cisagov / untitledgoosetool

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
Creative Commons Zero v1.0 Universal
904 stars 77 forks source link

Allow for refreshing auth token while collecting data via honk #58

Closed lautriv closed 4 weeks ago

lautriv commented 11 months ago

💡 Summary

It would be wonderful if the team could refactor the collection functions to allow for refreshing tokens during goosey honk.

Motivation and context

When performing a collection via honk on a large tenant it is common for the authentication token to expire prior to the completion of collection. E.g.

2023-10-06 19:32:36,067 - azure_ad_datadumper - ERROR - Error with authentication token: Lifetime validation failed, the token is expired. (azure_ad_datadumper.py:399)
2023-10-06 19:32:36,067 - azure_ad_datadumper - ERROR - Please re-auth. (azure_ad_datadumper.py:400)

While a user could collect items individually by modifying .conf and repeatedly running honk, I don't think that is sustainable in the long term.

Implementation notes

I would expect that honk (and the underlying modules) will need to have functionality added to be able to:

Alternatively, we might be able to use refresh tokens assuming those are available for the application authentication flows.

Acceptance criteria

How do we know when this work is done?

AuthMon commented 10 months ago

This would be a great feature for use in larger tenants where execution can take several hours. The current build looks for 429 response from graph API and terminates after an hour of execution with a message asking for re-auth.

nkantor-snl commented 4 weeks ago

The newest version of the tool has moved to authentication through service principal only. This more easily allows the tool to refresh auth tokens since user auth with MFA is no longer integrated. If you would like to do this for your use of the tool please checkout the documentation on autohonk in the README