Détecter les Attaques
par Compromission d'Identités

# Audit des applications OAuth suspectes

# Lister toutes les applications avec leurs permissions
$apps = Get-MgApplication -All
$servicePrincipals = Get-MgServicePrincipal -All

foreach ($app in $apps) {
    $sp = $servicePrincipals | Where-Object {$_.AppId -eq $app.AppId}
    if ($sp) {
        $permissions = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id

        # Filtrer les permissions dangereuses
        $dangerousPerms = $permissions | Where-Object {
            $_.Scope -match "Mail.ReadWrite|Files.ReadWrite.All|Directory.AccessAsUser.All"
        }

        if ($dangerousPerms) {
            Write-Warning "Application suspecte: $($app.DisplayName)"
            Write-Output "Permissions: $($dangerousPerms.Scope)"
        }
    }
}

# Script de monitoring des métriques de sécurité

function Get-SecurityMetrics {
    param([int]$DaysBack = 7)

    $startDate = (Get-Date).AddDays(-$DaysBack)

    # Connexions suspectes
    $suspiciousSignIns = Get-MgAuditLogSignIn -Filter "createdDateTime ge $($startDate.ToString('yyyy-MM-ddTHH:mm:ssZ'))" `
        | Where-Object { $_.RiskLevel -ne "none" -or $_.RiskState -ne "none" }

    # Applications OAuth récemment approuvées
    $recentApps = Get-MgAuditLogDirectoryAudit -Filter "createdDateTime ge $($startDate.ToString('yyyy-MM-ddTHH:mm:ssZ'))" `
        | Where-Object { $_.Category -eq "ApplicationManagement" -and $_.Result -eq "success" }

    # Métriques de sécurité
    $metrics = @{
        SuspiciousSignIns = $suspiciousSignIns.Count
        NewApplications = $recentApps.Count
        UniqueUsersAtRisk = ($suspiciousSignIns | Select-Object -Unique UserPrincipalName).Count
        AverageRiskScore = ($suspiciousSignIns | Measure-Object -Property RiskLevelAggregated -Average).Average
    }

    return $metrics
}

function Detect-PasswordSpraying {
    [CmdletBinding()]
    param(
        [int]$TimeWindowHours = 1,
        [int]$FailedAttemptsThreshold = 5,
        [int]$UniqueUsersThreshold = 10
    )

    Write-Host "🔍 Détection d'attaques Password Spraying..." -ForegroundColor Cyan

    # Connexion à Microsoft Graph
    Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All"

    $startTime = (Get-Date).AddHours(-$TimeWindowHours)
    $endTime = Get-Date

    # Récupérer les tentatives de connexion échouées
    $failedSignIns = Get-MgAuditLogSignIn -Filter "createdDateTime ge $($startTime.ToString('yyyy-MM-ddTHH:mm:ssZ')) and status/errorCode ne 0" -All

    # Analyser par adresse IP source
    $ipAnalysis = $failedSignIns | Group-Object { $_.IpAddress } | ForEach-Object {
        $ipAddress = $_.Name
        $attempts = $_.Group
        $uniqueUsers = ($attempts | Select-Object -Unique UserPrincipalName).Count
        $totalAttempts = $attempts.Count
        $countries = ($attempts | Select-Object -Unique @{Name="Country"; Expression={$_.Location.CountryOrRegion}}).Country

        [PSCustomObject]@{
            IpAddress = $ipAddress
            TotalAttempts = $totalAttempts
            UniqueUsers = $uniqueUsers
            Countries = ($countries | Where-Object {$_ -ne $null}) -join ", "
            IsSuspicious = ($uniqueUsers -ge $UniqueUsersThreshold -and $totalAttempts -ge $FailedAttemptsThreshold)
            Users = ($attempts.UserPrincipalName | Select-Object -Unique) -join ", "
        }
    }

    # Filtrer les IPs suspectes
    $suspiciousIPs = $ipAnalysis | Where-Object { $_.IsSuspicious }

    if ($suspiciousIPs) {
        Write-Host "🚨 $(($suspiciousIPs).Count) adresses IP suspectes détectées!" -ForegroundColor Red

        foreach ($ip in $suspiciousIPs) {
            Write-Host "`n📍 IP: $($ip.IpAddress)" -ForegroundColor Yellow
            Write-Host "   Tentatives: $($ip.TotalAttempts)" -ForegroundColor White
            Write-Host "   Utilisateurs uniques: $($ip.UniqueUsers)" -ForegroundColor White
            Write-Host "   Pays: $($ip.Countries)" -ForegroundColor White
            Write-Host "   Utilisateurs ciblés: $($ip.Users)" -ForegroundColor Gray
        }

        # Génération de rapport détaillé
        $reportPath = "PasswordSprayingReport_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
        $suspiciousIPs | Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8
        Write-Host "`n📄 Rapport sauvegardé: $reportPath" -ForegroundColor Green

        # Recommandations automatiques
        Write-Host "`n💡 Recommandations:" -ForegroundColor Cyan
        Write-Host "   1. Bloquer les IPs suspectes dans Conditional Access" -ForegroundColor White
        Write-Host "   2. Forcer le reset MFA pour les utilisateurs ciblés" -ForegroundColor White
        Write-Host "   3. Activer le verrouillage intelligent Azure AD" -ForegroundColor White
        Write-Host "   4. Implémenter des politiques de mots de passe renforcées" -ForegroundColor White

    } else {
        Write-Host "✅ Aucune activité de Password Spraying détectée." -ForegroundColor Green
    }

    return $suspiciousIPs
}

function Audit-SuspiciousOAuthApps {
    [CmdletBinding()]
    param(
        [int]$DaysBack = 30,
        [switch]$ExportResults
    )

    Write-Host "🔐 Audit des applications OAuth suspectes..." -ForegroundColor Cyan

    # Connexion avec permissions étendues
    Connect-MgGraph -Scopes "Application.Read.All", "Directory.Read.All", "AuditLog.Read.All"

    # Permissions considérées comme dangereuses
    $dangerousPermissions = @(
        "Mail.ReadWrite", "Mail.ReadWrite.Shared", "Mail.Send",
        "Files.ReadWrite.All", "Sites.ReadWrite.All",
        "Directory.ReadWrite.All", "Directory.AccessAsUser.All",
        "User.ReadWrite.All", "Group.ReadWrite.All",
        "Application.ReadWrite.All", "AppRoleAssignment.ReadWrite.All"
    )

    # Récupérer toutes les applications
    Write-Host "📋 Récupération des applications..." -ForegroundColor Yellow
    $applications = Get-MgApplication -All
    $servicePrincipals = Get-MgServicePrincipal -All

    $suspiciousApps = @()

    foreach ($app in $applications) {
        $sp = $servicePrincipals | Where-Object { $_.AppId -eq $app.AppId }

        if ($sp) {
            # Analyser les permissions OAuth2
            $oauth2Permissions = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id -ErrorAction SilentlyContinue

            # Analyser les permissions d'application
            $appRoles = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -ErrorAction SilentlyContinue

            $suspicionLevel = 0
            $reasons = @()

            # Vérifier les permissions dangereuses
            foreach ($perm in $oauth2Permissions) {
                $scopes = $perm.Scope -split ' '
                foreach ($scope in $scopes) {
                    if ($scope -in $dangerousPermissions) {
                        $suspicionLevel += 2
                        $reasons += "Permission dangereuse: $scope"
                    }
                }
            }

            # Vérifier les caractéristiques suspectes
            if ([string]::IsNullOrEmpty($app.PublisherDomain) -or $app.PublisherDomain -eq "Unknown") {
                $suspicionLevel += 1
                $reasons += "Domaine éditeur inconnu"
            }

            if ([string]::IsNullOrEmpty($app.PrivacyStatementUrl)) {
                $suspicionLevel += 1
                $reasons += "Pas de politique de confidentialité"
            }

            if ($app.DisplayName -match "^(App|Application|Test|Demo)$") {
                $suspicionLevel += 1
                $reasons += "Nom générique suspect"
            }

            # Applications récemment créées avec beaucoup de permissions
            if ($app.CreatedDateTime -gt (Get-Date).AddDays(-$DaysBack) -and $oauth2Permissions.Count -gt 5) {
                $suspicionLevel += 2
                $reasons += "Application récente avec nombreuses permissions"
            }

            if ($suspicionLevel -ge 3) {
                $suspiciousApps += [PSCustomObject]@{
                    DisplayName = $app.DisplayName
                    AppId = $app.AppId
                    PublisherDomain = $app.PublisherDomain
                    CreatedDateTime = $app.CreatedDateTime
                    SuspicionLevel = $suspicionLevel
                    Reasons = $reasons -join "; "
                    OAuth2Permissions = ($oauth2Permissions.Scope -join "; ")
                    AppRoles = ($appRoles.AppRoleId -join "; ")
                    Users = ($oauth2Permissions | ForEach-Object { Get-MgUser -UserId $_.PrincipalId -ErrorAction SilentlyContinue | Select-Object -ExpandProperty UserPrincipalName }) -join "; "
                }
            }
        }
    }

    # Affichage des résultats
    if ($suspiciousApps) {
        Write-Host "🚨 $($suspiciousApps.Count) applications suspectes détectées!" -ForegroundColor Red

        foreach ($app in ($suspiciousApps | Sort-Object SuspicionLevel -Descending)) {
            Write-Host "`n🔍 Application: $($app.DisplayName)" -ForegroundColor Yellow
            Write-Host "   App ID: $($app.AppId)" -ForegroundColor White
            Write-Host "   Niveau de suspicion: $($app.SuspicionLevel)/10" -ForegroundColor $(if($app.SuspicionLevel -ge 7){"Red"}elseif($app.SuspicionLevel -ge 5){"Yellow"}else{"White"})
            Write-Host "   Raisons: $($app.Reasons)" -ForegroundColor Gray
            Write-Host "   Créée le: $($app.CreatedDateTime)" -ForegroundColor Gray
            Write-Host "   Permissions: $($app.OAuth2Permissions)" -ForegroundColor Gray
        }

        if ($ExportResults) {
            $reportPath = "SuspiciousOAuthApps_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
            $suspiciousApps | Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8
            Write-Host "`n📄 Rapport exporté: $reportPath" -ForegroundColor Green
        }

        # Recommandations
        Write-Host "`n💡 Actions recommandées:" -ForegroundColor Cyan
        Write-Host "   1. Révoquer l'accès des applications hautement suspectes" -ForegroundColor White
        Write-Host "   2. Implémenter une politique de consentement administrateur" -ForegroundColor White
        Write-Host "   3. Auditer régulièrement les permissions OAuth" -ForegroundColor White
        Write-Host "   4. Former les utilisateurs sur les risques du consentement" -ForegroundColor White

    } else {
        Write-Host "✅ Aucune application OAuth suspecte détectée." -ForegroundColor Green
    }

    return $suspiciousApps
}

function Monitor-PrivilegedIdentities {
    [CmdletBinding()]
    param(
        [int]$MonitoringPeriodHours = 24,
        [switch]$AlertOnAnomalies
    )

    Write-Host "👑 Monitoring des identités privilégiées..." -ForegroundColor Cyan

    Connect-MgGraph -Scopes "Directory.Read.All", "AuditLog.Read.All", "RoleManagement.Read.All"

    # Rôles privilégiés à surveiller
    $privilegedRoles = @(
        "Global Administrator",
        "Privileged Role Administrator",
        "User Administrator",
        "Exchange Administrator",
        "SharePoint Administrator",
        "Security Administrator",
        "Conditional Access Administrator"
    )

    $startTime = (Get-Date).AddHours(-$MonitoringPeriodHours)

    # Récupérer les rôles et leurs membres
    $roleMembers = @()
    foreach ($roleName in $privilegedRoles) {
        $role = Get-MgDirectoryRole -Filter "displayName eq '$roleName'"
        if ($role) {
            $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
            foreach ($member in $members) {
                $user = Get-MgUser -UserId $member.Id -ErrorAction SilentlyContinue
                if ($user) {
                    $roleMembers += [PSCustomObject]@{
                        RoleName = $roleName
                        UserPrincipalName = $user.UserPrincipalName
                        DisplayName = $user.DisplayName
                        UserId = $user.Id
                        AccountEnabled = $user.AccountEnabled
                        LastSignIn = $user.SignInActivity.LastSignInDateTime
                    }
                }
            }
        }
    }

    Write-Host "📊 $($roleMembers.Count) identités privilégiées trouvées" -ForegroundColor Yellow

    # Analyser l'activité de connexion récente
    $privilegedActivity = @()
    foreach ($member in $roleMembers) {
        $signIns = Get-MgAuditLogSignIn -Filter "userId eq '$($member.UserId)' and createdDateTime ge $($startTime.ToString('yyyy-MM-ddTHH:mm:ssZ'))" -All

        # Analyser les anomalies
        $anomalies = @()
        $locations = $signIns | Select-Object -Unique @{Name="Country"; Expression={$_.Location.CountryOrRegion}}
        $ipAddresses = $signIns | Select-Object -Unique IpAddress

        # Détection de voyage impossible
        if ($locations.Count -gt 2) {
            $anomalies += "Connexions depuis $($locations.Count) pays différents"
        }

        # Détection d'IPs multiples
        if ($ipAddresses.Count -gt 5) {
            $anomalies += "Connexions depuis $($ipAddresses.Count) adresses IP différentes"
        }

        # Connexions en dehors des heures de bureau
        $afterHours = $signIns | Where-Object {
            $hour = (Get-Date $_.CreatedDateTime).Hour
            $hour -lt 8 -or $hour -gt 18
        }

        if ($afterHours.Count -gt 0) {
            $anomalies += "$($afterHours.Count) connexions en dehors des heures de bureau"
        }

        # Connexions échouées récentes
        $failedSignIns = $signIns | Where-Object { $_.Status.ErrorCode -ne 0 }

        $privilegedActivity += [PSCustomObject]@{
            UserPrincipalName = $member.UserPrincipalName
            RoleName = $member.RoleName
            TotalSignIns = $signIns.Count
            FailedSignIns = $failedSignIns.Count
            UniqueCountries = $locations.Count
            UniqueIPs = $ipAddresses.Count
            AfterHoursSignIns = $afterHours.Count
            Anomalies = if($anomalies) { $anomalies -join "; " } else { "Aucune" }
            IsAnomalous = $anomalies.Count -gt 0
            LastSignIn = if($signIns) { ($signIns | Sort-Object CreatedDateTime -Descending | Select-Object -First 1).CreatedDateTime } else { "Aucune connexion récente" }
        }
    }

    # Afficher les résultats
    $anomalousUsers = $privilegedActivity | Where-Object { $_.IsAnomalous }

    if ($anomalousUsers) {
        Write-Host "🚨 $($anomalousUsers.Count) identités privilégiées avec comportement anormal!" -ForegroundColor Red

        foreach ($user in $anomalousUsers) {
            Write-Host "`n⚠️ Utilisateur: $($user.UserPrincipalName)" -ForegroundColor Yellow
            Write-Host "   Rôle: $($user.RoleName)" -ForegroundColor White
            Write-Host "   Connexions: $($user.TotalSignIns) (dont $($user.FailedSignIns) échouées)" -ForegroundColor White
            Write-Host "   Anomalies: $($user.Anomalies)" -ForegroundColor Red
            Write-Host "   Dernière connexion: $($user.LastSignIn)" -ForegroundColor Gray
        }

        if ($AlertOnAnomalies) {
            Write-Host "`n🚨 Génération d'alertes pour les comportements anormaux..." -ForegroundColor Red
            # Ici, vous pourriez intégrer l'envoi d'alertes par email, Teams, ou webhook
        }

    } else {
        Write-Host "✅ Aucun comportement anormal détecté pour les identités privilégiées." -ForegroundColor Green
    }

    # Rapport complet
    $reportPath = "PrivilegedIdentitiesReport_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
    $privilegedActivity | Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8
    Write-Host "`n📄 Rapport complet sauvegardé: $reportPath" -ForegroundColor Green

    return $privilegedActivity
}