"CISA Launches Free Tool to Detect Hacking in Microsoft Cloud Services"
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has released an open-source incident response tool called 'Untitled Goose Tool' that helps detect signs of malicious activity in Microsoft cloud environments. The Python-based utility can dump telemetry information from Azure Active Directory, Microsoft Azure, and Microsoft 365 environments. With the help of CISA's cross-platform Microsoft cloud interrogation and analysis tool, security experts and network admins can export and review AAD sign-in and audit logs, M365 unified audit log (UAL), Azure activity logs, Microsoft Defender for IoT alerts, and Microsoft Defender for Endpoint data for suspicious activity.