css extract

rvdwegen · Oct 5, 2024 · 9d87d07 · 9d87d07
1 parent 0a68e15
commit 9d87d07
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/tenantDetails/run.ps1 b/tenantDetails/run.ps1
@@ -126,25 +126,30 @@ try {
                 @{
                     detection = $TenantInformation.tenantId
                     friendlyName = "CIPP or CIPP-like"
+                    cssExtractPattern = '\.ext-sign-in-box\s*\{[^}]*\}'
                 },
                 @{
                     detection = "dscm.li"
                     friendlyName = "Zolder.io"
+                    cssExtractPattern = ''
                 },
                 @{
                     detection = "catch.eye.security"
                     friendlyName = "Eye.security"
+                    cssExtractPattern = ''
                 },
                 @{
                     detection = "dakg4cmpuclai.cloudfront.net"
                     friendlyName = "Canarytokens.org"
+                    cssExtractPattern = 'body\s*\{[^}]*background:\s*url\([''"]([^''"]+)[''"]\)[^}]*\}'
                 }
             )
 
             # Check if any pattern matches
             $aitm = $patterns | Where-Object { $cssContent -like "*$($_.detection)*" }
 
             if ($aitm) {
+                $cssExtract = ($cssContent | Select-String -Pattern $aitm.cssExtractPattern).Matches[0].Value
                 Write-Host "AITM detected: $aitm"
             } else {
                 Write-Host "AITM not detected"
@@ -153,6 +158,8 @@ try {
         } catch {
             Write-Warning "Failed to retrieve or process custom CSS content: $_"
         }
+
+        # unknown css detection
     }
 
     $fullDetails = @{
@@ -163,6 +170,7 @@ try {
         tenantDomains = $TenantDomains
         userTenantBranding = $userTenantBranding
         aitm = $aitm.friendlyName
+        cssExtract = $cssExtract
     }
 
 }