{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.946899950504303 } ], "prob": 0.94689995, "models": [ { "m": "az", "raw": 0.48315495, "prob": 0.94689995, "class": 0 }, { "m": "az/scripts", "raw": 0.660095, "prob": 0.6460582, "class": 0 }, { "m": "az/powershell", "raw": 0.038079094, "prob": 0.2, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-07T13:00:00Z" }, "path": "MSFT_TeamsMeetingPolicy.psm1", "raw": { "v": "6", "fs": [ { "f": "O(As)Md", "x": 34, "ff": { "m": { "ast": { "max_depth": 41.0, "call_count": 59.0, "node_count": 12374.0, "identifier_count": 193.0, "string_literal_count": 242.0, "array_literal_max_length": 2.0 }, "file": { "size": 36324.0, "entropy": 4.56, "size_bytes": 36324.0 }, "text": { "digit_ratio": 0.01, "space_count": 9955.0, "total_lines": 1218.0, "char_entropy": 4.56, "unique_chars": 82.0, "string_density": 0.2, "avg_line_length": 28.82, "max_line_length": 160.0, "empty_line_ratio": 0.2, "last_line_length": 1.0, "whitespace_ratio": 0.31, "most_common_ratio": 0.08, "identifier_density": 0.55, "line_length_stddev": 25.56, "encoded_string_ratio": 0.1, "normalized_string_count": 6.93, "repeated_char_sequences": 169.0, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.22, "max_inline_whitespace_run": 37.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 18.93 }, "calls": { "count": 59.0 }, "binary": { "overall_entropy": 4.56 }, "source": { "function_count": 4.0 }, "strings": { "total": 242.0, "avg_length": 14.53, "max_length": 94.0, "avg_entropy": 3.12, "empty_count": 6.0, "total_bytes": 3516.0, "entropy_stddev": 0.62, "base64_candidates": 24.0, "shell_command_strings": 6.0 }, "comments": { "chars": 1157.0, "lines": 23.0, "total": 23.0, "to_code_ratio": 0.02, "base64_in_comments": 4.0, "high_entropy_comments": 1.0 }, "functions": { "count": 4.0 }, "identifiers": { "count": 193.0, "total": 665.0, "avg_length": 20.3, "max_length": 43.0, "min_length": 2.0, "avg_entropy": 3.54, "reuse_ratio": 0.29, "unique_count": 194.0, "length_stddev": 9.13, "has_digit_ratio": 0.06, "base64_like_names": 9.0, "high_entropy_count": 122.0, "high_entropy_ratio": 0.63 } }, "s": [ [ 758, "u8", "EnabledUserOverride" ], [ 758, "u8", "EnabledUserOverride" ], [ 781, "u8", "DisabledUserOverride" ], [ 781, "u8", "DisabledUserOverride" ], [ 805, "u8", "Disabled" ], [ 805, "u8", "Disabled" ], [ 1234, "u8", "Enabled" ], [ 1234, "u8", "Enabled" ], [ 1245, "u8", "Disabled" ], [ 1245, "u8", "Disabled" ], [ 1315, "u8", "Disabled" ], [ 1315, "u8", "Disabled" ], [ 2966, "u8", "Enabled" ], [ 2966, "u8", "Enabled" ], [ 2977, "u8", "FederatedOnly" ], [ 2977, "u8", "FederatedOnly" ], [ 2994, "u8", "Disabled" ], [ 2994, "u8", "Disabled" ], [ 3366, "u8", "EveryoneInCompany" ], [ 3366, "u8", "EveryoneInCompany" ], [ 3387, "u8", "Everyone" ], [ 3387, "u8", "Everyone" ], [ 3399, "u8", "EveryoneInSameAndFederatedCompany" ], [ 3399, "u8", "EveryoneInSameAndFederatedCompany" ], [ 3436, "u8", "OrganizerOnly" ], [ 3436, "u8", "OrganizerOnly" ], [ 3453, "u8", "InvitedUsers" ], [ 3453, "u8", "InvitedUsers" ], [ 3469, "u8", "EveryoneInCompanyExcludingGuests" ], [ 3469, "u8", "EveryoneInCompanyExcludingGuests" ], [ 3749, "u8", "OrganizerOnlyUserOverride" ], [ 3749, "u8", "OrganizerOnlyUserOverride" ], [ 3778, "u8", "EveryoneInCompanyUserOverride" ], [ 3778, "u8", "EveryoneInCompanyUserOverride" ], [ 3811, "u8", "EveryoneUserOverride" ], [ 3811, "u8", "EveryoneUserOverride" ], [ 3899, "u8", "EveryoneUserOverride" ], [ 3899, "u8", "EveryoneUserOverride" ], [ 3967, "u8", "Disabled" ], [ 3967, "u8", "Disabled" ], [ 3979, "u8", "Enabled" ], [ 3979, "u8", "Enabled" ], [ 4045, "u8", "Disabled" ], [ 4045, "u8", "Disabled" ], [ 4346, "u8", "EnabledOutgoingIncoming" ], [ 4346, "u8", "EnabledOutgoingIncoming" ], [ 4373, "u8", "Disabled" ], [ 4373, "u8", "Disabled" ], [ 4433, "u8", "EnabledOutgoingIncoming" ], [ 4433, "u8", "EnabledOutgoingIncoming" ], [ 4504, "u8", "EnabledOutgoingIncoming" ], [ 4504, "u8", "EnabledOutgoingIncoming" ], [ 4531, "u8", "Disabled" ], [ 4531, "u8", "Disabled" ], [ 4591, "u8", "EnabledOutgoingIncoming" ], [ 4591, "u8", "EnabledOutgoingIncoming" ], [ 4662, "u8", "Disabled" ], [ 4662, "u8", "Disabled" ], [ 4674, "u8", "DisabledUserOverride" ], [ 4674, "u8", "DisabledUserOverride" ], [ 4758, "u8", "DisabledUserOverride" ], [ 4758, "u8", "DisabledUserOverride" ], [ 4937, "u8", "Disabled" ], [ 4937, "u8", "Disabled" ], [ 4949, "u8", "Enabled" ], [ 4949, "u8", "Enabled" ], [ 5105, "u8", "Disabled" ], [ 5105, "u8", "Disabled" ], [ 5117, "u8", "Enabled" ], [ 5117, "u8", "Enabled" ], [ 5187, "u8", "Enabled" ], [ 5187, "u8", "Enabled" ], [ 5349, "10", "1" ], [ 5349, "10", "1" ], [ 5351, "10", "99999" ], [ 5351, "10", "99999" ], [ 5471, "u8", "TeamsAndSfb" ], [ 5471, "u8", "TeamsAndSfb" ], [ 5486, "u8", "Teams" ], [ 5486, "u8", "Teams" ], [ 5688, "u8", "Stream" ], [ 5688, "u8", "Stream" ], [ 5698, "u8", "OneDriveForBusiness" ], [ 5698, "u8", "OneDriveForBusiness" ], [ 5797, "u8", "Off" ], [ 5797, "u8", "Off" ], [ 5804, "u8", "Distinguish" ], [ 5804, "u8", "Distinguish" ], [ 5819, "u8", "Attribute" ], [ 5819, "u8", "Attribute" ], [ 5894, "u8", "Off" ], [ 5894, "u8", "Off" ], [ 6053, "u8", "SingleApplication" ], [ 6053, "u8", "SingleApplication" ], [ 6074, "u8", "EntireScreen" ], [ 6074, "u8", "EntireScreen" ], [ 6090, "u8", "Disabled" ], [ 6090, "u8", "Disabled" ], [ 6199, "u8", "Disabled" ], [ 6199, "u8", "Disabled" ], [ 6211, "u8", "EnabledUserOverride" ], [ 6211, "u8", "EnabledUserOverride" ], [ 6312, "u8", "Disabled" ], [ 6312, "u8", "Disabled" ], [ 6324, "u8", "Enabled" ], [ 6324, "u8", "Enabled" ], [ 6393, "u8", "Enabled" ], [ 6393, "u8", "Enabled" ], [ 6448, "u8", "Disabled" ], [ 6448, "u8", "Disabled" ], [ 6460, "u8", "Enabled" ], [ 6460, "u8", "Enabled" ], [ 6599, "u8", "NoFilters" ], [ 6599, "u8", "NoFilters" ], [ 6612, "u8", "BlurOnly" ], [ 6612, "u8", "BlurOnly" ], [ 6624, "u8", "BlurAndDefaultBackgrounds" ], [ 6624, "u8", "BlurAndDefaultBackgrounds" ], [ 6653, "u8", "AllFilters" ], [ 6653, "u8", "AllFilters" ], [ 6739, "u8", "Everyone" ], [ 6739, "u8", "Everyone" ], [ 6751, "u8", "EveryoneInCompany" ], [ 6751, "u8", "EveryoneInCompany" ], [ 6866, "u8", "Present" ], [ 6866, "u8", "Present" ], [ 6877, "u8", "Absent" ], [ 6877, "u8", "Absent" ], [ 6930, "u8", "Present" ], [ 6930, "u8", "Present" ], [ 7286, "u8", "Getting the Teams Meeting Policy $($Identity)" ], [ 7286, "u8", "Getting the Teams Meeting Policy $($Identity)" ], [ 7389, "u8", "MicrosoftTeams" ], [ 7389, "u8", "MicrosoftTeams" ], [ 7652, "u8", "MSFT_" ], [ 7652, "u8", "MSFT_" ], [ 7979, "u8", "Absent" ], [ 7979, "u8", "Absent" ], [ 8092, "u8", "SilentlyContinue" ], [ 8092, "u8", "SilentlyContinue" ], [ 8188, "u8", "Could not find Teams Meeting Policy ${$Identity}" ], [ 8188, "u8", "Could not find Teams Meeting Policy ${$Identity}" ], [ 8311, "u8", "Found Teams Meeting Policy {$Identity}" ], [ 8311, "u8", "Found Teams Meeting Policy {$Identity}" ], [ 14010, "u8", "Present" ], [ 14010, "u8", "Present" ], [ 14377, "u8", "Error retrieving data:" ], [ 14377, "u8", "Error retrieving data:" ], [ 15304, "u8", "EnabledUserOverride" ], [ 15304, "u8", "EnabledUserOverride" ], [ 15327, "u8", "DisabledUserOverride" ], [ 15327, "u8", "DisabledUserOverride" ], [ 15351, "u8", "Disabled" ], [ 15351, "u8", "Disabled" ], [ 15780, "u8", "Enabled" ], [ 15780, "u8", "Enabled" ], [ 15791, "u8", "Disabled" ], [ 15791, "u8", "Disabled" ], [ 15861, "u8", "Disabled" ], [ 15861, "u8", "Disabled" ], [ 17512, "u8", "Enabled" ], [ 17512, "u8", "Enabled" ], [ 17523, "u8", "FederatedOnly" ], [ 17523, "u8", "FederatedOnly" ], [ 17540, "u8", "Disabled" ], [ 17540, "u8", "Disabled" ], [ 17912, "u8", "EveryoneInCompany" ], [ 17912, "u8", "EveryoneInCompany" ], [ 17933, "u8", "Everyone" ], [ 17933, "u8", "Everyone" ], [ 17945, "u8", "EveryoneInSameAndFederatedCompany" ], [ 17945, "u8", "EveryoneInSameAndFederatedCompany" ], [ 17982, "u8", "OrganizerOnly" ], [ 17982, "u8", "OrganizerOnly" ], [ 17999, "u8", "InvitedUsers" ], [ 17999, "u8", "InvitedUsers" ], [ 18015, "u8", "EveryoneInCompanyExcludingGuests" ], [ 18015, "u8", "EveryoneInCompanyExcludingGuests" ], [ 18295, "u8", "OrganizerOnlyUserOverride" ], [ 18295, "u8", "OrganizerOnlyUserOverride" ], [ 18324, "u8", "EveryoneInCompanyUserOverride" ], [ 18324, "u8", "EveryoneInCompanyUserOverride" ], [ 18357, "u8", "EveryoneUserOverride" ], [ 18357, "u8", "EveryoneUserOverride" ], [ 18445, "u8", "EveryoneUserOverride" ], [ 18445, "u8", "EveryoneUserOverride" ], [ 18513, "u8", "Disabled" ], [ 18513, "u8", "Disabled" ], [ 18525, "u8", "Enabled" ], [ 18525, "u8", "Enabled" ], [ 18591, "u8", "Disabled" ], [ 18591, "u8", "Disabled" ], [ 18892, "u8", "EnabledOutgoingIncoming" ], [ 18892, "u8", "EnabledOutgoingIncoming" ], [ 18919, "u8", "Disabled" ], [ 18919, "u8", "Disabled" ], [ 18979, "u8", "EnabledOutgoingIncoming" ], [ 18979, "u8", "EnabledOutgoingIncoming" ], [ 19050, "u8", "EnabledOutgoingIncoming" ], [ 19050, "u8", "EnabledOutgoingIncoming" ], [ 19077, "u8", "Disabled" ], [ 19077, "u8", "Disabled" ], [ 19137, "u8", "EnabledOutgoingIncoming" ], [ 19137, "u8", "EnabledOutgoingIncoming" ], [ 19208, "u8", "Disabled" ], [ 19208, "u8", "Disabled" ], [ 19220, "u8", "DisabledUserOverride" ], [ 19220, "u8", "DisabledUserOverride" ], [ 19304, "u8", "DisabledUserOverride" ], [ 19304, "u8", "DisabledUserOverride" ], [ 19483, "u8", "Disabled" ], [ 19483, "u8", "Disabled" ], [ 19495, "u8", "Enabled" ], [ 19495, "u8", "Enabled" ], [ 19651, "u8", "Disabled" ], [ 19651, "u8", "Disabled" ], [ 19663, "u8", "Enabled" ], [ 19663, "u8", "Enabled" ], [ 19733, "u8", "Enabled" ], [ 19733, "u8", "Enabled" ], [ 19895, "10", "1" ], [ 19895, "10", "1" ], [ 19897, "10", "99999" ], [ 19897, "10", "99999" ], [ 20017, "u8", "TeamsAndSfb" ], [ 20017, "u8", "TeamsAndSfb" ], [ 20032, "u8", "Teams" ], [ 20032, "u8", "Teams" ], [ 20234, "u8", "Stream" ], [ 20234, "u8", "Stream" ], [ 20244, "u8", "OneDriveForBusiness" ], [ 20244, "u8", "OneDriveForBusiness" ], [ 20343, "u8", "Off" ], [ 20343, "u8", "Off" ], [ 20350, "u8", "Distinguish" ], [ 20350, "u8", "Distinguish" ], [ 20365, "u8", "Attribute" ], [ 20365, "u8", "Attribute" ], [ 20440, "u8", "Off" ], [ 20440, "u8", "Off" ], [ 20599, "u8", "SingleApplication" ], [ 20599, "u8", "SingleApplication" ], [ 20620, "u8", "EntireScreen" ], [ 20620, "u8", "EntireScreen" ], [ 20636, "u8", "Disabled" ], [ 20636, "u8", "Disabled" ], [ 20745, "u8", "Disabled" ], [ 20745, "u8", "Disabled" ], [ 20757, "u8", "EnabledUserOverride" ], [ 20757, "u8", "EnabledUserOverride" ], [ 20858, "u8", "Disabled" ], [ 20858, "u8", "Disabled" ], [ 20870, "u8", "Enabled" ], [ 20870, "u8", "Enabled" ], [ 20939, "u8", "Enabled" ], [ 20939, "u8", "Enabled" ] ], "v": { "file.stem": "MSFT_TeamsMeetingPolicy", "file.basename": "MSFT_TeamsMeetingPolicy.psm1", "source.language": "powershell", "source.strings[0]": " |---[$i/$($policies.Count)] $($policy.Identity)", "source.strings[1]": "-FeFowUserTo", "source.strings[2]": "-FeFowUserTr", "source.strings[3]": "./+FowUserTo", "source.strings[4]": "/F%lowUserTo", "source.strings[5]": "/FeFowUserTo", "source.strings[6]": "/JOlowUserTol5(\u003c", "source.strings[7]": "3FeFowUserTo", "source.strings[8]": "3OOFowUserT4=EinExtern", "source.strings[9]": "3OglEwUsev7 Y", "source.strings[10]": "7DOFowUserT=R", "source.strings[11]": "9FeFowUserTo", "source.strings[12]": "9lOFowUp77", "source.strings[13]": "=FeFowUserTo", "source.strings[14]": "@$K@e}uSERtOjO2\u003e$\n", "source.strings[15]": "@$LLOWuSERtOjOINeXIEV", "source.strings[16]": "@$LLOWuSERtOjOINeXTERNALmEEIIJ", "source.strings[17]": "@FeFowUsev2 E", "source.strings[18]": "A%K@e}uSERtOjO2\u003e$\n", "source.strings[19]": "A%KE2}uSERtOjOM/)", "source.strings[20]": "A.@feWuSERtOj49", "source.strings[21]": "A.LLOWuSERtOjOINeETA", "source.strings[22]": "A.LLOWuSERtOjOINeXTERNALmEETING", "source.strings[23]": "A.fLOWuSERtOjOI/)", "source.strings[24]": "A2@feWuSERtOj49", "source.strings[25]": "A2LLOWuSERtOjOINeXTERNALmEETISG", "source.strings[26]": "A2LLOWuSERtOjOTNa", "source.strings[27]": "A2fLOWuSERtOjOI--", "source.strings[28]": "A2fLOWuSERtOjOI/)", "source.strings[29]": "A3@feWuSERtOj49", "source.strings[30]": "A3DE2}uSERtOjO28$", "source.strings[31]": "A3DE2}uSERtOjO2=\u003c", "source.strings[32]": "AaLLOWuSERtOjOINeXTERSAH=\n\t", "source.strings[33]": "AaLLOWuSERtOjOISe\\", "source.strings[34]": "Absent", "source.strings[35]": "AfE1eWuSERtOj4:", "source.strings[36]": "AfE1eWuSERtOjK:", "source.strings[37]": "AfffOWuSERtO#\tIFa", "source.strings[38]": "AllFilters", "source.strings[39]": "AllowAnonymousUsersToDialOut", "source.strings[40]": "AllowIPVideo", "source.strings[41]": "AllowRecordingStorageOutsideRegion", "source.strings[42]": "ApplicationId", "source.strings[43]": "Attribute", "source.strings[44]": "B'K@e}uSERtOjO2\u003e$\n", "source.strings[45]": "BlurAndDefaultBackgrounds", "source.strings[46]": "BlurOnly", "source.strings[47]": "C2@feWuSERtOj49", "source.strings[48]": "C2LLOWuNEV$", "source.strings[49]": "C2fLOWuSERtOjOI/)", "source.strings[50]": "CaLLOWuSERtOjOINeXTERNALmEEIIJ", "source.strings[51]": "CaLLOWuSERtOjOISe\\", "source.strings[52]": "CertificateThumbprint", "source.strings[53]": "Could not find Teams Meeting Policy ${$Identity}", "source.strings[54]": "Creating a new Teams Meeting Policy {$Identity}", "source.strings[55]": "Creating new Policy with Values: $(Convert-M365DscHashtableToString -Hashtable $SetParameters)", "source.strings[56]": "Credential", "source.strings[57]": "Current Values: $(Convert-M365DscHashtableToString -Hashtable $CurrentValues)", "source.strings[58]": "DKLLOWuSERtOjOD+7\n", "source.strings[59]": "DKLLOWuSERy\u0026$", "source.strings[60]": "DKLLOWuSERy,%", "source.strings[61]": "DKLLOWuSERy?+", "source.strings[62]": "Disabled", "source.strings[63]": "DisabledUserOverride", "source.strings[64]": "Distinguish", "source.strings[65]": "E%@feWuSERtOj49", "source.strings[66]": "E%LLOWuSERtOjOINeXTERSAH=\n\t", "source.strings[67]": "E%fLOWuSERtOjOI* ", "source.strings[68]": "E-1fOWuSERtOn,", "source.strings[69]": "E-@feWuSERtOj49", "source.strings[70]": "E/1fOWuSERtOn.", "source.strings[71]": "Enabled", "source.strings[72]": "EnabledOutgoingIncoming", "source.strings[73]": "EnabledUserOverride", "source.strings[74]": "Ensure", "source.strings[75]": "EntireScreen", "source.strings[76]": "Error during Export:", "source.strings[77]": "Error retrieving data:", "source.strings[78]": "Everyone", "source.strings[79]": "EveryoneInCompany", "source.strings[80]": "EveryoneInCompanyExcludingGuests", "source.strings[81]": "EveryoneInCompanyUserOverride", "source.strings[82]": "EveryoneInSameAndFederatedCompany", "source.strings[83]": "EveryoneUserOverride", "source.strings[84]": "F8@feWuSERtOj49", "source.strings[85]": "F8LLOWuSERtOjOINeXIEV", "source.strings[86]": "F8fLOWuSERtOjOI/)", "source.strings[87]": "FederatedOnly", "source.strings[88]": "Found Teams Meeting Policy {$Identity}", "source.strings[89]": "G)@feWuSERtOj49", "source.strings[90]": "G)fLOWuSERtOjOI/)", "source.strings[91]": "G8EfOWuSERtO1eINeXTERNALmE2", "source.strings[92]": "Getting the Teams Meeting Policy $($Identity)", "source.strings[93]": "I2@feWuSERtOj49", "source.strings[94]": "I2KE2}uSERtOjOM\u003e7", "source.strings[95]": "I2LLOWuSERtOjOINeXTERNALmEEIIJ", "source.strings[96]": "I2fLOWuSERtOjOI/)", "source.strings[97]": "InvitedUsers", "source.strings[98]": "J\u00261fOWuSERtO", "source.strings[99]": "J\u00261fOWuSERtOn\"", "source.functions[0]": "anonymous", "source.strings[100]": "J\u00261fOWuSERtOn#", "source.strings[101]": "J\u00261fOWuSERtOn\u0026", "source.strings[102]": "J\u00261fOWuSERtOn\u00269/0", "source.strings[103]": "J\u00261fOWuSERtOn\u002698,", "source.strings[104]": "J\u00261fOWuSERtOn)", "source.strings[105]": "J\u00261fOWuSERtOn*", "source.strings[106]": "J\u00261fOWuSERtOn+", "source.strings[107]": "J\u00261fOWuSERtOn,", "source.strings[108]": "J\u00261fOWuSERtOn-", "source.strings[109]": "J\u00261fOWuSERtOn.", "source.strings[110]": "J\u00261fOWuSERtOn8", "source.strings[111]": "J\u00261fOWuSERtOn;", "source.strings[112]": "J\u00261fOWuSERtOn\u003c", "source.strings[113]": "J\u00261fOWuSERtOn=", "source.strings[114]": "J\u0026@feWuSERtOj49", "source.strings[115]": "J\u0026K@e}uSERtOjO2\u003e$\n", "source.strings[116]": "J\u0026LLOWuSERtOjOINeXIEV", "source.strings[117]": "J\u0026LLOWuSERtOjOINeXTERNALmEXTM", "source.strings[118]": "J\u0026LLOWuSERtOjOINeXTERNAQmA", "source.strings[119]": "J\u0026LLOWuSERtOjOISe\\", "source.strings[120]": "J\u0026LLOWuSERtOjRIJ5", "source.strings[121]": "J\u0026LLOWuSERtOwOM", "source.strings[122]": "J\u0026fLOWuSERtOjOI/)", "source.strings[123]": "J2@feWuSERtOj49", "source.strings[124]": "J2LLOWuSERtOjOINeXTERNALmEETISG", "source.strings[125]": "J2LLOWuSERtOjOINeXTERNALpEA", "source.strings[126]": "J2fLOWuSERtOjOI/)", "source.strings[127]": "J5@feWuSERtOj49", "source.strings[128]": "J5K@e}uSERtOjO2\u003e$\n", "source.strings[129]": "J5KE2}uSERtOjO2=\u003c", "source.strings[130]": "J5LLOWuSERtOjOINeXTERSAH=\n\t", "source.strings[131]": "J5_^2}uSERtOjO28$", "source.strings[132]": "J5_^2}uSERtOjOM# ", "source.strings[133]": "J5fLOWuSERtOjOI(*\n", "source.strings[134]": "J8KE2}uSERtOjO2=\u003c", "source.strings[135]": "JKLLOWuSER)ejOINeXTE%", "source.strings[136]": "JaLLOWuSERtOjOINeXIEV", "source.strings[137]": "JaLLOWuSERtOjOINeXTERNALmEEIIJ", "source.strings[138]": "K%\tLOWuSERtOjOINeXTEONE", "source.strings[139]": "K%\tLOWuSERtOjOINeXTERNALmEETING", "source.strings[140]": "K%\tLOWuSERtOjOINeXTERNALmEETISG", "source.strings[141]": "K%\tLOWuSERtOjOINeXTERNALmXEP", "source.strings[142]": "K%\tfOWuSERtOjOIN", "source.strings[143]": "K%\tfOWuSERtOjOIN\t", "source.strings[144]": "K-@feWuSERtOj49", "source.strings[145]": "K-LLOWuSERtRjK", "source.strings[146]": "K-fLOWuSERtOjOI/)", "source.strings[147]": "K/@feWuSERtOj49", "source.strings[148]": "K/LLOWuSERtOjOINeXTERNALmEEIIJ", "source.strings[149]": "K/LLOWuSERtOjOINeXTERNALmEETING", "source.strings[150]": "K/LLOWuSERtOjOINeXTERSAH=\n\t", "source.strings[151]": "K/LLOWuSERtRjK", "source.strings[152]": "K/fLOWuSERtOjOI/)", "source.strings[153]": "K/ffeWuSEV:", "source.strings[154]": "K6@feWuSERtOj49", "source.strings[155]": "K6LLOWuSERtOjOINeXTERNALmEETING", "source.strings[156]": "K6LLOWuSERtOjOINeXTERNALmEXTM", "source.strings[157]": "K6fLOWuSERtOjOI/)", "source.strings[158]": "LaLLOWuSERtOjOINeXTERNALmEEIIJ", "source.strings[159]": "M%\tfOWuSERtOjOIN", "source.strings[160]": "M.@feWuSERtOj49", "source.strings[161]": "M.LLOWuSERtOjOINeXTERNALmEETING", "source.strings[162]": "M.fLOWuSERtOjOI/)", "source.strings[163]": "MicrosoftTeams", "source.strings[164]": "NoFilters", "source.strings[165]": "OneDriveForBusiness", "source.strings[166]": "OrganizerOnly", "source.strings[167]": "OrganizerOnlyUserOverride", "source.strings[168]": "P2KE2}uSERtOjOM/0", "source.strings[169]": "P8@feWuSERtOj49", "source.strings[170]": "P8LLOWuSERtOjOINeXTERNALmEETING", "source.strings[171]": "P8fLOWuSERtOjOI* ", "source.strings[172]": "PaLLOWuSERtOjOINeXIEV", "source.strings[173]": "Present", "source.strings[174]": "Q$E1eWuSERtOj4:", "source.strings[175]": "Q1@feWuSERtOj49", "source.strings[176]": "Q1fLOWuSERtOjOI/)", "source.strings[177]": "Q5@feWuSERtOj49", "source.strings[178]": "Q5LLOWuSERtOjOINeETA", "source.strings[179]": "Q5fLOWuSERtOjOI/)", "source.strings[180]": "RecordingStorageMode", "source.strings[181]": "Removing existing Teams Meeting Policy {$Identity}", "source.strings[182]": "Setting Teams Meeting Policy", "source.strings[183]": "SilentlyContinue", "source.strings[184]": "SingleApplication", "source.strings[185]": "Stream", "source.strings[186]": "T$@feWuSERtOj49", "source.strings[187]": "T$fLOWuSERtOjOI\",", "source.strings[188]": "Target Values: $(Convert-M365DscHashtableToString -Hashtable $PSBoundParameters)", "source.strings[189]": "TeamsAndSfb", "source.strings[190]": "TenantId", "source.strings[191]": "Test-TargetResource returned $TestResult", "source.strings[192]": "Testing configuration of Team Meeting Policy {$Identity}", "source.strings[193]": "Updating settings for Teams Meeting Policy {$Identity}", "source.strings[194]": "V%@feWuSERtOj49", "source.strings[195]": "V%LLOWuSERtOjOINeXTERNALmEETINZ", "source.strings[196]": "V%fLOWuSERtOjOI/0", "source.strings[197]": "V2@feWuSERtOj49", "source.strings[198]": "V2KE2}uSERtOjOM8,", "source.strings[199]": "V2fLOWuSERtOjOI,)", "source.strings[200]": "V5LLOWuSERtOjOINeXTERNALpEA", "source.strings[201]": "V5fLOWuSERtOjOI/)", "source.strings[202]": "Verbose", "source.strings[203]": "W2KE2}uSERtOjOM\u003c ", "source.strings[204]": "WaLLOWuSERtOjOINeXTERNALmEEIIJ", "source.strings[205]": "WmffOWuSERtO", "source.strings[206]": "YcfLOWuSERtOjOI", "source.strings[207]": "_KLLOWuSERp", "source.strings[208]": "c;OFowUserTka", "source.strings[209]": "c;OFowUserTkd", "source.strings[210]": "c;OFowUserTke", "source.strings[211]": "c;OFowUserTkg", "source.strings[212]": "c;OFowUserTkv", "source.strings[213]": "c;OFowUserTky", "source.strings[214]": "c;OFowUserTk{", "source.strings[215]": "d:fLOWuSERtOjOI'!", "source.strings[216]": "fFbAEwUsev7 Z", "source.strings[217]": "flOFowUserT", "source.strings[218]": "jF8lowUserTo`", "source.strings[219]": "jFeF4]UserTo", "source.strings[220]": "jFeFos1661", "source.strings[221]": "jFeFos9:377.G", "source.strings[222]": "jFeFowUnev", "source.strings[223]": "jFeFowUser17G\t -", "source.strings[224]": "jFeFowUser5:C\n", "source.strings[225]": "jFeFowUser=!Q\n", "source.strings[226]": "jFeFowUserIo", "source.strings[227]": "jFeFowUserTbr", "source.strings[228]": "jFeFowUserTo", "source.strings[229]": "jFeFowUserTo\nEm", "source.strings[230]": "jFeFowUserToE", "source.strings[231]": "jFeFowUserToq\n;-", "source.strings[232]": "jFeFowUserTor", "source.strings[233]": "jFeFowUserTos", "source.strings[234]": "jFeFowUserTot", "source.strings[235]": "jFeFowUserTou\t\u0026-", "source.strings[236]": "jFeFowUserTov\t%!", "source.strings[237]": "jFeFowUserToz", "source.strings[238]": "jFeFowUserTo{", "source.strings[239]": "jFeFowUserTo~", "source.strings[240]": "jFeFowUserTo~5", "source.strings[241]": "jFeFowUserTr", "source.strings[242]": "jFmlowUserTol5(\u003c", "source.strings[243]": "m%@feWuSERtOj49", "source.strings[244]": "m/@feWuSERtOj49", "source.strings[245]": "m/fLOWuSERtOjOI/)", "source.strings[246]": "mF%lowUserTo", "source.strings[247]": "mJOlowUserTol5(\u003c", "source.strings[248]": "mlOFowUserT\u0026QEaj", "source.strings[249]": "o#@feWuSERtOj49", "source.strings[250]": "x;OFowUserTkz", "source.strings[251]": "yKLLOWuSER", "source.strings[252]": "yKLLOWuSERp!/", "source.strings[253]": "yKLLOWuSERp##", "source.strings[254]": "yKLLOWuSERp\u003c)", "source.strings[255]": "yKLLOWuSERp\u003e$.," }, "ct": [ "Add-M365DSCTelemetryEvent", "Confirm-M365DSCDependencies", "Convert-M365DscHashtableToString", "Format-M365DSCTelemetryParameters", "Get-CsTeamsMeetingPolicy", "Get-M365DSCExportContentForResource", "Get-TargetResource", "New-CsTeamsMeetingPolicy", "New-M365DSCConnection", "New-M365DSCLogEntry", "Out-Null", "Remove-CsTeamsMeetingPolicy", "Save-M365DSCPartialExport", "Set-CsTeamsMeetingPolicy", "Test-M365DSCParameterState", "Update-M365DSCExportAuthenticationResults", "Write-Host", "Write-Verbose" ], "id": "powershell" }, "id": 0, "sz": 36324, "ts": [ { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "Command" ], "i": "objectives/command-and-control/dropper/execution/fileless::curl-custom-ua-piped-powershell--rx-30", "l": 1 }, { "d": "Stream string fragment", "e": [ ".Stream" ], "i": "objectives/execution/interpreter/script/wsh-fragments::adodb-fragment-stream-dup", "l": 1 }, { "c": 1.0, "d": "\"Environment\" keyword", "e": [ "environment" ], "i": "micro-behaviors/data/text/keywords/env::environment-keyword", "l": 1 }, { "c": 1.0, "d": "Valid PowerShell code", "e": [ "param\n (" ], "i": "metadata/lang/scripted::ps-valid", "l": 2 }, { "c": 0.8799999952316284, "d": "Source or test deletion target", "e": [ "Test" ], "i": "micro-behaviors/data/text/keywords/lexicon::target-source-test", "l": 1 }, { "c": 0.8999999761581421, "d": "Destructive delete verb", "e": [ "Remove" ], "i": "micro-behaviors/data/text/keywords/lexicon::delete-verb", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "Value" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 1218.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Multiple embedded base64 literals", "e": [ "EveryoneInSameAndFederatedCompany", "EveryoneUserOverride", "EnabledOutgoingIncoming", "OrganizerOnlyUserOverride", "EveryoneInCompanyUserOverride", "DisabledUserOverride", "EveryoneInCompanyExcludingGuests" ], "i": "objectives/command-and-control/dropper/staging/encrypted::multiple-base64-literals", "l": 1, "m": "C0025", "el": [ "d47", "ee3", "10fa", "ea5", "ec2", "30d", "d8d" ] }, { "c": 0.30000001192092896, "d": "credential keyword", "e": [ "Credential" ], "i": "micro-behaviors/data/text/keywords/lexicon::credential", "l": 1 }, { "c": 0.75, "d": "Regex component marker", "e": [ "TEMP" ], "i": "micro-behaviors/fs/directory/mkdir::temp-mkdir-command--rx-3", "l": 1 }, { "a": "T1562.001", "c": 0.8199999928474426, "d": "PowerShell char arithmetic", "e": [ "J\u00261fOWuSERtOn\u00269/0" ], "i": "objectives/evasion/anti-av/amsi::powershell-char-arithmetic", "l": 1, "m": "E1562", "el": [ "1136" ] }, { "a": "T1567", "c": 1.0, "d": "Regex component marker", "e": [ "Users" ], "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Obfuscated PowerShell variable names", "e": [ "identifiers.avg_entropy = 3.54" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::ps-obfuscated-vars", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Many random-looking source identifier names", "e": [ "identifiers.high_entropy_ratio = 0.63" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor → base64", "e": [ "\u003cbinary data\u003e \u003cxor+base64\u003e" ], "i": "metadata/encoded-payload/xor-base64", "l": 3, "el": [ "offset:14259" ] } ], "sha": "cb504ec47c753f1f15edd3f1c776caaaa7165edef8d6d1506f2ad55cf5206d3e", "path": "/data/samples/bad/projects/PowerHub/powerhub/decoy/MSFT_TeamsMeetingPolicy.psm1", "type": "powershell" } ], "tv": "318d5" } }