Our AI threat analyst detects malicious packages and blogs about OSS compromises
7000 write-ups and countingRead one

Spectra Assure

Toolbox

Explore

Learn

ReversingLabs

Spectra Assure

Community

PS Gallery

Search by package name, PURL or hash

passEverything is awesome!

Scanned:

Maester

latest

Top 1k

Maester is an automation framework to assess and monitor your Microsoft 365 security configuration.

License: unknown

Published:

Visit source repository

See on PowerShell Gallery

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

No application hardening issues

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

Overview issues15 vulnerabilities0 malware0 behaviors91 dependencies2 contributors5 versions698

FAQ for Maester

What is Maester?

Maester is an automation framework to assess and monitor your Microsoft 365 security configuration. For more information about this package, visit its homepage.

Is Maester malicious or is it safe to use?

The PS Gallery package Maester was scanned for malware, software tampering, risky behaviors, exposed secrets and known vulnerabilities. No risks were detected, therefore, this version of the package is currently considered as safe to use.

Is Maester popular?

The PS Gallery package Maester ranks among the top 1000 projects in this community. It has 625K recorded downloads. A package's popularity is not a good indicator of its safety, visit the SAFE Assessment section to see the full analysis of package deployment risk categories.

How do I secure Maester once it is in my app?

Since we can't know when or where malicious attacks will happen, we recommend tracking how Maester behaviors change over multiple software releases. By adopting differential analysis in your release process, you can detect unexpected changes to a Maester version, which can prevent advanced software supply chain attacks. Read how our technology can help prevent future attacks similar to SolarWinds and 3CX.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

Popularity

624.96k

Total Downloads

Contributors

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Software components sometimes need to interact with higher privilege parts of the operating system, often requiring administrative access to accomplish a task. System security settings are the first line of defense against the most common attack vectors. For that reason, attackers often aim to tamper with system security settings. Disabling User Access Controls (UAC) and other security settings enables malicious code to execute without being blocked. While the presence of code that tampers with system security settings does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that interact with system security settings. One example of acceptable use for such functions is allowing specialized applications to install as services that monitor the operating system events.

Prevalence in PowerShell Gallery community

5 packages

found in

Top 100

86 packages

found in

Top 1k

726 packages

found in

Top 10k

1.29k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1562.001 - Disable or Modify Tools.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Software components sometimes need to interact with higher privilege parts of the operating system, often requiring administrative access to accomplish a task. Operating systems integrate first and third-party security solutions that can detect and block malicious code. For that reason, attackers often aim to tamper with system security software. Changing antivirus and other security software service settings may enable malicious code to execute without being blocked. While the presence of code that tampers with system security software does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that can temporarily disable system security features. One example of acceptable use for such functions is allowing specialized applications to modify protected folders and settings.

Prevalence in PowerShell Gallery community

0 packages

found in

Top 100

15 packages

found in

Top 1k

42 packages

found in

Top 10k

91 packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1562.001 - Disable or Modify Tools.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing service URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverage the GitHub service to deliver malicious payloads.

Prevalence in PowerShell Gallery community

7 packages

found in

Top 100

387 packages

found in

Top 1k

1476 packages

found in

Top 10k

2.58k packages

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider removing all references to flagged network locations.

Problem

Export restrictions (or a restriction on exportation) are limitations on the quantity of goods exported to a specific country or countries by a Government. The United States Government has imposed export restrictions on a number of countries and regions. These restrictions may or may not apply to digital goods such as software and other related intellectual property. It is advised that the reported findings are put in the usage context so that they can be audited and reviewed by the legal department before the software package is deployed. Current list of countries with export restrictions includes: Cuba (.cu), Iran (.ir), North Korea (.nk) and Syria (.sy).

Prevalence in PowerShell Gallery community

0 packages

found in

Top 100

2 packages

found in

Top 1k

4 packages

found in

Top 10k

10 packages

in community

Next steps

found in

Top 10k

76 packages

in community

Top vulnerabilities

No vulnerabilities found.

Maester

SAFE Assessment

Compliance

Security

Threats

FAQ for Maester

What is Maester?

Is Maester malicious or is it safe to use?

Is Maester popular?

How do I secure Maester once it is in my app?

Did you know...

Popularity

Top issues

TH16114Detected presence of software components that can tamper with the system security settings.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

TH16115Detected presence of software components that can tamper with the system security software.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

TH17131Detected presence of files containing domains used for intercepting and inspecting HTTP requests.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

TH18101Detected presence of files containing URLs that reside in regions with US export restrictions.hunting

Problem

Prevalence in PowerShell Gallery community

Next steps

Top behaviors

Prevents creating an interactive prompt for the user during execution.stealth

Prevalence in PowerShell Gallery community

Tampers with Active Directory settings.settings

Prevalence in PowerShell Gallery community

Loads additional snap-ins or modules to the current session.payload

Prevalence in PowerShell Gallery community

Tampers with Server Message Block (SMB) Shares.network

Prevalence in PowerShell Gallery community

Tampers with DNS server settings.network

Prevalence in PowerShell Gallery community

Top vulnerabilities