Invoke-MDOP2-Incident-Response.ps1
|
#Requires -Version 7.4 <# .SYNOPSIS Finds phishing mail in a Microsoft 365 tenant and moves every copy to the Inbox, Archive, Junk, Deleted Items or Recoverable Items. .DESCRIPTION Signs the admin in, makes sure the tool's app registration and Mail.ReadWrite consent exist in the tenant, creates a short-lived client secret for this session only, and removes that secret again on exit. .PARAMETER TenantId Tenant ID or primary domain of the customer tenant. Leave empty to use the tenant of the account you sign in with. .PARAMETER AppDisplayName Display name of the tool's app registration in the tenant. .PARAMETER SecretLifetimeHours Lifetime of the just-in-time client secret. The secret is removed on exit; this is the fallback if removal can't run. .PARAMETER TestMailbox Console self-test: reads the newest message in this mailbox's Inbox with the app-only token. .PARAMETER TestSearch Console self-test: runs a message trace search and locates the newest matching message in every mailbox. Keys: Range (1d, 7d, 30d, 90d), Subject, SubjectFilterType, Sender, Recipient, Status, MessageId. Example: -TestSearch @{ Range = '7d'; Sender = 'contoso.com'; Subject = 'Invoice' } .PARAMETER TestAction Console self-test: finds one message by Message-ID, runs one or more actions on every copy and shows the status after each. Keys: MessageId (required), Action (MoveToInbox, MoveToArchive, MoveToJunk, MoveToDeletedItems, SoftDelete; one or more, run in order), Range, Execute. Dry run unless Execute = $true. Example: -TestAction @{ MessageId = '<abc@contoso.com>'; Action = 'MoveToJunk' } .PARAMETER NoBrowser Don't open the Microsoft Graph sign-in page and the web UI in the default browser; only print their links. The Exchange Online sign-in always opens in the default browser. .NOTES This script runs Invoke-MDOP2IncidentResponse from the MDOP2-IR module in this folder, for use from a clone of the repository. After Install-Module MDOP2-IR, run Invoke-MDOP2IncidentResponse directly. Without a Test parameter the tool starts the local web UI on 127.0.0.1 and runs until you end the session (Enter or Ctrl+C in the console, or End session in the UI). #> [CmdletBinding()] param( [ValidatePattern('^([0-9a-fA-F-]{36}|[A-Za-z0-9.-]+\.[A-Za-z]{2,})$')] [string]$TenantId, [ValidatePattern('^[A-Za-z0-9 ._-]{3,120}$')] [string]$AppDisplayName = 'Invoke-MDOP2-Incident-Response', [ValidateRange(1, 8)] [int]$SecretLifetimeHours = 2, [ValidatePattern('^[^\s@]+@[^\s@]+\.[^\s@]+$')] [string]$TestMailbox, [hashtable]$TestSearch, [hashtable]$TestAction, [switch]$NoBrowser ) $ErrorActionPreference = 'Stop' Import-Module (Join-Path $PSScriptRoot 'MDOP2-IR.psd1') -Force Invoke-MDOP2IncidentResponse @PSBoundParameters |