarningforotherdiskencryption": "Allow Standard User Encryption",

"device_vendor_msft_bitlocker_configurerecoverypasswordrotation": "Configure Recovery Password Rotation"

}

response = requests.get(api_url, headers=headers)

if response.status_code == 200:

response_json = response.json()

for setting in response_json.get('value', []):

if 'settingInstance' in setting and 'choiceSettingValue' in setting['settingInstance']:

value_field = setting['settingInstance']['choiceSettingValue'].get('value')

if value_field:

cleaned_value = value_field.rstrip('_01')

if cleaned_value in settings_map:

setting_text = settings_map[cleaned_value]

if value_field.endswith('_1'):

print(f"ENABLED : {setting_text}")

elif value_field.endswith('_0'):

print(f"DISABLED : {setting_text}")

else:

print(f"{setting_text} - {value_field}")

else:

print_red(f"[-] Failed to retrieve settings: {response.status_code}")

print_red(response.text)

print("=" * 80)

# display-firewallconfigpolicyrules - firewall config policy

def display_firewallconfigpolicyrules(args):

if not args.id:

print_red("[-] Error: --id argument is required for display-firewallconfigpolicyrules command")

return

print_yellow("[*] Display-FirewallConfigPolicyRules")

print("=" * 80)

api_url = f"https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('{args.id}')/settings"

user_agent = get_user_agent(args)

headers = {

'Authorization': f'Bearer {get_access_token(args.token)}',

'Content-Type': 'application/json',

'User-Agent': user_agent

}

settings_map = {

"vendor_msft_firewall_mdmstore_global_crlcheck": {

"displayName": "Certificate revocation list verification",

"options": {

"vendor_msft_firewall_mdmstore_global_crlcheck_0": "None - Disables CRL checking",

"vendor_msft_firewall_mdmstore_global_crlcheck_1": "Attempt - checking is attempted and that certificate validation fails only if the certificate is revoked",

"vendor_msft_firewall_mdmstore_global_crlcheck_2": "Require - checking is required and that certificate validation fails if any error is encountered during CRL processing",

}

},

"vendor_msft_firewall_mdmstore_global_disablestatefulftp": {

"displayName": "Disable Stateful Ftp",

"options": {

"vendor_msft_firewall_mdmstore_global_disablestatefulftp_false": "Stateful FTP enabled",

"vendor_msft_firewall_mdmstore_global_disablestatefulftp_true": "Stateful FTP disabled",

}

},

"vendor_msft_firewall_mdmstore_global_enablepacketqueue": {

"displayName": "Enable Packet Queue",

"options": {

"vendor_msft_firewall_mdmstore_global_enablepacketqueue_0": "Disabled - Indicates that all queuing is to be disabled",

"vendor_msft_firewall_mdmstore_global_enablepacketqueue_1": "Queue Inbound - inbound encrypted packets are to be queued",

"vendor_msft_firewall_mdmstore_global_enablepacketqueue_2": "Queue Outbound - packets are to be queued after decryption is performed for forwarding",

}

},

"vendor_msft_firewall_mdmstore_global_ipsecexempt": {

"displayName": "IPsec Exceptions",

"options": {

"vendor_msft_firewall_mdmstore_global_ipsecexempt_0": "FW_GLOBAL_CONFIG_IPSEC_EXEMPT_NONE: No IPsec exemptions.",

"vendor_msft_firewall_mdmstore_global_ipsecexempt_1": "FW_GLOBAL_CONFIG_IPSEC_EXEMPT_NEIGHBOR_DISC: Exempt neighbor discover IPv6 ICMP type-codes from IPsec.",

"vendor_msft_firewall_mdmstore_global_ipsecexempt_2": "FW_GLOBAL_CONFIG_IPSEC_EXEMPT_ICMP: Exempt ICMP from IPsec.",

"vendor_msft_firewall_mdmstore_global_ipsecexempt_4": "FW_GLOBAL_CONFIG_IPSEC_EXEMPT_ROUTER_DISC: Exempt router discover IPv6 ICMP type-codes from IPsec.",

"vendor_msft_firewall_mdmstore_global_ipsecexempt_8": "FW_GLOBAL_CONFIG_IPSEC_EXEMPT_DHCP: Exempt both IPv4 and IPv6 DHCP traffic from IPsec.",

}

},

"vendor_msft_firewall_mdmstore_global_opportunisticallymatchauthsetperkm": {

"displayName": "Opportunistically Match Auth Set Per KM",

"options": {

"vendor_msft_firewall_mdmstore_global_opportunisticallymatchauthsetperkm_false": "FALSE",

"vendor_msft_firewall_mdmstore_global_opportunisticallymatchauthsetperkm_true": "TRUE",

}

},

"vendor_msft_firewall_mdmstore_global_presharedkeyencoding": {

"displayName": "Preshared Key Encoding",

"options": {

"vendor_msft_firewall_mdmstore_global_presharedkeyencoding_0": "FW_GLOBAL_CONFIG_PRESHARED_KEY_ENCODING_NONE: Preshared key is not encoded. Instead, it is kept in its wide-character format. This symbolic constant has a value of 0.",

"vendor_msft_firewall_mdmstore_global_presharedkeyencoding_1": "FW_GLOBAL_CONFIG_PRESHARED_KEY_ENCODING_UTF_8: Encode the preshared key using UTF-8. This symbolic constant has a value of 1.",

}

},

"vendor_msft_firewall_mdmstore_global_saidletime": {

"displayName": "Security association idle time",

"options": {}

},

"vendor_msft_firewall_mdmstore_domainprofile_allowlocalipsecpolicymerge": {

"displayName": "Allow Local Ipsec Policy Merge",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_allowlocalipsecpolicymerge_false": "AllowLocalIpsecPolicyMerge Off",

"vendor_msft_firewall_mdmstore_domainprofile_allowlocalipsecpolicymerge_true": "AllowLocalIpsecPolicyMerge On",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_authappsallowuserprefmerge": {

"displayName": "Auth Apps Allow User Pref Merge",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_authappsallowuserprefmerge_false": "AuthAppsAllowUserPrefMerge Off",

"vendor_msft_firewall_mdmstore_domainprofile_authappsallowuserprefmerge_true": "AuthAppsAllowUserPrefMerge On",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_enablelogdroppedpackets": {

"displayName": "Enable Log Dropped Packets",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_enablelogdroppedpackets_false": "Disable Logging Of Dropped Packets",

"vendor_msft_firewall_mdmstore_domainprofile_enablelogdroppedpackets_true": "Enable Logging Of Dropped Packets",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_disableunicastresponsestomulticastbroadcast": {

"displayName": "Disable Unicast Responses To Multicast Broadcast",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_disableunicastresponsestomulticastbroadcast_false": "Unicast Responses Not Blocked",

"vendor_msft_firewall_mdmstore_domainprofile_disableunicastresponsestomulticastbroadcast_true": "Unicast Responses Blocked",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_shielded": {

"displayName": "Shielded",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_shielded_false": "Shielding Off",

"vendor_msft_firewall_mdmstore_domainprofile_shielded_true": "Shielding On",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_allowlocalpolicymerge": {

"displayName": "Allow Local Policy Merge",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_allowlocalpolicymerge_false": "AllowLocalPolicyMerge Off",

"vendor_msft_firewall_mdmstore_domainprofile_allowlocalpolicymerge_true": "AllowLocalPolicyMerge On",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_defaultoutboundaction": {

"displayName": "Default Outbound Action",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_defaultoutboundaction_0": "Allow Outbound By Default",

"vendor_msft_firewall_mdmstore_domainprofile_defaultoutboundaction_1": "Block Outbound By Default",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_enablelogignoredrules": {

"displayName": "Enable Log Ignored Rules",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_enablelogignoredrules_false": "Disable Logging Of Ignored Rules",

"vendor_msft_firewall_mdmstore_domainprofile_enablelogignoredrules_true": "Enable Logging Of Ignored Rules",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_disableinboundnotifications": {

"displayName": "Disable Inbound Notifications",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_disableinboundnotifications_false": "Firewall May Display Notification",

"vendor_msft_firewall_mdmstore_domainprofile_disableinboundnotifications_true": "Firewall Must Not Display Notification",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_enablelogsuccessconnections": {

"displayName": "Enable Log Success Connections",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_enablelogsuccessconnections_false": "Disable Logging Of Successful Connections",

"vendor_msft_firewall_mdmstore_domainprofile_enablelogsuccessconnections_true": "Enable Logging Of Successful Connections",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_logfilepath": {

"displayName": "Log File Path",

"options": {}

},

"vendor_msft_firewall_mdmstore_domainprofile_enablefirewall": {

"displayName": "Enable Domain Network Firewall",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_enablefirewall_false": "Disable Firewall",

"vendor_msft_firewall_mdmstore_domainprofile_enablefirewall_true": "Enable Firewall",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_logmaxfilesize": {

"displayName": "Log Max File Size",

"options": {}

},

"vendor_msft_firewall_mdmstore_domainprofile_globalportsallowuserprefmerge": {

"displayName": "Global Ports Allow User Pref Merge",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_globalportsallowuserprefmerge_false": "GlobalPortsAllowUserPrefMerge Off",

"vendor_msft_firewall_mdmstore_domainprofile_globalportsallowuserprefmerge_true": "GlobalPortsAllowUserPrefMerge On",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_defaultinboundaction": {

"displayName": "Default Inbound Action for Domain Profile",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_defaultinboundaction_0": "Allow Inbound By Default",

"vendor_msft_firewall_mdmstore_domainprofile_defaultinboundaction_1": "Block Inbound By Default",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_disablestealthmodeipsecsecuredpacketexemption": {

"displayName": "Disable Stealth Mode Ipsec Secured Packet Exemption",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_disablestealthmodeipsecsecuredpacketexemption_false": "FALSE",

"vendor_msft_firewall_mdmstore_domainprofile_disablestealthmodeipsecsecuredpacketexemption_true": "TRUE",

}

},

"vendor_msft_firewall_mdmstore_domainprofile_disablestealthmode": {

"displayName": "Disable Stealth Mode",

"options": {

"vendor_msft_firewall_mdmstore_domainprofile_disablestealthmode_false": "Use Stealth Mode",

"vendor_msft_firewall_mdmstore_domainprofile_disablestealthmode_true": "Disable Stealth Mode",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_allowlocalipsecpolicymerge": {

"displayName": "Allow Local Ipsec Policy Merge",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_allowlocalipsecpolicymerge_false": "AllowLocalIpsecPolicyMerge Off",

"vendor_msft_firewall_mdmstore_privateprofile_allowlocalipsecpolicymerge_true": "AllowLocalIpsecPolicyMerge On",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_authappsallowuserprefmerge": {

"displayName": "Auth Apps Allow User Pref Merge",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_authappsallowuserprefmerge_false": "AuthAppsAllowUserPrefMerge Off",

"vendor_msft_firewall_mdmstore_privateprofile_authappsallowuserprefmerge_true": "AuthAppsAllowUserPrefMerge On",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_enablefirewall": {

"displayName": "Enable Private Network Firewall",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_enablefirewall_false": "Disable Firewall",

"vendor_msft_firewall_mdmstore_privateprofile_enablefirewall_true": "Enable Firewall",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_logmaxfilesize": {

"displayName": "Log Max File Size",

"options": {}

},

"vendor_msft_firewall_mdmstore_privateprofile_globalportsallowuserprefmerge": {

"displayName": "Global Ports Allow User Pref Merge",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_globalportsallowuserprefmerge_false": "GlobalPortsAllowUserPrefMerge Off",

"vendor_msft_firewall_mdmstore_privateprofile_globalportsallowuserprefmerge_true": "GlobalPortsAllowUserPrefMerge On",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_defaultinboundaction": {

"displayName": "Default Inbound Action for Private Profile",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_defaultinboundaction_0": "Allow Inbound By Default",

"vendor_msft_firewall_mdmstore_privateprofile_defaultinboundaction_1": "Block Inbound By Default",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_disableunicastresponsestomulticastbroadcast": {

"displayName": "Disable Unicast Responses To Multicast Broadcast",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_disableunicastresponsestomulticastbroadcast_false": "Unicast Responses Not Blocked",

"vendor_msft_firewall_mdmstore_privateprofile_disableunicastresponsestomulticastbroadcast_true": "Unicast Responses Blocked",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_logfilepath": {

"displayName": "Log File Path",

"options": {}

},

"vendor_msft_firewall_mdmstore_privateprofile_disablestealthmode": {

"displayName": "Disable Stealth Mode",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_disablestealthmode_false": "Use Stealth Mode",

"vendor_msft_firewall_mdmstore_privateprofile_disablestealthmode_true": "Disable Stealth Mode",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_enablelogdroppedpackets": {

"displayName": "Enable Log Dropped Packets",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_enablelogdroppedpackets_false": "Disable Logging Of Dropped Packets",

"vendor_msft_firewall_mdmstore_privateprofile_enablelogdroppedpackets_true": "Enable Logging Of Dropped Packets",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_disablestealthmodeipsecsecuredpacketexemption": {

"displayName": "Disable Stealth Mode Ipsec Secured Packet Exemption",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_disablestealthmodeipsecsecuredpacketexemption_false": "FALSE",

"vendor_msft_firewall_mdmstore_privateprofile_disablestealthmodeipsecsecuredpacketexemption_true": "TRUE",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_disableinboundnotifications": {

"displayName": "Disable Inbound Notifications",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_disableinboundnotifications_false": "Firewall May Display Notification",

"vendor_msft_firewall_mdmstore_privateprofile_disableinboundnotifications_true": "Firewall Must Not Display Notification",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_enablelogsuccessconnections": {

"displayName": "Enable Log Success Connections",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_enablelogsuccessconnections_false": "Disable Logging Of Successful Connections",

"vendor_msft_firewall_mdmstore_privateprofile_enablelogsuccessconnections_true": "Enable Logging Of Successful Connections",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_shielded": {

"displayName": "Shielded",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_shielded_false": "Shielding Off",

"vendor_msft_firewall_mdmstore_privateprofile_shielded_true": "Shielding On",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_allowlocalpolicymerge": {

"displayName": "Allow Local Policy Merge",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_allowlocalpolicymerge_false": "AllowLocalPolicyMerge Off",

"vendor_msft_firewall_mdmstore_privateprofile_allowlocalpolicymerge_true": "AllowLocalPolicyMerge On",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_defaultoutboundaction": {

"displayName": "Default Outbound Action",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_defaultoutboundaction_0": "Allow Outbound By Default",

"vendor_msft_firewall_mdmstore_privateprofile_defaultoutboundaction_1": "Block Outbound By Default",

}

},

"vendor_msft_firewall_mdmstore_privateprofile_enablelogignoredrules": {

"displayName": "Enable Log Ignored Rules",

"options": {

"vendor_msft_firewall_mdmstore_privateprofile_enablelogignoredrules_false": "Disable Logging Of Ignored Rules",

"vendor_msft_firewall_mdmstore_privateprofile_enablelogignoredrules_true": "Enable Logging Of Ignored Rules",

}

},

"vendor_msft_firewall_mdmstore_publicprofile_disableunicastresponsestomulticastbroadcast": {

"displayName": "Disable Unicast Responses To Multicast Broadcast",

"options": {

"vendor_msft_firewall_mdmstore_publicprofile_disableunicastresponsestomulticastbroadcast_false": "Unicast Responses Not Blocked",

"vendor_msft_firewall_mdmstore_publicprofile_disableunicastresponsestomulticastbroadcast_true": "Unicast Responses Blocked",

}