Microsoft 365 et Azure : Attaque, Détection et Défense 2026

# Audit des applications OAuth suspectes

# Lister toutes les applications avec leurs permissions
$apps = Get-MgApplication -All
$servicePrincipals = Get-MgServicePrincipal -All

foreach ($app in $apps) {
 $sp = $servicePrincipals | Where-Object {$_.AppId -eq $app.AppId}
 if ($sp) {
 $permissions = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id

 # Filtrer les permissions dangereuses
 $dangerousPerms = $permissions | Where-Object {
 $_.Scope -match "Mail.ReadWrite|Files.ReadWrite.All|Directory.AccessAsUser.All"
 }

 if ($dangerousPerms) {
 Write-Warning "Application suspecte: $($app.DisplayName)"
 Write-Output "Permissions: $($dangerousPerms.Scope)"
 }
 }
}

# Script de monitoring des métriques de sécurité

function Get-SecurityMetrics {
 param([int]$DaysBack = 7)

 $startDate = (Get-Date).AddDays(-$DaysBack)

 # Connexions suspectes
 $suspiciousSignIns = Get-MgAuditLogSignIn -Filter "createdDateTime ge $($startDate.ToString('yyyy-MM-ddTHH:mm:ssZ'))" `
 | Where-Object { $_.RiskLevel -ne "none" -or $_.RiskState -ne "none" }

 # Applications OAuth récemment approuvées
 $recentApps = Get-MgAuditLogDirectoryAudit -Filter "createdDateTime ge $($startDate.ToString('yyyy-MM-ddTHH:mm:ssZ'))" `
 | Where-Object { $_.Category -eq "ApplicationManagement" -and $_.Result -eq "success" }

 # Métriques de sécurité
 $metrics = @{
 SuspiciousSignIns = $suspiciousSignIns.Count
 NewApplications = $recentApps.Count
 UniqueUsersAtRisk = ($suspiciousSignIns | Select-Object -Unique UserPrincipalName).Count
 AverageRiskScore = ($suspiciousSignIns | Measure-Object -Property RiskLevelAggregated -Average).Average
 }

 return $metrics
}

function Detect-PasswordSpraying {
 [CmdletBinding()]
 param(
 [int]$TimeWindowHours = 1,
 [int]$FailedAttemptsThreshold = 5,
 [int]$UniqueUsersThreshold = 10
 )

 Write-Host "🔍 Détection d'attaques Password Spraying..." -ForegroundColor Cyan

 # Connexion à Microsoft Graph
 Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All"

 $startTime = (Get-Date).AddHours(-$TimeWindowHours)
 $endTime = Get-Date

 # Récupérer les tentatives de connexion échouées
 $failedSignIns = Get-MgAuditLogSignIn -Filter "createdDateTime ge $($startTime.ToString('yyyy-MM-ddTHH:mm:ssZ')) and status/errorCode ne 0" -All

 # Analyser par adresse IP source
 $ipAnalysis = $failedSignIns | Group-Object { $_.IpAddress } | ForEach-Object {
 $ipAddress = $_.Name
 $attempts = $_.Group
 $uniqueUsers = ($attempts | Select-Object -Unique UserPrincipalName).Count
 $totalAttempts = $attempts.Count
 $countries = ($attempts | Select-Object -Unique @{Name="Country"; Expression={$_.Location.CountryOrRegion}}).Country

 [PSCustomObject]@{
 IpAddress = $ipAddress
 TotalAttempts = $totalAttempts
 UniqueUsers = $uniqueUsers
 Countries = ($countries | Where-Object {$_ -ne $null}) -join ", "
 IsSuspicious = ($uniqueUsers -ge $UniqueUsersThreshold -and $totalAttempts -ge $FailedAttemptsThreshold)
 Users = ($attempts.UserPrincipalName | Select-Object -Unique) -join ", "
 }
 }

 # Filtrer les IPs suspectes
 $suspiciousIPs = $ipAnalysis | Where-Object { $_.IsSuspicious }

 if ($suspiciousIPs) {
 Write-Host "🚨 $(($suspiciousIPs).Count) adresses IP suspectes détectées!" -ForegroundColor Red

 foreach ($ip in $suspiciousIPs) {
 Write-Host "`n📍 IP: $($ip.IpAddress)" -ForegroundColor Yellow
 Write-Host " Tentatives: $($ip.TotalAttempts)" -ForegroundColor White
 Write-Host " Utilisateurs uniques: $($ip.UniqueUsers)" -ForegroundColor White
 Write-Host " Pays: $($ip.Countries)" -ForegroundColor White
 Write-Host " Utilisateurs ciblés: $($ip.Users)" -ForegroundColor Gray
 }

 # Génération de rapport détaillé
 $reportPath = "PasswordSprayingReport_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
 $suspiciousIPs | Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8
 Write-Host "`n📄 Rapport sauvegardé: $reportPath" -ForegroundColor Green

 # Recommandations automatiques
 Write-Host "`n💡 Recommandations:" -ForegroundColor Cyan
 Write-Host " 1. Bloquer les IPs suspectes dans Conditional Access" -ForegroundColor White
 Write-Host " 2. Forcer le reset MFA pour les utilisateurs ciblés" -ForegroundColor White
 Write-Host " 3. Activer le verrouillage intelligent Azure AD" -ForegroundColor White
 Write-Host " 4. Implémenter des politiques de mots de passe renforcées" -ForegroundColor White

 } else {
 Write-Host "✅ Aucune activité de Password Spraying détectée." -ForegroundColor Green
 }

 return $suspiciousIPs
}

function Audit-SuspiciousOAuthApps {
 [CmdletBinding()]
 param(
 [int]$DaysBack = 30,
 [switch]$ExportResults
 )

 Write-Host "🔐 Audit des applications OAuth suspectes..." -ForegroundColor Cyan

 # Connexion avec permissions étendues
 Connect-MgGraph -Scopes "Application.Read.All", "Directory.Read.All", "AuditLog.Read.All"

 # Permissions considérées comme dangereuses
 $dangerousPermissions = @(
 "Mail.ReadWrite", "Mail.ReadWrite.Shared", "Mail.Send",
 "Files.ReadWrite.All", "Sites.ReadWrite.All",
 "Directory.ReadWrite.All", "Directory.AccessAsUser.All",
 "User.ReadWrite.All", "Group.ReadWrite.All",
 "Application.ReadWrite.All", "AppRoleAssignment.ReadWrite.All"
 )

 # Récupérer toutes les applications
 Write-Host "📋 Récupération des applications..." -ForegroundColor Yellow
 $applications = Get-MgApplication -All
 $servicePrincipals = Get-MgServicePrincipal -All

 $suspiciousApps = @()

 foreach ($app in $applications) {
 $sp = $servicePrincipals | Where-Object { $_.AppId -eq $app.AppId }

 if ($sp) {
 # Analyser les permissions OAuth2
 $oauth2Permissions = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id -ErrorAction SilentlyContinue

 # Analyser les permissions d'application
 $appRoles = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -ErrorAction SilentlyContinue

 $suspicionLevel = 0
 $reasons = @()

 # Vérifier les permissions dangereuses
 foreach ($perm in $oauth2Permissions) {
 $scopes = $perm.Scope -split ' '
 foreach ($scope in $scopes) {
 if ($scope -in $dangerousPermissions) {
 $suspicionLevel += 2
 $reasons += "Permission dangereuse: $scope"
 }
 }
 }

 # Vérifier les caractéristiques suspectes
 if ([string]::IsNullOrEmpty($app.PublisherDomain) -or $app.PublisherDomain -eq "Unknown") {
 $suspicionLevel += 1
 $reasons += "Domaine éditeur inconnu"
 }

 if ([string]::IsNullOrEmpty($app.PrivacyStatementUrl)) {
 $suspicionLevel += 1
 $reasons += "Pas de politique de confidentialité"
 }

 if ($app.DisplayName -match "^(App|Application|Test|Demo)$") {
 $suspicionLevel += 1
 $reasons += "Nom générique suspect"
 }

 # Applications récemment créées avec beaucoup de permissions
 if ($app.CreatedDateTime -gt (Get-Date).AddDays(-$DaysBack) -and $oauth2Permissions.Count -gt 5) {
 $suspicionLevel += 2
 $reasons += "Application récente avec nombreuses permissions"
 }

 if ($suspicionLevel -ge 3) {
 $suspiciousApps += [PSCustomObject]@{
 DisplayName = $app.DisplayName
 AppId = $app.AppId
 PublisherDomain = $app.PublisherDomain
 CreatedDateTime = $app.CreatedDateTime
 SuspicionLevel = $suspicionLevel
 Reasons = $reasons -join "; "
 OAuth2Permissions = ($oauth2Permissions.Scope -join "; ")
 AppRoles = ($appRoles.AppRoleId -join "; ")
 Users = ($oauth2Permissions | ForEach-Object { Get-MgUser -UserId $_.PrincipalId -ErrorAction SilentlyContinue | Select-Object -ExpandProperty UserPrincipalName }) -join "; "
 }
 }
 }
 }

 # Affichage des résultats
 if ($suspiciousApps) {
 Write-Host "🚨 $($suspiciousApps.Count) applications suspectes détectées!" -ForegroundColor Red

 foreach ($app in ($suspiciousApps | Sort-Object SuspicionLevel -Descending)) {
 Write-Host "`n🔍 Application: $($app.DisplayName)" -ForegroundColor Yellow
 Write-Host " App ID: $($app.AppId)" -ForegroundColor White
 Write-Host " Niveau de suspicion: $($app.SuspicionLevel)/10" -ForegroundColor $(if($app.SuspicionLevel -ge 7){"Red"}elseif($app.SuspicionLevel -ge 5){"Yellow"}else{"White"})
 Write-Host " Raisons: $($app.Reasons)" -ForegroundColor Gray
 Write-Host " Créée le: $($app.CreatedDateTime)" -ForegroundColor Gray
 Write-Host " Permissions: $($app.OAuth2Permissions)" -ForegroundColor Gray
 }

 if ($ExportResults) {
 $reportPath = "SuspiciousOAuthApps_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
 $suspiciousApps | Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8
 Write-Host "`n📄 Rapport exporté: $reportPath" -ForegroundColor Green
 }

 # Recommandations
 Write-Host "`n💡 Actions recommandées:" -ForegroundColor Cyan
 Write-Host " 1. Révoquer l'accès des applications hautement suspectes" -ForegroundColor White
 Write-Host " 2. Implémenter une politique de consentement administrateur" -ForegroundColor White
 Write-Host " 3. Auditer régulièrement les permissions OAuth" -ForegroundColor White
 Write-Host " 4. Former les utilisateurs sur les risques du consentement" -ForegroundColor White

 } else {
 Write-Host "✅ Aucune application OAuth suspecte détectée." -ForegroundColor Green
 }

 return $suspiciousApps
}

function Monitor-PrivilegedIdentities {
 [CmdletBinding()]
 param(
 [int]$MonitoringPeriodHours = 24,
 [switch]$AlertOnAnomalies
 )

 Write-Host "👑 Monitoring des identités privilégiées..." -ForegroundColor Cyan

 Connect-MgGraph -Scopes "Directory.Read.All", "AuditLog.Read.All", "RoleManagement.Read.All"

 # Rôles privilégiés à surveiller
 $privilegedRoles = @(
 "Global Administrator",
 "Privileged Role Administrator",
 "User Administrator",
 "Exchange Administrator",
 "SharePoint Administrator",
 "Security Administrator",
 "Conditional Access Administrator"
 )

 $startTime = (Get-Date).AddHours(-$MonitoringPeriodHours)

 # Récupérer les rôles et leurs membres
 $roleMembers = @()
 foreach ($roleName in $privilegedRoles) {
 $role = Get-MgDirectoryRole -Filter "displayName eq '$roleName'"
 if ($role) {
 $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
 foreach ($member in $members) {
 $user = Get-MgUser -UserId $member.Id -ErrorAction SilentlyContinue
 if ($user) {
 $roleMembers += [PSCustomObject]@{
 RoleName = $roleName
 UserPrincipalName = $user.UserPrincipalName
 DisplayName = $user.DisplayName
 UserId = $user.Id
 AccountEnabled = $user.AccountEnabled
 LastSignIn = $user.SignInActivity.LastSignInDateTime
 }
 }
 }
 }
 }

 Write-Host "📊 $($roleMembers.Count) identités privilégiées trouvées" -ForegroundColor Yellow

 # Analyser l'activité de connexion récente
 $privilegedActivity = @()
 foreach ($member in $roleMembers) {
 $signIns = Get-MgAuditLogSignIn -Filter "userId eq '$($member.UserId)' and createdDateTime ge $($startTime.ToString('yyyy-MM-ddTHH:mm:ssZ'))" -All

 # Analyser les anomalies
 $anomalies = @()
 $locations = $signIns | Select-Object -Unique @{Name="Country"; Expression={$_.Location.CountryOrRegion}}
 $ipAddresses = $signIns | Select-Object -Unique IpAddress

 # Détection de voyage impossible
 if ($locations.Count -gt 2) {
 $anomalies += "Connexions depuis $($locations.Count) pays différents"
 }

 # Détection d'IPs multiples
 if ($ipAddresses.Count -gt 5) {
 $anomalies += "Connexions depuis $($ipAddresses.Count) adresses IP différentes"
 }

 # Connexions en dehors des heures de bureau
 $afterHours = $signIns | Where-Object {
 $hour = (Get-Date $_.CreatedDateTime).Hour
 $hour -lt 8 -or $hour -gt 18
 }

 if ($afterHours.Count -gt 0) {
 $anomalies += "$($afterHours.Count) connexions en dehors des heures de bureau"
 }

 # Connexions échouées récentes
 $failedSignIns = $signIns | Where-Object { $_.Status.ErrorCode -ne 0 }

 $privilegedActivity += [PSCustomObject]@{
 UserPrincipalName = $member.UserPrincipalName
 RoleName = $member.RoleName
 TotalSignIns = $signIns.Count
 FailedSignIns = $failedSignIns.Count
 UniqueCountries = $locations.Count
 UniqueIPs = $ipAddresses.Count
 AfterHoursSignIns = $afterHours.Count
 Anomalies = if($anomalies) { $anomalies -join "; " } else { "Aucune" }
 IsAnomalous = $anomalies.Count -gt 0
 LastSignIn = if($signIns) { ($signIns | Sort-Object CreatedDateTime -Descending | Select-Object -First 1).CreatedDateTime } else { "Aucune connexion récente" }
 }
 }

 # Afficher les résultats
 $anomalousUsers = $privilegedActivity | Where-Object { $_.IsAnomalous }

 if ($anomalousUsers) {
 Write-Host "🚨 $($anomalousUsers.Count) identités privilégiées avec comportement anormal!" -ForegroundColor Red

 foreach ($user in $anomalousUsers) {
 Write-Host "`n⚠️ Utilisateur: $($user.UserPrincipalName)" -ForegroundColor Yellow
 Write-Host " Rôle: $($user.RoleName)" -ForegroundColor White
 Write-Host " Connexions: $($user.TotalSignIns) (dont $($user.FailedSignIns) échouées)" -ForegroundColor White
 Write-Host " Anomalies: $($user.Anomalies)" -ForegroundColor Red
 Write-Host " Dernière connexion: $($user.LastSignIn)" -ForegroundColor Gray
 }

 if ($AlertOnAnomalies) {
 Write-Host "`n🚨 Génération d'alertes pour les comportements anormaux..." -ForegroundColor Red
 # Ici, vous pourriez intégrer l'envoi d'alertes par email, Teams, ou webhook
 }

 } else {
 Write-Host "✅ Aucun comportement anormal détecté pour les identités privilégiées." -ForegroundColor Green
 }

 # Rapport complet
 $reportPath = "PrivilegedIdentitiesReport_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
 $privilegedActivity | Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8
 Write-Host "`n📄 Rapport complet sauvegardé: $reportPath" -ForegroundColor Green

 return $privilegedActivity
}