1. Launch a browser, navigate to protection.office.com, select Classifications and then select Sensitive info types.
2. Click +Create.
3. Enter a name and description and click Next.
4. Click +Add an element.
5. Select Regular expression from the drop-down, and paste in the regular expression text.
6. If you want to increase the sensitivity or confidence level, you may want to include supporting elements like btc or wallet keywords and click Next.
7. Confirm and click Finish.
8. Click Yes to test your pattern against a file.
9. Create a file with the following content:

   Send BTC payment to address:1JHJnnDp9A92XdjfYkHKyrJ3R99Q72K3X4

10. Upload the file and click Test.
11. Click Finish.

• Microsoft Teams PowerShell Model (Install-Module MicrosoftTeams)
• Connect to Exchange Online PowerShell
• Connect to Teams (Connect-MicrosoftTeams)

$UnifiedGroups = Get-UnifiedGroup -ResultSize Unlimited
$Teams = Get-Team
foreach ($Group in $UnifiedGroups) 
{ If (!($Teams.GroupId -match $group.ExternalDirectoryObjectId)) 
     { 
     New-Team -Group $Group.ExternalDirectoryObjectId 
     }
}

Getting Information on the Team you want to monitor

1. To install the Teams module, launch an elevated PowerShell session and run Install-Module MicrosoftTeams to download and install it from the PowerShell Gallery.
2. Once you've installed the module, you can use the Connect-MicrosoftTeams cmdlet to connect to your Office 365 tenant.
3. In order to get the information for the team whose channels we want to monitor, we'll need the object ID.  Run the Get-Team cmdlet, and then note the GroupID.

Configuring Azure Automation for Microsoft Teams

1. Create an Office 365 Service Account that will be used to log in and run the services.  If you want this account to send mail, it will need an Exchange Online mailbox license assigned.
2. Launch the Azure Portal, and create an Azure Automation service account.
3. Under Shared Resources, click Modules, click Browse gallery.
4. Search for Teams and select it.
5. Click Import.
6. Click OK to acknowledge.
7. Hopefully, you are blessed with an Import Successful toast notification.  If it doesn't, do not pass go and do not collect $200.
8. Add a credential (it'll be the credentials of the service account that you created in step 1).  Pay attention to the *Name value, as that's what we'll reference later on in the script.
9. Prepare your script.  In normal Windows PowerShell scripting, you may be familiar with the Get-Credential cmdlet, which gives you the ability to request and store a credential object (so aptly named).  In PowerShell Runbooks, we're going to use the Azure Automation version of this cmdlet (Get-AutomationPSCredential).  When we use it, we're going to tell it which Azure Automation credential to use (using the value in the name parameter specified earlier). $Credential = Get-AutomationPSCredential -Name "O365Service"
10. Under Process Automation, click Create a runbook.  You can see an overview of the process here.
11. Fill out the RunBook properties and click Create.
12. Paste the script content in the runbook and click Test pane to try it out. I've highlighted the areas you'll want to update:

    $Credential = Get-AutomationPSCredential -Name "O365Service"
    Connect-MicrosoftTeams -Credential $Credential
    $GroupId = "<Group ID from above>"
    $NewChannels = Get-TeamChannel -GroupId $GroupId | ? { ($_.Description -eq $null -or $_.Description -notlike "*RunBook*") -and $_.DisplayName -ne "General" }
    $SmtpServer = "smtp.office365.com"
    $SmtpPort = "587"
    $To = "recipient@domain.com"
    $From = "sender@domain.com"
    foreach ($Channel in $NewChannels)
    {
        $Date = Get-Date -Format "yyyy-MM-dd HH:MM:ss"
        If ($Channel.Description) { $Description = $Channel.Description + " Processed via RunBook at $($Date)" }
        Else { $Description = "Processed via RunBook at $($Date)" }
        Set-TeamChannel -GroupId $GroupId -CurrentDisplayName $Channel.DisplayName -Description $Description
        Send-MailMessage -UseSsl -Port 587 -Credential $Credential -SmtpServer $smtpserver -To $To -From $From -Subject "New channel $($Channel.DisplayName) has been added. Go take a look!"
    }
    Disconnect-MicrosoftTeams

13. Click Start.
14. Wait for the test to complete and review the output.
15. Publish it.

Function Get-Hash([String[]] $StringValue,[ValidateSet('SHA','SHA1','MD5','SHA256','SHA384','SHA512')]$Algorithm = "MD5") 
{
$HashedValue = New-Object System.Text.StringBuilder 
[System.Security.Cryptography.HashAlgorithm]::Create($Algorithm).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($StringValue))|%{ 
[Void]$HashedValue.Append($_.ToString("x2")) 
} 
$HashedValue.ToString() 
}

PS C:\temp> $String = "Hello, World!"
PS C:\temp> $String | Out-File hello.txt
PS C:\temp> $SecondString = Get-Content hello.txt
PS C:\temp> $Download = (New-Object System.Net.WebClient).DownloadString("https://www.undocumented-features.com/wp-content/uploads/2019/03/Hello.txt").Trim()
PS C:\temp> Get-Hash $String
65a8e27d8879283831b664bd8b7f0ad4
PS C:\temp> Get-Hash $SecondString
65a8e27d8879283831b664bd8b7f0ad4
PS C:\temp> Get-Hash $Download
65a8e27d8879283831b664bd8b7f0ad4
PS C:\temp>

$Exports | ? { $_.ExportedBytes -gt 0 } 
$SummaryByUser = $Exports | Group-Object -Property CreatedBy
$Exports | ? { $_.StartTime -gt (Get-Date).AddDays(-14) }

• You have a report.
• You have some exported objects.