Microsoft 365: Angreifer umgehen MFA mit gestohlenen Anmelde-Token — so prüfen und schützen Sie Ihr Unternehmen

$module = @(
  'Microsoft.Graph.Authentication'
  'Microsoft.Graph.Users'
  'Microsoft.Graph.Users.Actions'
  'Microsoft.Graph.Identity.DirectoryManagement'
  'Microsoft.Graph.Identity.SignIns'
  'Microsoft.Graph.Reports'
  'Microsoft.Graph.Applications'
  'Microsoft.Graph.Beta.Reports'
  'ExchangeOnlineManagement'
)
foreach ($m in $module) {
  if (-not (Get-Module -ListAvailable -Name $m)) {
    Install-Module -Name $m -Scope CurrentUser -Repository PSGallery -Force
  }
}
Get-InstalledModule -Name 'Microsoft.Graph.*' | Format-Table Name, Version -AutoSize

Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.DirectoryManagement
Connect-MgGraph -Scopes 'Device.Read.All' -NoWelcome

Get-MgDevice -All -Property Id,DisplayName,RegistrationDateTime,TrustType,OperatingSystem |
  Where-Object { $_.DisplayName -cmatch '^DESKTOP-[0-9A-F]{8}$' } |
  Sort-Object RegistrationDateTime |
  ForEach-Object {
    $owner = Get-MgDeviceRegisteredOwner -DeviceId $_.Id | Select-Object -First 1
    [pscustomobject]@{
      Geraet     = $_.DisplayName
      Registriert = $_.RegistrationDateTime
      Typ        = $_.TrustType
      Besitzer   = $owner.AdditionalProperties['userPrincipalName']
    }
  } | Format-Table -AutoSize

Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.DirectoryManagement
Connect-MgGraph -Scopes 'Device.Read.All' -NoWelcome

$seit = (Get-Date).AddDays(-120)
Get-MgDevice -All -Property DisplayName,RegistrationDateTime,TrustType,OperatingSystem |
  Where-Object { $_.RegistrationDateTime -ge $seit } |
  Sort-Object RegistrationDateTime |
  Format-Table DisplayName, RegistrationDateTime, TrustType, OperatingSystem -AutoSize

Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Users, Microsoft.Graph.Identity.SignIns
Connect-MgGraph -Scopes 'User.Read.All','UserAuthenticationMethod.Read.All' -NoWelcome

Get-MgUser -All -Filter 'accountEnabled eq true' -Property Id,UserPrincipalName |
  ForEach-Object {
    $upn = $_.UserPrincipalName
    Get-MgUserAuthenticationMethodMicrosoftAuthenticator -UserId $_.Id |
      Select-Object @{n='Benutzer';e={$upn}}, DisplayName, CreatedDateTime
  } |
  Sort-Object CreatedDateTime -Descending |
  Format-Table -AutoSize

Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Reports
Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome

$seit = (Get-Date).ToUniversalTime().AddDays(-30).ToString('yyyy-MM-ddTHH:mm:ssZ')
$filter = "activityDateTime ge $seit and (activityDisplayName eq 'User deleted security info' or activityDisplayName eq 'Admin deleted security info' or activityDisplayName eq 'User registered security info')"
$events = Get-MgAuditLogDirectoryAudit -All -Filter $filter

$events | Group-Object { $_.TargetResources[0].UserPrincipalName } | ForEach-Object {
  $benutzer = $_.Name
  $geloescht = $_.Group | Where-Object ActivityDisplayName -like '*deleted security info'
  $neu = $_.Group | Where-Object ActivityDisplayName -eq 'User registered security info'
  foreach ($d in $geloescht) {
    foreach ($r in $neu) {
      $minuten = ($r.ActivityDateTime - $d.ActivityDateTime).TotalMinutes
      if ($minuten -ge 0 -and $minuten -le 180) {
        [pscustomobject]@{
          Benutzer  = $benutzer
          Geloescht = $d.ActivityDateTime
          Neu       = $r.ActivityDateTime
          Minuten   = [int]$minuten
          IP        = $r.InitiatedBy.User.IPAddress
        }
      }
    }
  }
} | Format-Table -AutoSize

Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Beta.Reports
Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome

$seit = (Get-Date).ToUniversalTime().AddDays(-30).ToString('yyyy-MM-ddTHH:mm:ssZ')
$adressen = '193.26.115.', '124.198.132.33', '45.83.31.44', '192.159.99.172', '185.238.2.195', '167.148.41.96'

foreach ($a in $adressen) {
  $filter = "createdDateTime ge $seit and startsWith(ipAddress,'$a') and signInEventTypes/any(t: t eq 'interactiveUser' or t eq 'nonInteractiveUser')"
  Get-MgBetaAuditLogSignIn -All -Filter $filter |
    Select-Object CreatedDateTime, UserPrincipalName, IPAddress, AppDisplayName, ResourceDisplayName, UserAgent,
      @{n='Fehlercode';e={$_.Status.ErrorCode}}
} | Sort-Object CreatedDateTime | Format-Table -AutoSize

Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Beta.Reports
Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome

$seit = (Get-Date).ToUniversalTime().AddDays(-7).ToString('yyyy-MM-ddTHH:mm:ssZ')
$filter = "createdDateTime ge $seit and signInEventTypes/any(t: t eq 'interactiveUser' or t eq 'nonInteractiveUser')"
$anmeldungen = Get-MgBetaAuditLogSignIn -All -Filter $filter
$spalten = 'CreatedDateTime', 'UserPrincipalName', 'IPAddress', 'AppDisplayName', 'UserAgent'

# 1. Skript-Werkzeug: User-Agent 'node' oder nur 'Mozilla/5.0'
$anmeldungen | Where-Object { $_.UserAgent -in 'node', 'Mozilla/5.0' } | Format-Table $spalten -AutoSize

# 2. Gerätecode-Anmeldungen
$anmeldungen | Where-Object { $_.AuthenticationProtocol -eq 'deviceCode' -or $_.OriginalTransferMethod -eq 'deviceCodeFlow' } | Format-Table $spalten -AutoSize

# 3. Richtig angemeldet, aber vom bedingten Zugriff blockiert
$anmeldungen | Where-Object { $_.Status.ErrorCode -eq 53003 } | Format-Table $spalten -AutoSize

Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -ShowBanner:$false

$ordner = 'RSS|Unterhaltungsverlauf|Conversation History'
Get-EXOMailbox -ResultSize Unlimited | ForEach-Object {
  Get-InboxRule -Mailbox $_.UserPrincipalName -IncludeHidden
} | Where-Object {
  $_.Name.Trim().Length -le 3 -or
  $_.Name -notmatch '[a-zA-Z0-9]' -or
  $_.MoveToFolder -match $ordner -or
  $_.DeleteMessage -or
  $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo
} | Select-Object MailboxOwnerId, Name, Enabled, MoveToFolder, DeleteMessage, MarkAsRead,
    ForwardTo, RedirectTo, SubjectOrBodyContainsWords

Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -ShowBanner:$false

Get-EXOMailbox -ResultSize Unlimited -Properties ForwardingSmtpAddress,ForwardingAddress,DeliverToMailboxAndForward |
  Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
  Format-Table UserPrincipalName, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward -AutoSize

Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -ShowBanner:$false

$operationen = 'New-InboxRule', 'Set-InboxRule', 'UpdateInboxRules'
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-120) -EndDate (Get-Date) -Operations $operationen -ResultSize 5000 |
  ForEach-Object {
    $d = $_.AuditData | ConvertFrom-Json
    [pscustomobject]@{
      Zeit     = $_.CreationDate
      Benutzer = $_.UserIds
      Aktion   = $_.Operations
      IP       = if ($d.ClientIP) { $d.ClientIP } else { $d.ClientIPAddress }
    }
  } | Sort-Object Zeit | Format-Table -AutoSize

Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Applications, Microsoft.Graph.Users
Connect-MgGraph -Scopes 'Directory.Read.All' -NoWelcome

Get-MgOauth2PermissionGrant -All | Where-Object ConsentType -eq 'Principal' | ForEach-Object {
  $app = Get-MgServicePrincipal -ServicePrincipalId $_.ClientId
  $user = Get-MgUser -UserId $_.PrincipalId -Property UserPrincipalName
  [pscustomobject]@{
    App         = $app.DisplayName
    Herausgeber = $app.PublisherName
    Benutzer    = $user.UserPrincipalName
    Rechte      = $_.Scope
  }
} | Format-Table -AutoSize -Wrap

Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns
Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome

"Sicherheitsstandards aktiv: " + (Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy).IsEnabled

Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName, State,
    @{n='Authentifizierungsfluss';e={$_.Conditions.AuthenticationFlows.TransferMethods}},
    @{n='Gewaehrung';e={$_.GrantControls.BuiltInControls -join ', '}} |
  Format-Table -AutoSize

Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Users, Microsoft.Graph.Users.Actions
Connect-MgGraph -Scopes 'User.ReadWrite.All','User.RevokeSessions.All' -NoWelcome

$upn = 'name@firma.de'
Update-MgUser -UserId $upn -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $upn

Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns
Connect-MgGraph -Scopes 'UserAuthenticationMethod.ReadWrite.All' -NoWelcome

$upn = 'name@firma.de'
Get-MgUserAuthenticationMethodMicrosoftAuthenticator -UserId $upn |
  Format-Table Id, DisplayName, CreatedDateTime -AutoSize

Remove-MgUserAuthenticationMethodMicrosoftAuthenticator -UserId $upn -MicrosoftAuthenticatorAuthenticationMethodId '<Id>'

Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.DirectoryManagement
Connect-MgGraph -Scopes 'Directory.AccessAsUser.All' -NoWelcome

Update-MgDevice -DeviceId '<Objekt-ID>' -AccountEnabled:$false

Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -ShowBanner:$false

$upn = 'name@firma.de'
Get-InboxRule -Mailbox $upn -IncludeHidden | Format-Table Name, Identity, MoveToFolder, DeleteMessage -AutoSize
Remove-InboxRule -Mailbox $upn -Identity '<Identity>' -Confirm:$false

Set-Mailbox -Identity $upn -ForwardingSmtpAddress $null -ForwardingAddress $null