t0pcyber/hawkPowershell Based tool for gathering information related to O365 intrusions and potential Breaches
Visit hawkforensics.io for comprehensive documentation including:
Hawk is a free, open-source PowerShell module that streamlines the collection of forensic data from Microsoft cloud environments. Designed primarily for security professionals, incident responders, and administrators, Hawk automates the gathering of critical log data across Microsoft services, with a focus on Microsoft 365 (M365) and Microsoft Entra ID.
While Hawk includes basic analysis capabilities to flag potential items of interest (such as suspicious mail forwarding rules, over-privileged applications, or risky user activities), it is fundamentally a data collection tool rather than an automated threat detection system.
Hawk streamlines data collection compared to manually running individual queries through web interfaces, freeing up those resources for other administrative tasks. The tool's goal is to quickly get you the data needed to come to a conclusion; not to make the conclusion for you.
Install-Module -Name Hawk
Hawk offers two main investigation approaches:
Start-HawkTenantInvestigation to begin a tenant-wide investigationStart-HawkUserInvestigation -UserPrincipleName <[email protected]> to investigate specific usersHawk organizes investigation results into a structured directory hierarchy:
📂 [Investigation Root]
├── 📂 Tenant/
│ ├── AdminAuditLogConfig.csv
│ ├── OrgConfig.csv
│ ├── _Investigate_*.csv
│ └── [other tenant files]
├── 📂 [[email protected]]/
│ ├── Mailbox_Info.csv
│ ├── InboxRules.csv
│ ├── _Investigate_*.csv
│ └── [other user files]
└── 📂 [[email protected]]/
└── [similar structure]
Files prefixed with _Investigate_ contain potentially suspicious findings that warrant further review.
Everyone is welcome to contribute to Hawk. The goal is to maintain a community-led tool that provides security professionals with the resources they need.
For critical issues or inquiries, email [email protected].
Hawk, the open-source PowerShell module, collects limited usage data to help improve the module by identifying the most frequently used features. This data assists in prioritizing updates, enhancements, and new functionality.
✅ Collected Data:
❌ Not Collected:
The telemetry helps us understand which functions are used most frequently so we can:
The collected data is strictly used for internal development purposes to enhance the Hawk module. It is never shared, sold, or used for any form of tracking beyond feature usage.