HAWK

Microsoft 365 Incident Response and Threat Hunting PowerShell tool.
The Hawk is designed to ease the burden on M365 administrators who are performing Cloud forensic tasks for their organization.
It accelerates the gathering of data from multiple sources in the service that be used to quickly identify malicious presence and activity.

Minimum PowerShell version

5.0

Installation Options

Owners

• matbyrd
• SemperCyber1775

Copyright

Copyright (c) 2025 Paul Navarro

Package Details

FileList

• Hawk.nuspec
• internal\functions\Add-HawkAppData.ps1
• internal\functions\Test-UserObject.ps1
• changelog.md
• functions\Tenant\Get-HawkTenantEDiscoveryConfiguration.ps1
• internal\functions\Compress-HawkData.ps1
• internal\functions\Write-HawkBanner.ps1
• functions\Tenant\Get-HawkTenantEDiscoveryLog.ps1
• internal\functions\Convert-ReportToHTML.ps1
• internal\scriptblocks\scriptblocks.ps1
• Hawk.psd1
• functions\Tenant\Get-HawkTenantEntraIDAdmin.ps1
• internal\functions\Get-AllUnifiedAuditLogEntry.ps1
• internal\scripts\license.ps1
• Hawk.psm1
• functions\Tenant\Get-HawkTenantEntraIDUser.ps1
• internal\functions\Get-AzureADPSPermission.ps1
• internal\scripts\postimport.ps1
• readme.md
• functions\Tenant\Get-HawkTenantEXOAdmin.ps1
• internal\functions\Get-HawkUserPath.ps1
• internal\scripts\preimport.ps1
• bin\readme.md
• functions\Tenant\Get-HawkTenantInboxRule.ps1
• internal\functions\Get-IPGeolocation.ps1
• internal\scripts\strings.ps1
• bin\System.Net.IPNetwork.dll
• functions\Tenant\Get-HawkTenantMailItemsAccessed.ps1
• internal\functions\Get-SimpleAdminAuditLog.ps1
• internal\scripts\pre_commit_hook_scripts\Invoke-PowerShellScriptAnalyzer.ps1
• en-us\about_Hawk.help.txt
• functions\Tenant\Get-HawkTenantRbacChange.ps1
• internal\functions\Get-SimpleUnifiedAuditLog.ps1
• internal\tepp\assignment.ps1
• en-us\strings.psd1
• functions\Tenant\Search-HawkTenantActivityByIP.ps1
• internal\functions\Import-AzureAuthenticationLog.ps1
• internal\tepp\example.tepp.ps1
• functions\readme.md
• functions\Tenant\Start-HawkTenantInvestigation.ps1
• internal\functions\Initialize-HawkGlobalObject.ps1
• internal\tepp\readme.md
• functions\General\Show-HawkHelp.ps1
• functions\User\Get-HawkUserAdminAudit.ps1
• internal\functions\Out-HawkAppData.ps1
• tests\pester.ps1
• functions\General\Update-HawkModule.ps1
• functions\User\Get-HawkUserAuthHistory.ps1
• internal\functions\Out-LogFile.ps1
• tests\readme.md
• functions\Message\Get-HawkMessageHeader.ps1
• functions\User\Get-HawkUserAutoReply.ps1
• internal\functions\Out-MultipleFileType.ps1
• tests\functions\readme.md
• functions\Tenant\Get-HawkTenantAdminEmailForwardingChange.ps1
• functions\User\Get-HawkUserConfiguration.ps1
• internal\functions\Out-Report.ps1
• tests\general\FileIntegrity.Exceptions.ps1
• functions\Tenant\Get-HawkTenantAdminInboxRuleCreation.ps1
• functions\User\Get-HawkUserEmailForwarding.ps1
• internal\functions\Read-HawkAppData.ps1
• tests\general\FileIntegrity.Tests.ps1
• functions\Tenant\Get-HawkTenantAdminInboxRuleModification.ps1
• functions\User\Get-HawkUserHiddenRule.ps1
• internal\functions\readme.md
• tests\general\Help.Exceptions.ps1
• functions\Tenant\Get-HawkTenantAdminInboxRuleRemoval.ps1
• functions\User\Get-HawkUserInboxRule.ps1
• internal\functions\Select-UniqueObject.ps1
• tests\general\Help.Tests.ps1
• functions\Tenant\Get-HawkTenantAdminMailboxPermissionChange.ps1
• functions\User\Get-HawkUserMailboxAuditing.ps1
• internal\functions\Start-SleepWithProgress.ps1
• tests\general\Manifest.Tests.ps1
• functions\Tenant\Get-HawkTenantAppAndSPNCredentialDetail.ps1
• functions\User\Get-HawkUserMessageTrace.ps1
• internal\functions\Test-CCOConnection.ps1
• tests\general\strings.Exceptions.ps1
• functions\Tenant\Get-HawkTenantAuditLog.ps1
• functions\User\Get-HawkUserMobileDevice.ps1
• internal\functions\Test-EXOConnection.ps1
• tests\general\strings.Tests.ps1
• functions\Tenant\Get-HawkTenantAuthHistory.ps1
• functions\User\Get-HawkUserPWNCheck.ps1
• internal\functions\Test-GraphConnection.ps1
• tests\general\Test-PreCommitHook.ps1
• functions\Tenant\Get-HawkTenantAzureAppAuditLog.ps1
• functions\User\Start-HawkUserInvestigation.ps1
• internal\functions\Test-MicrosoftIP.ps1
• xml\Hawk.Format.ps1xml
• functions\Tenant\Get-HawkTenantConfiguration.ps1
• internal\configurations\configuration.ps1
• internal\functions\Test-RecipientAge.ps1
• xml\Hawk.Types.ps1xml
• functions\Tenant\Get-HawkTenantConsentGrant.ps1
• internal\configurations\PSScriptAnalyzerSettings.psd1
• internal\functions\Test-SuspiciousInboxRule.ps1
• xml\readme.md
• functions\Tenant\Get-HawkTenantDomainActivity.ps1
• internal\configurations\readme.md

Version History