Azurehound enhancement - Active Sessions

.gitignore

@@ -232,3 +232,7 @@ tags
 
 # Built Visual Studio Code Extensions
 *.vsix
+.github/workflows/cla.yml
+.github/workflows/vuln-scan.yml
+/.github
+get_token.ps1

client/client.go

@@ -25,15 +25,41 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"time"
 
 	"github.com/bloodhoundad/azurehound/v2/client/config"
 	"github.com/bloodhoundad/azurehound/v2/client/query"
 	"github.com/bloodhoundad/azurehound/v2/client/rest"
 	"github.com/bloodhoundad/azurehound/v2/models/azure"
+	"github.com/bloodhoundad/azurehound/v2/models/intune"
 	"github.com/bloodhoundad/azurehound/v2/panicrecovery"
 	"github.com/bloodhoundad/azurehound/v2/pipeline"
 )
 
+// SignInEvent represents a sign-in event from Microsoft Graph
+type SignInEvent struct {
+	ID                string    `json:"id"`
+	CreatedDateTime   time.Time `json:"createdDateTime"`
+	UserDisplayName   string    `json:"userDisplayName"`
+	UserPrincipalName string    `json:"userPrincipalName"`
+	UserId            string    `json:"userId"`
+	AppDisplayName    string    `json:"appDisplayName"`
+	ClientAppUsed     string    `json:"clientAppUsed"`
+	IPAddress         string    `json:"ipAddress"`
+	IsInteractive     bool      `json:"isInteractive"`
+	Status            struct {
+		ErrorCode int `json:"errorCode"`
+	} `json:"status"`
+	DeviceDetail struct {
+		DeviceId        string `json:"deviceId"`
+		DisplayName     string `json:"displayName"`
+		OperatingSystem string `json:"operatingSystem"`
+		IsCompliant     bool   `json:"isCompliant"`
+	} `json:"deviceDetail"`
+	RiskState           string `json:"riskState"`
+	RiskLevelAggregated string `json:"riskLevelAggregated"`
+}
+
 func NewClient(config config.Config) (AzureClient, error) {
 	if msgraph, err := rest.NewRestClient(config.GraphUrl(), config); err != nil {
 		return nil, err
@@ -175,8 +201,18 @@ type azureClient struct {
 }
 
 type AzureGraphClient interface {
+	ValidateScriptDeployment(ctx context.Context) error
 	GetAzureADOrganization(ctx context.Context, selectCols []string) (*azure.Organization, error)
 
+	ListIntuneDevices(ctx context.Context, params query.GraphParams) <-chan AzureResult[azure.IntuneDevice]
+	ExecuteRegistryCollectionScript(ctx context.Context, deviceID string) (*azure.ScriptExecution, error)
+	GetScriptExecutionResults(ctx context.Context, scriptID string) <-chan AzureResult[azure.ScriptExecutionResult]
+	WaitForScriptCompletion(ctx context.Context, scriptID string, maxWaitTime time.Duration) (*azure.RegistryData, error)
+	CollectRegistryDataFromDevice(ctx context.Context, deviceID string) (*azure.RegistryData, error)
+	CollectRegistryDataFromAllDevices(ctx context.Context) <-chan AzureResult[azure.DeviceRegistryData]
+	GetDeployedScriptID(ctx context.Context, scriptName string) (string, error)
+	TriggerScriptExecution(ctx context.Context, scriptID, deviceID string) error
+
 	ListAzureADGroups(ctx context.Context, params query.GraphParams) <-chan AzureResult[azure.Group]
 	ListAzureADGroupMembers(ctx context.Context, objectId string, params query.GraphParams) <-chan AzureResult[json.RawMessage]
 	ListAzureADGroupOwners(ctx context.Context, objectId string, params query.GraphParams) <-chan AzureResult[json.RawMessage]
@@ -221,6 +257,19 @@ type AzureClient interface {
 
 	TenantInfo() azure.Tenant
 	CloseIdleConnections()
+
+	// New methods for role detection
+	GetUserDirectoryRoles(ctx context.Context, userPrincipalName string) ([]azure.DirectoryRole, error)
+	GetUserMemberOf(ctx context.Context, userPrincipalName string) ([]azure.DirectoryObject, error)
+
+	CollectSessionDataDirectly(ctx context.Context) <-chan AzureResult[azure.DeviceSessionData]
+	GetUserSignInActivity(ctx context.Context, userPrincipalName string, days int) ([]SignInEvent, error)
+	GetDeviceSignInActivity(ctx context.Context, deviceId string, days int) ([]SignInEvent, error)
+
+	// Add Intune methods
+	ListIntuneManagedDevices(ctx context.Context, params query.GraphParams) <-chan AzureResult[intune.ManagedDevice]
+	GetIntuneDeviceCompliance(ctx context.Context, deviceId string, params query.GraphParams) <-chan AzureResult[intune.ComplianceState]
+	GetIntuneDeviceConfiguration(ctx context.Context, deviceId string, params query.GraphParams) <-chan AzureResult[intune.ConfigurationState]
 }
 
 func (s azureClient) TenantInfo() azure.Tenant {

client/intune_devices.go

@@ -0,0 +1,65 @@
+// File: client/intune_devices.go
+// Copyright (C) 2022 SpecterOps
+// Implementation of Intune device management API calls
+
+package client
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/bloodhoundad/azurehound/v2/client/query"
+	"github.com/bloodhoundad/azurehound/v2/constants"
+	"github.com/bloodhoundad/azurehound/v2/models/intune"
+)
+
+// Maximum page size for Microsoft Graph API requests
+const MaxGraphAPIPageSize = 999
+
+func setDefaultParams(params *query.GraphParams) {
+	if params.Top == 0 {
+		params.Top = MaxGraphAPIPageSize
+	}
+}
+
+// ListIntuneManagedDevices retrieves all managed devices from Intune
+// GET /deviceManagement/managedDevices
+func (s *azureClient) ListIntuneManagedDevices(ctx context.Context, params query.GraphParams) <-chan AzureResult[intune.ManagedDevice] {
+	var (
+		out  = make(chan AzureResult[intune.ManagedDevice])
+		path = fmt.Sprintf("/%s/deviceManagement/managedDevices", constants.GraphApiVersion)
+	)
+
+	setDefaultParams(&params)
+
+	go getAzureObjectList[intune.ManagedDevice](s.msgraph, ctx, path, params, out)
+	return out
+}
+
+// GetIntuneDeviceCompliance retrieves compliance information for a specific device
+// GET /deviceManagement/managedDevices/{id}/deviceCompliancePolicyStates
+func (s *azureClient) GetIntuneDeviceCompliance(ctx context.Context, deviceId string, params query.GraphParams) <-chan AzureResult[intune.ComplianceState] {
+	var (
+		out  = make(chan AzureResult[intune.ComplianceState])
+		path = fmt.Sprintf("/%s/deviceManagement/managedDevices/%s/deviceCompliancePolicyStates", constants.GraphApiVersion, deviceId)
+	)
+
+	setDefaultParams(&params)
+
+	go getAzureObjectList[intune.ComplianceState](s.msgraph, ctx, path, params, out)
+	return out
+}
+
+// GetIntuneDeviceConfiguration retrieves configuration information for a specific device
+// GET /deviceManagement/managedDevices/{id}/deviceConfigurationStates
+func (s *azureClient) GetIntuneDeviceConfiguration(ctx context.Context, deviceId string, params query.GraphParams) <-chan AzureResult[intune.ConfigurationState] {
+	var (
+		out  = make(chan AzureResult[intune.ConfigurationState])
+		path = fmt.Sprintf("/%s/deviceManagement/managedDevices/%s/deviceConfigurationStates", constants.GraphApiVersion, deviceId)
+	)
+
+	setDefaultParams(&params)
+
+	go getAzureObjectList[intune.ConfigurationState](s.msgraph, ctx, path, params, out)
+	return out
+}