目录

• 关于
• 快速开始
  • 前置条件
  • 要求
  • 安装
• 使用方法
  • 配置
  • 图形界面
  • 认证
  • Csv
  • Honk
  • Messagetrace
  • 推荐的默认工作流程
  • 带时间范围的 UAL 调用推荐工作流程
  • 注意事项
• 已知问题
• 致谢
• 贡献
• 许可证
• 法律免责声明

关于

Untitled Goose Tool 是一款强大且灵活的狩猎与事件响应工具，它引入了新颖的认证和数据收集方法，以便对客户的 Microsoft Entra ID、Azure 和 M365 环境进行全面调查。Untitled Goose Tool 还会从 Microsoft Defender for Endpoint (MDE) 和 Defender for Internet of Things (IoT) (D4IoT) 收集额外的遥测数据。

该工具旨在帮助事件响应团队，在事件发生后为那些未将日志导入安全信息和事件管理 (SIEM) 系统或其他日志长期存储解决方案的环境导出云工件。

有关如何使用 Untitled Goose Tool 的更多指导，请参阅：Untitled Goose Tool 情况说明书

快速开始

前置条件

使用 Python 运行 Untitled Goose Tool 需要 Python >= 3.9。强烈推荐使用 Python 3.12，因为它能带来更好的日志记录。

在 Windows 机器上，运行该工具之前，你需要确保已安装 Microsoft Visual C++ 可再发行组件包 (14.x)。

还建议在虚拟环境中运行 Untitled Goose Tool。

Mac OSX

pip3 install virtualenv
virtualenv -p python3 .venv
source .venv/bin/activate

Linux

# You may need to run sudo apt-get install python3-venv first
python3 -m venv .venv
source .venv/bin/activate

Windows

# You can also use py -3 -m venv .venv
python -m venv .venv
.venv\Scripts\activate

要求

运行 Untitled Goose Tool 需要以下 EntraID/M365 权限，并为其提供对租户的只读访问权限。

请注意：用户账户应为仅限云端的账户（未同步到本地环境），这将确保该工具的登录过程在不同环境中保持一致。

一个仅限云端的用户账户及关联的 EXO 服务主体，需具备以下权限：

Exchange Online 管理中心

- View-Only Audit Logs
- View-Only Configuration
- View-Only Recipients
- User Options

具有以下权限的服务主体：

API 权限

Log Analytics API
- Data.Read (Application)

Microsoft Threat Protection:
- AdvancedHunting.Read.All (Application)

WindowsDefenderATP:
- AdvancedQuery.Read.All (Application)
- Alert.Read.All (Application)
- Library.Manage (Application)
- Machine.Read.All (Application)
- SecurityRecommendation.Read.All (Application)
- Software.Read.All (Application)
- Ti.ReadWrite (Application)
- Vulnerability.Read.All (Application)

Microsoft Graph:
- APIConnectors.Read.All (Application)
- AuditLog.Read.All (Application)
- ConsentRequest.Read.All (Application)
- Directory.Read.All (Application)
- Domain.Read.All (Application)
- IdentityProvider.Read.All (Application)
- IdentityRiskEvent.Read.All (Application)
- IdentityRiskyServicePrincipal.Read.All (Application)
- IdentityRiskyUser.Read.All (Application)
- MailboxSettings.Read (Application)
- Policy.Read.All (Application)
- Policy.Read.PermissionGrant (Application)
- Reports.Read.All (Application)
- RoleManagement.Read.All (Application)
- SecurityActions.Read.All (Application)
- SecurityAlert.Read.All (Application)
- SecurityEvents.Read.All (Application)
- UserAuthenticationMethod.Read.All (Application)

Office 365 Exchange Online
- Exchange.ManageAsApp (Application)

Azure 订阅 IAM 角色

- Reader
- Storage Blob Data Reader
- Storage Queue Data Reader

确保为服务主体启用“允许公共客户端流”。

我们有一个设置 PowerShell 脚本，用于设置具有所需权限的服务主体。此外，Azure 服务主体与 m365 的关联目前只能通过 PowerShell 完成，并且是某些 m365 日志收集所必需的。

以下是运行该脚本的示例，它将输出你需要运行的 goosey conf 命令，以便使用正确的信息构建配置文件

PS > Write-Host "Creating a new Goose Application and Users"
PS > ./Create_SP.ps1 -AppName GooseApp -Create

此外，当你使用完毕后，该脚本还可以删除该应用程序

PS > Write-Host "Creating a new Goose Application and Users"
PS > ./Create_SP.ps1 -AppName GooseApp -Delete

安装

要安装，请克隆仓库，然后执行 pip install：

常规安装

git clone https://github.com/cisagov/untitledgoosetool.git
cd untitledgoosetool
python3 -m pip install .

Docker

docker build . -t goosey
docker run -it -v $PWD:/workdir goosey goosey honk --debug

使用方法

配置

Untitled Goose Tool 需要身份验证参数和配置。要自动构建配置文件，请在安装后运行以下命令。

$ goosey conf

当运行 PowerShell 安装脚本以创建/设置服务主体时，将生成此命令的一个版本。以下是一个使用虚假参数值的示例

$ goosey conf --config_tenant=5fd146ad-8b31-4afa-a72f-6f71df5c7173 --config_subscriptionid=all --auth_appid=24fd6377-79e0-445d-838b-3eaa60d3ca21

之后，.auth、.conf、.auth_d4iot 和 .d4iot_conf 文件应放置在你的当前目录中。这些文件由 Untitled Goose Tool 使用。除非是使用上述参数生成的，否则你应填写顶部的 [auth] 部分，以便 Untitled Goose Tool 能够正确地对相应资源进行身份验证。但是，如果你对将凭据写入文件感到不放心，可以选择删除 .auth 和/或 .auth_d4iot，转而由工具通过控制台提示你输入凭据。

最简身份验证配置如下所示：

[auth]
# The username of your account. ex: [email protected]
username=
# The password of your account. ex: AAD_password
password=
# The application ID of your service principal
appid=
# The client secret value of your service principal (not the secret ID)
clientsecret=

极简配置如下所示：

[config]
# The tenant ID of your AAD tenant
tenant=
# If you have a GCC High tenant
us_government=False
# If you have a GCC tenant with MDE
mde_gcc=False
# If you have a GCC High tenant with MDE
mde_gcc_high=False
# If your M365 tenant is a government tenant
exo_us_government=False
# If you want to check all of your Azure subscriptions, set this to All, otherwise enter your Azure subscription ID. For multiple IDs, separate it with commas, no spaces
subscriptionid=All

[filters]
# Format should be YYYY-MM-DD. If not set will default to the earliest date for log retention
date_start=
# Format should be YYYY-MM-DD. Will default to the present day
date_end=

[variables]
# Threshold used for ual API requests. Specifies the maximum results pulled per session. Can be between 100 - 50000. The api is optimized to return results faster the larger the threshold, but the whole session has to be repeated if an error occurs as the results are not returned sorted. We recommend 5000 as the threshold, but this can be toggled with
ual_threshold=5000
# Maximum number of ual coroutines/tasks to have running asynchronously. Minimum value is 1.
max_ual_tasks=5
# Start date for an extra time frame for ual to search. Reason for this is because ual takes the longest to pull and while you don't want the oldest data to roll off, you may want to look at another timeframe and do not want to wait for ual to get there and pull the logs. Format should be YYY-MM-DD
ual_extra_start=
# End date for an extra time frame for ual to search. Reason for this is because ual takes the longest to pull and while you don't want the oldest data to roll off, you may want to look at another timeframe and do not want to wait for ual to get there and pull the logs. Format should be YYY-MM-DD
ual_extra_end=
# Threshold for how many logs to pull per query. Usually want to try to max this out as KQL queries are rate limited.
mde_threshold=10000

### Unified Audit Log Filters

You can fine-tune which Unified Audit Log (UAL) records are saved by setting UAL filter variables in the `[variables]` section of your `.conf` file. Use the `ual_`-prefixed variables below:

Note: The Operation, UserId, and ClientIP filters cannot be run together. You must start a separate UAL pull for each filter, and you may need to clear the bounds and state files when running duplicate timeframes.

- `ual_operations`: comma-separated list of UAL operation names to request from the `Search-UnifiedAuditLog` API (e.g. `Send On Behalf,FileDeleted,Create`). Do not wrap entries in quotes; internal spaces are preserved.
- `ual_userids`: comma-separated list of user IDs to include in saved results (e.g. `[email protected],[email protected]`).
- `ual_clientip`: comma-separated list of client IP addresses to include in saved results (e.g. `203.0.113.45,10.1.2.3`).