PS C:\> Import-Module .\CanaryHunter.psd1

PS C:\> Invoke-DocxCheck -DocxPath gwfrr71nre84bk5gobf3h96ms.docx
Url Found:

http://canarytokens.com/feedback/traffic/gwfrr71nre84bk5gobf3h96ms/index.html

PS C:\> Invoke-XlsxCheck -XlsxPath  .\gwfrr71nre84bk5gobf3h96ms.xlsx
Url Found:

http://canarytokens.com/images/tags/articles/gwfrr71nre84bk5gobf3h96ms/contact.php

PS C:\> Invoke-PDFCheck -StreamDumperPath C:\PDFStreamDumper\PDFStreamDumper.exe -PDFPath .\gwfrr71nre84bk5gobf3h96ms.pdf
Url Found:

http://gwfrr71nre84bk5gobf3h96ms.canarytokens.net/RNGPLTCJSTEKJHOMLLYCQINNXOVOWCUVME

PS C:\> Invoke-RegistryCheck
Sensitive Command Canary Found For:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\net.exe


Monitor Process Canary Value Found:
cmd.exe /c start /min powershell.exe -windowstyle hidden -command "$($u=$(\"u$env:username\" 
-replace('[^\x00-\x7f]|\s', ''))[0..63] -join '';$c=$(\"c$env:computername\" -replace('[^\x00-\x7f]|\s', ''));
Resolve-DnsName -Name \"$c.UN.$u.CMD.gwfrr71nre84bk5gobf3h96ms.canarytokens.com\")"

PS C:\> Invoke-AWSCheck -AWSPath .\AWS.config
Possible Canary Config Found:

AWS.config:2:aws_access_key_id = AKIAYVP4CIPPJUYTRES

PS C:\> Invoke-WireguardCheck -WireGuardPath .\WireguardConfig
Possible Canary Config Found:

Endpoint = 52.18.63.80

PS C:\> Invoke-KubeCheck -KubeConfigPath .\KubeConfig
Possible Canary Config Found:

server: https://52.18.63.80:6443

PS C:\> Invoke-MySqlDumpCheck -MySQLDumpPath .\gwfrr71nre84bk5gobf3h96ms_mysql_dump.sql
Url Found:

MASTER_HOST='gwfrr71nre84bk5gobf3h96ms.canarytokens.com'

PS C:\> Invoke-BlockCanaries

DisplayName                   : Block All Known Canary IP Addresses
Enabled                       : True
Profile                       : Any
Direction                     : Outbound
Action                        : Block

Firewall Rule to Block Canary IP Addresses Succesffully Created