Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Users are dropped in the suspicious app list #59

Open
randomaccess3 opened this issue Nov 8, 2024 · 2 comments
Open

Users are dropped in the suspicious app list #59

randomaccess3 opened this issue Nov 8, 2024 · 2 comments

Comments

@randomaccess3
Copy link

UsersAssigned = Get-MgServicePrincipalAppRoleAssignedTo -serviceprincipalid $match.id | Select-Object -expandproperty PrincipalDisplayname | Out-String #need to pull from additional cmd

If i'm reading this correctly this is going to drop users if there is more than one user assigned to the app.
In a case im looking at at the moment there's 2 users assigned to perfectdata software, but only one shown in "Users Assigned"

Same would apply to references, and known permissions

@syne0
Copy link
Owner

syne0 commented Dec 4, 2024

I think youre correct, totally needs to be in a foreach loop or something that would grab info for each user, plus they might have unique permissions., Even the csv output for this module is pretty messy so I think it needs more work.

This will be fixed for the 1.0.4.

@syne0
Copy link
Owner

syne0 commented Dec 29, 2024

OK this should be fixed in the next update now. The specific command could only pull user by ID and display name so I added some extra code so that it pulls UPN via the ID. Each user assigned to the application also does have it's own line in the export as well.

Similar issue exists with the permissions and references portion. I've submitted more apps to Huntress so once all the apps are done being ported over I'll move the sus list to their repo. Then, I'll redo the code to be better... somehow. not sure yet.

syne0 added a commit that referenced this issue Dec 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants