# Create a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows use: venv\Scripts\activate

# Install required libraries
# msal: Microsoft Authentication Library
# requests: For making HTTP calls
# python-dotenv: For managing environment variables
pip install msal requests python-dotenv

# Initialize project
mkdir sharepoint-monitor && cd sharepoint-monitor
npm init -y

# Install dependencies
# @microsoft/microsoft-graph-client: Official Graph SDK
# @azure/msal-node: Microsoft Authentication Library for Node
# dotenv: For environment variables
npm install @microsoft/microsoft-graph-client @azure/msal-node dotenv

import os
import logging
from msal import ConfidentialClientApplication
import requests
from dotenv import load_dotenv

# Load environment variables from .env file
load_dotenv()

# Configure Logging
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
logger = logging.getLogger(__name__)

class SharePointSecurityMonitor:
    def __init__(self):
        self.client_id = os.getenv("CLIENT_ID")
        self.client_secret = os.getenv("CLIENT_SECRET")
        self.tenant_id = os.getenv("TENANT_ID")
        self.authority = f"https://login.microsoftonline.com/{self.tenant_id}"
        self.scopes = ["https://graph.microsoft.com/.default"]
        
        self.app = ConfidentialClientApplication(
            self.client_id, authority=self.authority, client_credential=self.client_secret
        )
        self.access_token = self._get_token()

    def _get_token(self):
        """Acquires an OAuth2 token using MSAL."""
        result = self.app.acquire_token_for_client(scopes=self.scopes)
        if "access_token" in result:
            return result["access_token"]
        else:
            logger.error(f"Could not acquire token: {result.get('error_description')}")
            raise Exception("Authentication Failed")

    def scan_for_exploits(self):
        """Scans audit logs for suspicious patterns related to CVE-2026-65660."""
        endpoint = "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits"
        headers = {"Authorization": f"Bearer {self.access_token}"}
        
        # In a real scenario, we filter for specific suspicious activities
        # For CVE-2026-65660, we look for unexpected API calls to SharePoint endpoints
        try:
            response = requests.get(endpoint, headers=headers)
            response.raise_for_status()
            logs = response.json().get('value', [])

            for log in logs:
                # Logic: Detect unusual activity in SharePoint service
                if "SharePoint" in str(log) and "Update" in str(log):
                    logger.warning(f"CRITICAL: Suspicious activity detected: {log.get('activityDisplayName')}")
                    # Here you would trigger an alert (PagerDuty, Slack, etc.)
            
            logger.info("Scan completed successfully.")
        except requests.exceptions.RequestException as e:
            logger.error(f"API Request failed: {e}")

if __name__ == "__main__":
    monitor = SharePointSecurityMonitor()
    monitor.scan_for_exploits()

import * as dotenv from 'dotenv';
import * as msal from '@azure/msal-node';
import { Client } from '@microsoft/microsoft-graph-client';
import { TokenCredentialAuthenticationProvider } from '@microsoft/microsoft-graph-client/authProviders/azureTokenCredentials';

dotenv.config();

async function monitorSharePoint() {
    const msalConfig: msal.Configuration = {
        auth: {
            clientId: process.env.CLIENT_ID!,
            authority: `https://login.microsoftonline.com/${process.env.TENANT_ID}`,
            clientSecret: process.env.CLIENT_SECRET!,
        }
    };

    const cca = new msal.ConfidentialClientApplication(msalConfig);

    // Helper to get token for Graph Client
    const authProvider = async (done: (err: Error | null, token: string | undefined) => void) => {
        try {
            const authResult = await cca.acquireTokenByClientCredential({
                scopes: ['https://graph.microsoft.com/.default'],
            });
            done(null, authResult.accessToken);
        } catch (error) {
            done(error as Error, undefined);
        }
    };

    // Initialize Graph Client
    const client = Client.initWithMiddleware({ authProvider });

    try {
        console.log("Starting SharePoint Security Scan...");
        
        // Fetching Audit Logs
        const auditLogs = await client.api('/auditLogs/directoryAudits').get();

        auditLogs.value.forEach((log: any) => {
            // CVE-2026-65660 Defense: Check for suspicious property modifications
            // that might indicate RCE attempts via SharePoint API
            if (log.activityDisplayName?.includes("Update") || log.activityDisplayName?.includes("Delete")) {
                console.warn(`[!] ALERT: Potential Exploit Pattern Detected: ${log.activityDisplayName}`);
                console.log(`Details: ${JSON.stringify(log.additionalDetails)}`);
            }
        });

        console.log("Scan finished.");
    } catch (error) {
        console.error("Error during monitoring:", error);
    }
}

monitorSharePoint();

# Azure App Registration Details
CLIENT_ID=your_azure_app_client_id_here
CLIENT_SECRET=your_azure_app_secret_here
TENANT_ID=your_microsoft_tenant_id_here

# Security Thresholds
ALERT_THRESHOLD=5
LOG_LEVEL=INFO