prowler-cloud 5.17.1__py3-none-any.whl → 5.18.1__py3-none-any.whl

prowler/providers/gcp/services/compute/compute_instance_suspended_without_persistent_disks/compute_instance_suspended_without_persistent_disks.py

@@ -0,0 +1,35 @@
+from prowler.lib.check.models import Check, Check_Report_GCP
+from prowler.providers.gcp.services.compute.compute_client import compute_client
+
+
+class compute_instance_suspended_without_persistent_disks(Check):
+    """
+    Ensure that VM instances in SUSPENDED state do not have persistent disks attached.
+
+    This check identifies VM instances that are in a SUSPENDED or SUSPENDING state
+    and have persistent disks still attached. Suspended VMs with attached disks
+    represent unused infrastructure that continues to incur storage costs.
+
+    - PASS: VM instance is not in SUSPENDED/SUSPENDING state, or is suspended but has no disks attached.
+    - FAIL: VM instance is in SUSPENDED/SUSPENDING state with persistent disks attached.
+    """
+
+    def execute(self) -> list[Check_Report_GCP]:
+        findings = []
+        for instance in compute_client.instances:
+            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
+            report.status = "PASS"
+            report.status_extended = f"VM Instance {instance.name} is not suspended."
+
+            if instance.status in ("SUSPENDED", "SUSPENDING"):
+                attached_disks = [disk.name for disk in instance.disks]
+
+                if attached_disks:
+                    report.status = "FAIL"
+                    report.status_extended = f"VM Instance {instance.name} is {instance.status.lower()} with {len(attached_disks)} persistent disk(s) attached: {', '.join(attached_disks)}."
+                else:
+                    report.status_extended = f"VM Instance {instance.name} is {instance.status.lower()} but has no persistent disks attached."
+
+            findings.append(report)
+
+        return findings

prowler/providers/gcp/services/compute/compute_service.py

@@ -198,6 +198,7 @@ class Compute(GCPService):
                                     "deletionProtection", False
                                 ),
                                 network_interfaces=network_interfaces,
+                                status=instance.get("status", "RUNNING"),
                                 on_host_maintenance=instance.get("scheduling", {}).get(
                                     "onHostMaintenance", "MIGRATE"
                                 ),
@@ -700,6 +701,7 @@ class Instance(BaseModel):
     provisioning_model: str = "STANDARD"
     deletion_protection: bool = False
     network_interfaces: list[NetworkInterface] = []
+    status: str = "RUNNING"
     on_host_maintenance: str = "MIGRATE"
 
 

prowler/providers/m365/lib/powershell/m365_powershell.py

@@ -823,6 +823,52 @@ class M365PowerShell(PowerShellSession):
             "Get-SharingPolicy | ConvertTo-Json -Depth 10", json_parse=True
         )
 
+    def get_teams_protection_policy(self) -> dict:
+        """
+        Get Teams Protection Policy.
+
+        Retrieves the Teams protection policy settings including Zero-hour auto purge (ZAP) configuration.
+
+        Returns:
+            dict: Teams protection policy settings in JSON format.
+
+        Example:
+            >>> get_teams_protection_policy()
+            {
+                "Identity": "Teams Protection Policy",
+                "ZapEnabled": True
+            }
+        """
+        return self.execute(
+            "Get-TeamsProtectionPolicy | ConvertTo-Json -Depth 10", json_parse=True
+        )
+
+    def get_shared_mailboxes(self) -> dict:
+        """
+        Get Exchange Online Shared Mailboxes.
+
+        Retrieves all shared mailboxes from Exchange Online with their external
+        directory object IDs for cross-referencing with Entra ID user accounts.
+
+        Returns:
+            dict: Shared mailbox information in JSON format.
+
+        Example:
+            >>> get_shared_mailboxes()
+            [
+                {
+                    "DisplayName": "Support Mailbox",
+                    "UserPrincipalName": "support@contoso.com",
+                    "ExternalDirectoryObjectId": "12345678-1234-1234-1234-123456789012",
+                    "Identity": "support@contoso.com"
+                }
+            ]
+        """
+        return self.execute(
+            "Get-EXOMailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited | Select-Object DisplayName, UserPrincipalName, ExternalDirectoryObjectId, Identity | ConvertTo-Json -Depth 10",
+            json_parse=True,
+        )
+
     def get_user_account_status(self) -> dict:
         """
         Get User Account Status.
@@ -833,7 +879,7 @@ class M365PowerShell(PowerShellSession):
             dict: User account status settings in JSON format.
         """
         return self.execute(
-            "$dict=@{}; Get-User -ResultSize Unlimited | ForEach-Object { $dict[$_.Id] = @{ AccountDisabled = $_.AccountDisabled } }; $dict | ConvertTo-Json -Depth 10",
+            "$dict=@{}; Get-User -ResultSize Unlimited | ForEach-Object { $dict[$_.ExternalDirectoryObjectId] = @{ AccountDisabled = $_.AccountDisabled } }; $dict | ConvertTo-Json -Depth 10",
             json_parse=True,
         )
 

prowler/providers/m365/services/defender/defender_service.py

@@ -8,7 +8,20 @@ from prowler.providers.m365.m365_provider import M365Provider
 
 
 class Defender(M365Service):
+    """
+    Microsoft 365 Defender service implementation.
+
+    Provides access to Microsoft Defender for Office 365 configurations including
+    malware policies, spam filtering, anti-phishing, and Teams protection settings.
+    """
+
     def __init__(self, provider: M365Provider):
+        """
+        Initialize the Defender service.
+
+        Args:
+            provider: The M365 provider instance.
+        """
         super().__init__(provider)
         self.malware_policies = []
         self.outbound_spam_policies = {}
@@ -20,6 +33,7 @@ class Defender(M365Service):
         self.inbound_spam_policies = []
         self.inbound_spam_rules = {}
         self.report_submission_policy = None
+        self.teams_protection_policy = None
         if self.powershell:
             if self.powershell.connect_exchange_online():
                 self.malware_policies = self._get_malware_filter_policy()
@@ -33,6 +47,7 @@ class Defender(M365Service):
                 self.inbound_spam_policies = self._get_inbound_spam_filter_policy()
                 self.inbound_spam_rules = self._get_inbound_spam_filter_rule()
                 self.report_submission_policy = self._get_report_submission_policy()
+                self.teams_protection_policy = self._get_teams_protection_policy()
             self.powershell.close()
 
     def _get_malware_filter_policy(self):
@@ -350,6 +365,12 @@ class Defender(M365Service):
         return inbound_spam_rules
 
     def _get_report_submission_policy(self):
+        """
+        Retrieve the Defender report submission policy.
+
+        Returns:
+            ReportSubmissionPolicy: The report submission policy configuration.
+        """
         logger.info("Microsoft365 - Getting Defender report submission policy...")
         report_submission_policy = None
         try:
@@ -387,6 +408,28 @@ class Defender(M365Service):
             )
         return report_submission_policy
 
+    def _get_teams_protection_policy(self):
+        """
+        Retrieve the Teams protection policy including ZAP settings.
+
+        Returns:
+            TeamsProtectionPolicy: The Teams protection policy configuration.
+        """
+        logger.info("Microsoft365 - Getting Teams protection policy...")
+        teams_protection_policy = None
+        try:
+            policy = self.powershell.get_teams_protection_policy()
+            if policy:
+                teams_protection_policy = TeamsProtectionPolicy(
+                    identity=policy.get("Identity", ""),
+                    zap_enabled=policy.get("ZapEnabled", True),
+                )
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+        return teams_protection_policy
+
 
 class MalwarePolicy(BaseModel):
     enable_file_filter: bool
@@ -470,6 +513,8 @@ class InboundSpamRule(BaseModel):
 
 
 class ReportSubmissionPolicy(BaseModel):
+    """Model for Defender report submission policy settings."""
+
     report_junk_to_customized_address: bool
     report_not_junk_to_customized_address: bool
     report_phish_to_customized_address: bool
@@ -478,3 +523,10 @@ class ReportSubmissionPolicy(BaseModel):
     report_phish_addresses: list[str]
     report_chat_message_enabled: bool
     report_chat_message_to_customized_address_enabled: bool
+
+
+class TeamsProtectionPolicy(BaseModel):
+    """Model for Teams protection policy settings including ZAP configuration."""
+
+    identity: str
+    zap_enabled: bool

prowler/providers/m365/services/defender/defender_zap_for_teams_enabled/defender_zap_for_teams_enabled.metadata.json

@@ -0,0 +1,38 @@
+{
+  "Provider": "m365",
+  "CheckID": "defender_zap_for_teams_enabled",
+  "CheckTitle": "Zero-hour auto purge (ZAP) protects Microsoft Teams from malware and phishing",
+  "CheckType": [],
+  "ServiceName": "defender",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "Teams Protection Policy",
+  "ResourceGroup": "collaboration",
+  "Description": "Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes **malware** and **high confidence phishing** in Teams messages.\n\nWhen ZAP blocks a message, it is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP can occur up to 48 hours after delivery.",
+  "Risk": "Without ZAP enabled, malicious content delivered to Teams chats remains accessible to users for up to 48 hours after delivery, even after being identified as harmful.\n\nThis extended exposure window could lead to:\n- **Malware infections** from weaponized attachments or links\n- **Phishing attacks** compromising user credentials and MFA tokens\n- **Lateral movement** as attackers exploit compromised accounts within the organization",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge?view=o365-worldwide#zero-hour-auto-purge-zap-in-microsoft-teams",
+    "https://learn.microsoft.com/en-us/defender-office-365/mdo-support-teams-about?view=o365-worldwide"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "Set-TeamsProtectionPolicy -Identity 'Teams Protection Policy' -ZapEnabled $true",
+      "NativeIaC": "",
+      "Other": "1. Navigate to Microsoft Defender https://security.microsoft.com/\n2. Click to expand System and select Settings > Email & collaboration > Microsoft Teams protection\n3. Set Zero-hour auto purge (ZAP) to On (Default)",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable Zero-hour auto purge (ZAP) for Microsoft Teams to ensure malicious content is automatically removed from chats after detection, even if it was delivered before being identified as harmful.",
+      "Url": "https://hub.prowler.com/check/defender_zap_for_teams_enabled"
+    }
+  },
+  "Categories": [
+    "email-security",
+    "e5"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/m365/services/defender/defender_zap_for_teams_enabled/defender_zap_for_teams_enabled.py

@@ -0,0 +1,53 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportM365
+from prowler.providers.m365.services.defender.defender_client import defender_client
+
+
+class defender_zap_for_teams_enabled(Check):
+    """Check if Zero-hour auto purge (ZAP) is enabled for Microsoft Teams.
+
+    ZAP is a protection feature that retroactively detects and neutralizes malware
+    and high confidence phishing in Teams messages.
+
+    - PASS: ZAP is enabled for Teams protection.
+    - FAIL: ZAP is not enabled for Teams protection.
+
+    Attributes:
+        metadata: Metadata associated with the check (inherited from Check).
+    """
+
+    def execute(self) -> List[CheckReportM365]:
+        """Execute the check for Teams ZAP protection status.
+
+        This method checks if Zero-hour auto purge (ZAP) is enabled for Microsoft Teams
+        to ensure malicious content is automatically removed from chats after detection.
+
+        Returns:
+            List[CheckReportM365]: A list of reports containing the result of the check.
+        """
+        findings = []
+        teams_protection_policy = defender_client.teams_protection_policy
+
+        if teams_protection_policy:
+            report = CheckReportM365(
+                metadata=self.metadata(),
+                resource=teams_protection_policy,
+                resource_name="Teams Protection Policy",
+                resource_id="teamsProtectionPolicy",
+            )
+
+            if teams_protection_policy.zap_enabled:
+                report.status = "PASS"
+                report.status_extended = (
+                    "Zero-hour auto purge (ZAP) is enabled for Microsoft Teams."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    "Zero-hour auto purge (ZAP) is not enabled for Microsoft Teams."
+                )
+
+            findings.append(report)
+
+        return findings

prowler/providers/m365/services/exchange/exchange_service.py

@@ -9,7 +9,20 @@ from prowler.providers.m365.m365_provider import M365Provider
 
 
 class Exchange(M365Service):
+    """
+    Exchange Online service for Microsoft 365.
+
+    This service provides access to Exchange Online resources and configurations
+    including organization settings, mailboxes, transport rules, and policies.
+    """
+
     def __init__(self, provider: M365Provider):
+        """
+        Initialize the Exchange service.
+
+        Args:
+            provider: The M365Provider instance for authentication and configuration.
+        """
         super().__init__(provider)
         self.organization_config = None
         self.mailboxes_config = []
@@ -19,6 +32,7 @@ class Exchange(M365Service):
         self.mailbox_policies = []
         self.role_assignment_policies = []
         self.mailbox_audit_properties = []
+        self.shared_mailboxes = []
 
         if self.powershell:
             if self.powershell.connect_exchange_online():
@@ -30,6 +44,7 @@ class Exchange(M365Service):
                 self.mailbox_policies = self._get_mailbox_policy()
                 self.role_assignment_policies = self._get_role_assignment_policies()
                 self.mailbox_audit_properties = self._get_mailbox_audit_properties()
+                self.shared_mailboxes = self._get_shared_mailboxes()
             self.powershell.close()
 
     def _get_organization_config(self):
@@ -211,6 +226,12 @@ class Exchange(M365Service):
         return role_assignment_policies
 
     def _get_mailbox_audit_properties(self):
+        """
+        Get mailbox audit properties for all mailboxes.
+
+        Returns:
+            list[MailboxAuditProperties]: List of mailbox audit property configurations.
+        """
         logger.info("Microsoft365 - Getting mailbox audit properties...")
         mailbox_audit_properties = []
         try:
@@ -248,6 +269,44 @@ class Exchange(M365Service):
             )
         return mailbox_audit_properties
 
+    def _get_shared_mailboxes(self):
+        """
+        Get all shared mailboxes from Exchange Online.
+
+        Retrieves shared mailboxes with their external directory object IDs
+        for cross-referencing with Entra ID user accounts.
+
+        Returns:
+            list[SharedMailbox]: List of shared mailbox configurations.
+        """
+        logger.info("Microsoft365 - Getting shared mailboxes...")
+        shared_mailboxes = []
+        try:
+            shared_mailboxes_data = self.powershell.get_shared_mailboxes()
+            if not shared_mailboxes_data:
+                return shared_mailboxes
+            if isinstance(shared_mailboxes_data, dict):
+                shared_mailboxes_data = [shared_mailboxes_data]
+            for shared_mailbox in shared_mailboxes_data:
+                if shared_mailbox:
+                    shared_mailboxes.append(
+                        SharedMailbox(
+                            name=shared_mailbox.get("DisplayName", ""),
+                            user_principal_name=shared_mailbox.get(
+                                "UserPrincipalName", ""
+                            ),
+                            external_directory_object_id=shared_mailbox.get(
+                                "ExternalDirectoryObjectId", ""
+                            ),
+                            identity=shared_mailbox.get("Identity", ""),
+                        )
+                    )
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+        return shared_mailboxes
+
 
 class Organization(BaseModel):
     name: str
@@ -342,6 +401,8 @@ class AuditDelegate(Enum):
 
 
 class AuditOwner(Enum):
+    """Audit actions for mailbox owner operations."""
+
     APPLY_RECORD = "ApplyRecord"
     CREATE = "Create"
     HARD_DELETE = "HardDelete"
@@ -353,3 +414,20 @@ class AuditOwner(Enum):
     UPDATE_CALENDAR_DELEGATION = "UpdateCalendarDelegation"
     UPDATE_FOLDER_PERMISSIONS = "UpdateFolderPermissions"
     UPDATE_INBOX_RULES = "UpdateInboxRules"
+
+
+class SharedMailbox(BaseModel):
+    """
+    Model for Exchange Online shared mailbox.
+
+    Attributes:
+        name: Display name of the shared mailbox.
+        user_principal_name: User principal name (email) of the shared mailbox.
+        external_directory_object_id: The Entra ID object ID for cross-referencing.
+        identity: Identity of the shared mailbox in Exchange.
+    """
+
+    name: str
+    user_principal_name: str
+    external_directory_object_id: str
+    identity: str

prowler/providers/m365/services/exchange/exchange_shared_mailbox_sign_in_disabled/exchange_shared_mailbox_sign_in_disabled.metadata.json

@@ -0,0 +1,37 @@
+{
+  "Provider": "m365",
+  "CheckID": "exchange_shared_mailbox_sign_in_disabled",
+  "CheckTitle": "Shared mailbox has sign-in blocked",
+  "CheckType": [],
+  "ServiceName": "exchange",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "Shared Mailbox",
+  "ResourceGroup": "IAM",
+  "Description": "Shared mailboxes are used for collaboration and should not permit direct sign-in. This check verifies that the **AccountEnabled** property is set to `false` in Entra ID for all shared mailboxes, preventing direct authentication.",
+  "Risk": "When sign-in is enabled on shared mailboxes, users with the password can bypass delegation controls and access the mailbox directly. This undermines **accountability** since actions cannot be attributed to individual users, and it increases the attack surface for credential-based attacks.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes",
+    "https://learn.microsoft.com/en-us/microsoft-365/admin/email/create-a-shared-mailbox#block-sign-in-for-the-shared-mailbox-account"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "Get-EXOMailbox -RecipientTypeDetails SharedMailbox | ForEach-Object { Update-MgUser -UserId $_.ExternalDirectoryObjectId -AccountEnabled:$false }",
+      "NativeIaC": "",
+      "Other": "1. Navigate to Entra admin center (https://entra.microsoft.com/)\n2. Expand Identity > Users and select All users\n3. Search for and select the shared mailbox user account\n4. In the properties pane, go to Account status\n5. Uncheck 'Account enabled' and click Save\n6. Repeat for all shared mailbox accounts",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Block sign-in for all shared mailboxes to ensure users can only access them through delegation. This enforces accountability and reduces security risks from shared credentials.",
+      "Url": "https://hub.prowler.com/check/exchange_shared_mailbox_sign_in_disabled"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/m365/services/exchange/exchange_shared_mailbox_sign_in_disabled/exchange_shared_mailbox_sign_in_disabled.py

@@ -0,0 +1,59 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportM365
+from prowler.providers.m365.services.entra.entra_client import entra_client
+from prowler.providers.m365.services.exchange.exchange_client import exchange_client
+
+
+class exchange_shared_mailbox_sign_in_disabled(Check):
+    """
+    Verify that sign-in is blocked for all shared mailboxes.
+
+    Shared mailboxes are designed for collaboration and should not permit direct
+    sign-in. Users should access shared mailboxes through delegation only, which
+    ensures accountability and proper access controls.
+
+    - PASS: Shared mailbox has sign-in blocked (AccountEnabled = False in Entra ID).
+    - FAIL: Shared mailbox has sign-in enabled (AccountEnabled = True in Entra ID).
+    """
+
+    def execute(self) -> List[CheckReportM365]:
+        """
+        Execute the check to verify shared mailbox sign-in status.
+
+        Cross-references shared mailboxes from Exchange Online with user accounts
+        in Entra ID to determine if sign-in is blocked.
+
+        Returns:
+            List[CheckReportM365]: A list of reports with the sign-in status for
+            each shared mailbox.
+        """
+        findings = []
+
+        for shared_mailbox in exchange_client.shared_mailboxes:
+            report = CheckReportM365(
+                metadata=self.metadata(),
+                resource=shared_mailbox,
+                resource_name=shared_mailbox.name or shared_mailbox.user_principal_name,
+                resource_id=shared_mailbox.external_directory_object_id
+                or shared_mailbox.identity,
+            )
+
+            # Look up the user in Entra ID by their external directory object ID
+            entra_user = entra_client.users.get(
+                shared_mailbox.external_directory_object_id
+            )
+
+            if not entra_user:
+                report.status = "FAIL"
+                report.status_extended = f"Shared mailbox {shared_mailbox.user_principal_name} could not be found in Entra ID for verification."
+            elif entra_user.account_enabled:
+                report.status = "FAIL"
+                report.status_extended = f"Shared mailbox {shared_mailbox.user_principal_name} has sign-in enabled."
+            else:
+                report.status = "PASS"
+                report.status_extended = f"Shared mailbox {shared_mailbox.user_principal_name} has sign-in blocked."
+
+            findings.append(report)
+
+        return findings