jexp

mgraeber-rc

filter Get-AppPackageTriageInfo {
<#
.SYNOPSIS

A tool to perform rapid triage of decompressed application packages (.msix and .appx files).

.DESCRIPTION

Get-AppPackageTriageInfo parses key information from an uncompressed application package (.msix and .appx) without needing to first install it.

brokensound77

Detecting RMM

ℹ️ This was duplicated to this blog for readability and reference

---

The most difficult challenge with RMM detection is contextual awareness around usage to determine if it is valid or malicious.

AsishP

 $data = Search-UnifiedAuditLog 
         -StartDate $startInterval 
         -EndDate $endInterval 
         -Operations FileAccessed, FilePreviewed, PageViewed, PageViewedExtended, SearchViewed, CompanyLinkUsed, SecureLinkUsed, FileDownloaded, FileModified, FileUploaded, FileDeleted, FolderModified, CompanyLinkCreated, SharingInheritanceBroken, ListUpdated, FileSyncDownloadedFull, FileSyncUploadedFull  
         -SessionId $sessionId 
         -SessionCommand ReturnLargeSet 
         -ResultSize 5000
 ## Start Date - Date and Time in local Computer Date Time format
 ## End Date - Date and Time in local Computer Date Time format
 ## Operations - For more information see here - https://docs.microsoft.com/en-gb/office365/securitycompliance/search-the-audit-log-in-security-and-compliance#sharing-and-access-request-activities