search

T0pCyber / hawk

Powershell Based tool for gathering information related to O365 intrusions and potential Breaches
https://cloudforensicator.com/
MIT License
678 stars 109 forks source link

Import-Module HAWK Import-Module : Could not load file or assembly 'file:///C:\Program Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.5.1\netFramework\Azure.Core.dll' or one of its dependencies. The system cannot find the file specified. #124

Open jleroxGWNTC opened 1 month ago

jleroxGWNTC commented 1 month ago

Describe the bug A clear and concise description of what the bug is.

To Reproduce Steps to reproduce the behavior:

  1. Attempt to Run Start-HawkInvestigation
  2. See error

Expected behavior A clear and concise description of what you expected to happen.

Screenshots If applicable, add screenshots to help explain your problem. image

The files seem to be in netcore folder instead.

File (please complete the following information):

Additional context

Start-HawkTenantInvestigation Start-HawkTenantInvestigation : The 'Start-HawkTenantInvestigation' command was found in the module 'HAWK', but the module could not be loaded. For more information, run 'Import-Module HAWK'. At line:1 char:1

PS C:\Windows\system32> Import-Module HAWK Import-Module : Could not load file or assembly 'file:///C:\Program Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.5.1\netFramework\Azure.Core.dll' or one of its dependencies. The system cannot find the file specified. At line:1 char:1

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PS C:\Windows\system32> Connect-AzureAD WARNING: Install the latest PowerShell module, the Microsoft Graph PowerShell SDK, for new features and improvements! https://aka.ms/graphPSmigration

Account Environment TenantId TenantDomain AccountType

**** AzureCloud b5d4688c-a846-4007-834f-0281b485d64e **** User

PS C:\Windows\system32> Connect-MsolService PS C:\Windows\system32> Connect-ExchangeOnline

This V3 EXO PowerShell module contains new REST API backed Exchange Online cmdlets which doesn't require WinRM for Client-Server communication. You can now run these cmdlets after turning off WinRM Basic Auth in your client machine thus making it more secure.

Unlike the EXO* prefixed cmdlets, the cmdlets in this module support full functional parity with the RPS (V1) cmdlets.

V3 cmdlets in the downloaded module are resilient to transient failures, handling retries and throttling errors inherently.

REST backed EOP and SCC cmdlets are also available in the V3 module. Similar to EXO, the cmdlets can be run without WinRM basic auth enabled.

For more information check https://aka.ms/exov3-module

PS C:\Windows\system32> Start-HawkTenantInvestigation Start-HawkTenantInvestigation : The 'Start-HawkTenantInvestigation' command was found in the module 'HAWK', but the module could not be loaded. For more information, run 'Import-Module HAWK'. At line:1 char:1

PS C:\Windows\system32> Import-Module HAWK Import-Module : Could not load file or assembly 'file:///C:\Program Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.5.1\netFramework\Azure.Core.dll' or one of its dependencies. The system cannot find the file specified. At line:1 char:1

PS C:\Windows\system32> Import-Module hawk Import-Module : Could not load file or assembly 'file:///C:\Program Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.5.1\netFramework\Azure.Core.dll' or one of its dependencies. The system cannot find the file specified. At line:1 char:1

PS C:\Windows\system32> Import-Module hawk Import-Module : Could not load file or assembly 'file:///C:\Program Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.5.1\netFramework\Azure.Core.dll' or one of its dependencies. The system cannot find the file specified. At line:1 char:1

PS C:\Windows\system32> Import-Module hawk Import-Module : Could not load file or assembly 'file:///C:\Program Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.5.1\netFramework\Azure.Core.dll' or one of its dependencies. The system cannot find the file specified. At line:1 char:1

PS C:\Windows\system32> Import-Module hawk Import-Module : Could not load file or assembly 'file:///C:\Program Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.5.1\netFramework\Azure.Core.dll' or one of its dependencies. The system cannot find the file specified. At line:1 char:1

PS C:\Windows\system32> cd C:\ PS C:> Import-Module HAWK Import-Module : Could not load file or assembly 'file:///C:\Program Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.5.1\netFramework\Azure.Core.dll' or one of its dependencies. The system cannot find the file specified. At line:1 char:1

syne0 commented 1 month ago

Have you tried to downgrade EXO module to 3.4.0? It is a known issue that more up to date versions of EXO cause issues.

Also, you should edit your original post as I believe your company domain name is shown, just so you known.

Gray-0men commented 1 month ago

Have you tried to downgrade EXO module to 3.4.0? It is a known issue that more up to date versions of EXO cause issues.

Also, you should edit your original post as I believe your company domain name is shown, just so you known.

image

Yup this was the issue, deleted 3.5.1 after running Install-Module -Name ExchangeOnlineManagement -RequiredVersion 3.4.0

and it started up