diff --git a/docs/README.md b/docs/README.md index fa496fb..952406f 100644 --- a/docs/README.md +++ b/docs/README.md @@ -26,33 +26,33 @@ Specifically designed for enterprises and managed service providers, Check uses Check is available for **Chrome**, **Microsoft Edge**, and **Firefox** (109+ Coming Soon!). -The extension integrates seamlessly with existing security workflows, offering centralized management, comprehensive logging, and offers an optional CIPP integration for MSPs managing multiple Microsoft 365 tenants. +The extension integrates seamlessly with existing security workflows, offering centralized management, comprehensive logging, and optional CIPP integration for MSPs managing multiple Microsoft 365 tenants. -Check is completely free, open source, and can be delivered to users completely white-label, it is an open-source project licensed under AGPL-3. You can contribute to check at [https://github.com/cyberdrain/Check](https://github.com/cyberdrain/Check). +Check is completely free and open source, can be delivered to users fully white-labeled, and is licensed under AGPL-3. You can contribute to Check at [https://github.com/cyberdrain/Check](https://github.com/cyberdrain/Check). -Installing the plugin immediately gives you protection against AITM attacks and takes seconds. Click the install button and you're good to go. +Installing the extension immediately gives you protection against AITM attacks and takes seconds. Click the install button and you're good to go. Install for Edge **OR** Install for Chrome **OR** Firefox (Coming Soon!) ## Why was Check created? -Check was created out of a need to have better protection against AITM attacks. During a CyberDrain brainstorming session CyberDrain's lead dev came up with the idea to create a Chrome extension to protect users: +Check was created out of a need for better protection against AITM attacks. During a CyberDrain brainstorming session, CyberDrain's lead developer came up with the idea to create a Chrome extension to protect users:
-This led to a hackathon in which the team crafted a proof of concept. This proof of concept led to the creation of Check by CyberDrain. CyberDrain decided to offer Check as a free to use community resource, for everyone. +This led to a hackathon in which the team crafted a proof of concept. This proof of concept led to the creation of Check by CyberDrain. CyberDrain decided to offer Check as a free-to-use community resource for everyone. ### What information does Check collect? -Nothing. We're not even kidding, we don't collect any data at all. You can set up a CIPP reporting server if you'd like, but this reports directly to your own environment. CyberDrain doesn't believe in making their users a product. We don't sell or collect any information. +Nothing. We're not even kidding: we don't collect any data at all. You can set up a CIPP reporting server if you'd like, but it reports directly to your own environment. CyberDrain doesn't believe in making its users a product. We don't sell or collect any information. ## How does it look? -When a user gets the plugin added, a new icon will appear, this icon is [brandable](settings/branding.md) to customize it to your own logo and name. +When the extension is added for a user, a new icon will appear. This icon is [brandable](settings/branding.md), allowing you to customize it with your own logo and name.
-When visiting a page that is suspect, but our certainty if the page is phishing is too low we'll show a banner on the page to warn users, if we're sure about the page being an AITM or phishing attack, we'll block the page entirely: +When you visit a suspicious page but our certainty that it is phishing is too low, we'll show a banner to warn you. If we're sure that the page is an AITM or phishing attack, we'll block it entirely:
diff --git a/docs/SUMMARY.md b/docs/SUMMARY.md index a6e2bf0..6fbf9de 100644 --- a/docs/SUMMARY.md +++ b/docs/SUMMARY.md @@ -14,7 +14,7 @@ - [Manual Deployment](deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md) - [Domain Deployment](deployment/chrome-edge-deployment-instructions/windows/domain-deployment.md) - [RMM Deployment](deployment/chrome-edge-deployment-instructions/windows/rmm-deployment.md) - - [MacOS](deployment/chrome-edge-deployment-instructions/macos.md) + - [macOS](deployment/chrome-edge-deployment-instructions/macos.md) - [Firefox Deployment](deployment/firefox-deployment.md) ## Removal diff --git a/docs/advanced/creating-detection-rules.md b/docs/advanced/creating-detection-rules.md index 08c3934..7b54827 100644 --- a/docs/advanced/creating-detection-rules.md +++ b/docs/advanced/creating-detection-rules.md @@ -7,17 +7,17 @@ The extension uses a rule-driven architecture where all detection logic is defin * **Phishing indicators** - Patterns that detect malicious content (supports both regex and code-driven logic) * **Detection requirements** - Elements that identify Microsoft 365 login pages * **Blocking rules** - Conditions that immediately block pages -* **Rogue apps detection** - Dynamic detection of known malicious OAuth applications +* **Rogue app detection** - Dynamic detection of known malicious OAuth applications -Each of these rules has their own schema. You can create a custom rules file and host it anywhere publicly (e.g. your own fork of Check's GitHub repo, as an Azure Blob file, etc.). By default, Check loads the CyberDrain rule set from our repository every 24 hours (configurable). Custom rules URLs must be CORS-accessible and return valid JSON matching the schema. +Each rule type has its own schema. You can create a custom rules file and host it anywhere publicly, such as in your own fork of Check's GitHub repository or an Azure Blob. By default, Check loads the CyberDrain rule set from our repository every 24 hours (configurable). Custom rules URLs must be CORS-accessible and return valid JSON matching the schema. **Important:** After updating rules via the UI or changing custom URLs, reload any open tabs for changes to take effect on those pages. The extension loads rules at startup and on the configured interval. -Contributions to our rules can be done via [https://github.com/CyberDrain/Check/blob/main/rules/detection-rules.json](https://github.com/CyberDrain/Check/blob/main/rules/detection-rules.json) +You can contribute to our rules through [https://github.com/CyberDrain/Check/blob/main/rules/detection-rules.json](https://github.com/CyberDrain/Check/blob/main/rules/detection-rules.json). ## Rule Configuration and Updates -Rules are managed by the [`DetectionRulesManager`](https://github.com/CyberDrain/Check/blob/main/scripts/modules/detection-rules-manager.js) class. It's job is to: +Rules are managed by the [`DetectionRulesManager`](https://github.com/CyberDrain/Check/blob/main/scripts/modules/detection-rules-manager.js) class. Its job is to: * Load rules at extension startup * Check for updates based on the configured interval (default: 24 hours) @@ -26,10 +26,10 @@ Rules are managed by the [`DetectionRulesManager`](https://github.com/CyberDrain **Update Process:** -1. Rules are fetched from the configured URL (remote or fallback to local) +1. Rules are fetched from the configured remote URL, with a fallback to the local file 2. New rules are cached locally and immediately applied 3. A message is sent to notify other extension components of the update -4. Open tabs require reload to apply the new rules +4. Open tabs require a reload to apply the new rules ## Exclusions @@ -61,7 +61,7 @@ Use regex patterns that match the full URL: ### Trusted Domains -These domains get immediate trusted status with valid badges: +These domains receive immediate trusted status with valid badges: ```json "trusted_login_patterns": [ @@ -339,12 +339,12 @@ This rule triggers when: - Word proximity matters - You want to exclude certain contexts (allowlist patterns) - Performance is important (substring checks are faster than complex regex) -- Rules are easier to maintain and understand +- You want rules that are easier to maintain and understand **Use Regex When:** - You have a simple, single pattern to match - You need complex character matching -- The pattern is already well-tested as regex +- The pattern is already well-tested as a regex ### Pattern Properties @@ -416,7 +416,7 @@ Configure what elements identify a legitimate Microsoft 365 login page: Check includes dynamic detection of known rogue OAuth applications that attempt to steal Microsoft 365 credentials. This feature: * Automatically fetches the latest list of rogue apps from the [Huntress Labs repository](https://github.com/huntresslabs/rogueapps) -* Updates every 12 hours by default (configurable in `rogue_apps_detection` section) +* Updates every 12 hours by default (configurable in the `rogue_apps_detection` section) * Warns users when they encounter known malicious OAuth applications * Caches data locally for offline protection diff --git a/docs/deployment/chrome-edge-deployment-instructions/macos.md b/docs/deployment/chrome-edge-deployment-instructions/macos.md index 45c2bec..d531148 100644 --- a/docs/deployment/chrome-edge-deployment-instructions/macos.md +++ b/docs/deployment/chrome-edge-deployment-instructions/macos.md @@ -2,12 +2,13 @@ icon: apple --- -# MacOS -I'd recommend that this be deployed via your MDM if the goal is to auto-deploy it without user interaction. +# macOS -A custom .mobileconfig file can be uploaded to most MDMs for deployment if they don't have their own Google Chrome, or Microsoft Edge profile building functionality baked-in. +We recommend deploying Check through your MDM if the goal is to install it automatically without user interaction. -Here's an example profile of the XML to create a mobileconfig that will install this in Microsoft Edge and Google Chrome. +A custom `.mobileconfig` file can be uploaded to most MDMs if they don't have built-in profile-building functionality for Google Chrome or Microsoft Edge. + +Here's an example XML profile for a mobile configuration that installs Check in Microsoft Edge and Google Chrome. ``` @@ -72,13 +73,13 @@ Here's an example profile of the XML to create a mobileconfig that will install ``` -You could also deploy it in Chrome via command-line by creating the proper JSON object in the correct directory in the core /Library directory in macOS. Credit to @cezaraugusto for the script (slightly modified to simply install 'Check' if no parameter is passed...though technically you could pass any other Chrome extension ID after the script path and it would install that extension). +You could also deploy it in Chrome from the command line by creating the appropriate JSON object in the correct location under the core `/Library` directory in macOS. Credit goes to @cezaraugusto for the script, which was slightly modified to install Check when no parameter is passed. You can also pass another Chrome extension ID after the script path to install that extension. ``` #!/bin/bash # https://developer.chrome.com/docs/extensions/mv3/external_extensions/#preferences -# Credit to #cezaraugusto# from GithubGist for this script...slightly modified for the purposes of installing Check by Cyberdrain if no parameter is passed +# Credit to #cezaraugusto# from GitHub Gist for this script, slightly modified to install Check by CyberDrain if no parameter is passed # https://gist.github.com/cezaraugusto # https://gist.github.com/cezaraugusto/0101d2cb251c088f398ca0f8d4495ca0 @@ -111,19 +112,15 @@ fi install_chrome_extension "$extension" -# Usage: +# Usage: # ./install_extension.sh -# Sample: adding React Dev Tools from command-line to Chrome +# Sample: adding React Dev Tools from the command line to Chrome # ./install_extension.sh fmkadmapgofadopljbjfkapdkoienihi ``` -This would not install the extension until the next time Chrome is launched, and then it will require the user to approve it. +This does not install the extension until the next time Chrome is launched. The user will then be required to approve it. SCR-20260520-krbi +Due to limitations like this, it is better to deploy the extension through an MDM. - - -Due to limitations like this it really would be better to push it via an MDM. - - -If you have experience deploying managed MacOS browser extensions, please contribute to the [docs via GitHub](https://github.com/CyberDrain/Check/tree/dev/docs). All Mac resources in the GitHub repo should be considered inaccurate until tested. +If you have experience deploying managed macOS browser extensions, please contribute to the [docs via GitHub](https://github.com/CyberDrain/Check/tree/dev/docs). All macOS resources in the GitHub repo should be considered inaccurate until tested. diff --git a/docs/deployment/chrome-edge-deployment-instructions/windows/README.md b/docs/deployment/chrome-edge-deployment-instructions/windows/README.md index 0163370..f430b3c 100644 --- a/docs/deployment/chrome-edge-deployment-instructions/windows/README.md +++ b/docs/deployment/chrome-edge-deployment-instructions/windows/README.md @@ -7,7 +7,7 @@ icon: windows # Windows -There are a few different options on how you can deploy Check to Windows devices. For more information on each, please see the page: +There are several ways to deploy Check to Windows devices. For more information about each method, see the following pages: {% content-ref url="manual-deployment.md" %} [manual-deployment.md](manual-deployment.md) diff --git a/docs/deployment/chrome-edge-deployment-instructions/windows/domain-deployment.md b/docs/deployment/chrome-edge-deployment-instructions/windows/domain-deployment.md index ac600b7..2583371 100644 --- a/docs/deployment/chrome-edge-deployment-instructions/windows/domain-deployment.md +++ b/docs/deployment/chrome-edge-deployment-instructions/windows/domain-deployment.md @@ -2,7 +2,7 @@ {% tabs %} {% tab title="Intune" %} -The simplest method of Intune deployment is via a win32 script. Follow the steps below to deploy Check with Intune. +The simplest method of Intune deployment is through a Win32 script. Follow the steps below to deploy Check with Intune. *** @@ -16,7 +16,7 @@ The simplest method of Intune deployment is via a win32 script. Follow the steps 1. Deploy-Windows-Chrome-and-Edge.ps1 2. Remove-Windows-Chrome-and-Edge.ps1 3. Detect-Windows-Chrome-and-Edge.ps1 -3. You will be prompted during the Setup script on how you want to configure Check. Follow the script's guidance to ensure you're accurately entering values for the script. These values will be used for both the Deploy and Detect to ensure the extension is properly deployed. +3. The setup script will prompt you to configure Check. Follow its guidance to ensure that you enter each value accurately. These values will be used by both the deployment and detection scripts to verify that the extension is properly deployed. 4. Set the output location the script will use to generate the three new scripts. {% hint style="info" %} @@ -97,7 +97,7 @@ Keep **Run script as 32-bit process on 64-bit clients** set to **No** so the det ### Updating Settings -When you need to change extension settings (e.g., enable page blocking, update branding): +When you need to change extension settings (e.g., enable page blocking or update branding): 1. Re-run the setup script with new values, or manually edit the config blocks in both `Deploy-` and `Detect-` scripts 2. Re-package with `IntuneWinAppUtil.exe` @@ -120,20 +120,19 @@ To remove the extension from managed devices: {% endtab %} {% tab title="Group Policy" %} -1. Download the following from the Check repo on GitHub +1. Download the following files from the Check repository on GitHub: 1. ​[Deploy-ADMX.ps1](https://github.com/CyberDrain/Check/blob/main/enterprise/Deploy-ADMX.ps1) 2. ​[Check-Extension.admx](https://github.com/CyberDrain/Check/blob/main/enterprise/admx/Check-Extension.admx)​ 3. ​[Check-Extension.adml](https://github.com/CyberDrain/Check/blob/main/enterprise/admx/en-US/Check-Extension.adml)​ -2. Run Deploy-ADMX.ps1. As long as you keep the other two files in the same folder, it will correctly add the available objects to Group Policy. -3. Open Group Policy and create a policy using the imported settings that can be found at `Computer Configuration → Policies → Administrative Templates → CyberDrain → Check - Microsoft 365 Phishing Protection` +2. Run `Deploy-ADMX.ps1`. As long as you keep the other two files in the same folder, it will correctly add the available objects to Group Policy. +3. Open Group Policy and create a policy using the imported settings at `Computer Configuration → Policies → Administrative Templates → CyberDrain → Check - Microsoft 365 Phishing Protection`. ![](<../../../.gitbook/assets/image (2).png>) {% endtab %} {% tab title="CIPP Standard" %} -You can use a CIPP standard to deploy Check. It works the same way that the [#intune](domain-deployment.md#intune "mention") instructions do but CIPP handles all the work for install and detection script building. +You can use a CIPP standard to deploy Check. It works the same way as the [#intune](domain-deployment.md#intune "mention") instructions, but CIPP handles the installation and detection-script creation. For more, see our [Standards documentation](https://standards.cipp.app/standards/deploycheckchromeextension). {% endtab %} {% endtabs %} - diff --git a/docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md b/docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md index f26d209..85a9532 100644 --- a/docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md +++ b/docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md @@ -5,18 +5,18 @@ **Modify the following script and copy it to your RMM's scripting engine or run the script directly on the endpoint to deploy Check:** {% hint style="info" %} -This script is designed to deploy the extension to both Chrome and Edge. It is recommended to deploy both even if you standardize on one. This will provide you with better protection in the case someone uses the non-favored browser. +This script is designed to deploy the extension to both Chrome and Edge. We recommend deploying it to both browsers, even if you standardize on one. This provides better protection in case someone uses the non-preferred browser. {% endhint %} 1. Review the Extension Configuration Settings and Custom Branding Settings variables and update those to your desired values. The current values in the script are the default values. Leaving any unchanged will set the defaults. -2. If you are leveraging a RMM that has the ability to define the variables in the deployment section of scripting, then you may be able to remove this section and enter the variable definitions into the RMM scripting pages. +2. If you are using an RMM that can define variables in its scripting interface, you may be able to remove this section and enter the variable definitions in the RMM instead. 3. For webhook deployment, configure `$enableGenericWebhook`, `$webhookUrl`, and `$webhookEvents` in the script. Supported events are documented in [Webhook Documentation](../../../webhooks.md). Download the Script from GitHub {% endtab %} -{% tab title="Side Load" %} -Developers who wish to test their code changes can side load the extension into their browser. +{% tab title="Sideload" %} +Developers who wish to test their code changes can sideload the extension in their browser. 1. Fork the repository and clone your fork 2. Open `chrome://extensions` or `edge://extensions` diff --git a/docs/deployment/chrome-edge-deployment-instructions/windows/rmm-deployment.md b/docs/deployment/chrome-edge-deployment-instructions/windows/rmm-deployment.md index 014f972..16ca243 100644 --- a/docs/deployment/chrome-edge-deployment-instructions/windows/rmm-deployment.md +++ b/docs/deployment/chrome-edge-deployment-instructions/windows/rmm-deployment.md @@ -6,13 +6,13 @@ description: >- # RMM Deployment -Review the below options for how to deploy Check to Windows devices via RMM. If you use a RMM not featured, please see the script in [#powershell](manual-deployment.md#powershell "mention") to script the install. +Review the following options for deploying Check to Windows devices through an RMM. If you use an RMM that is not listed, see the script in [#powershell](manual-deployment.md#powershell "mention") to automate the installation.
Action1 -For Action1, you can use the script in [#powershell](manual-deployment.md#powershell "mention") to create a ps1 file and deploy it via a [custom package in the software repository](https://www.action1.com/documentation/add-custom-packages-to-app-store/) or via the [script library](https://www.action1.com/documentation/script-library/). +For Action1, you can save the script in [#powershell](manual-deployment.md#powershell "mention") as a `.ps1` file and deploy it through a [custom package in the software repository](https://www.action1.com/documentation/add-custom-packages-to-app-store/) or the [script library](https://www.action1.com/documentation/script-library/).
@@ -20,7 +20,7 @@ For Action1, you can use the script in [#powershell](manual-deployment.md#powers Acronis RMM -For Acronis RMM, you can use the script in [#powershell](manual-deployment.md#powershell "mention") to [create a script in the Script repository](https://www.acronis.com/en-us/support/documentation/CyberProtectionService/#cyber-scripting-creating-script.html) and then running the script via a [Script Plan](https://www.acronis.com/en-us/support/documentation/CyberProtectionService/#cyber-scripting-scripting-plans.html). +For Acronis RMM, you can use the script in [#powershell](manual-deployment.md#powershell "mention") to [create a script in the Script repository](https://www.acronis.com/en-us/support/documentation/CyberProtectionService/#cyber-scripting-creating-script.html) and then run it through a [Script Plan](https://www.acronis.com/en-us/support/documentation/CyberProtectionService/#cyber-scripting-scripting-plans.html). @@ -32,7 +32,7 @@ For Acronis RMM, you can use the script in [#powershell](manual-deployment.md#po 2. Create a new script 3. Add a PowerShell Execute Script step 4. Copy in the [#powershell](manual-deployment.md#powershell "mention") script. -5. Save and assign the script to your targetted devices. +5. Save and assign the script to your targeted devices. @@ -57,7 +57,7 @@ For Acronis RMM, you can use the script in [#powershell](manual-deployment.md#po ImmyBot ImmyBot includes a pre-built Global Computer Task for Check browser extension deployment.\ -Due to how flexible Immy is, this may look intimidating at first, but it is quite easy and nearly purely UI-driven!\ +Due to Immy's flexibility, this may look intimidating at first, but the process is straightforward and almost entirely UI-driven.\ Follow these steps to deploy Check using ImmyBot: **Step 1: Create a Deployment** @@ -90,11 +90,11 @@ Follow these steps to deploy Check using ImmyBot: 1. Click **Create** to save the deployment 2. **Run a Maintenance Session** to apply the deployment: * Navigate to the target computers - * Initiate maintenance session to execute deployments + * Initiate a maintenance session to execute deployments 3. **Monitor Results** through ImmyBot's maintenance session logs 4. Review deployment status and address any failures -**Best Practices for** ImmyBot **Deployment** +**Best Practices for ImmyBot Deployment** * **Test First**: Create a test deployment targeting a small group before rolling out globally * **Use Targeting**: Leverage Immy's advanced targeting to deploy based on computer properties, user assignments, or custom criteria @@ -110,7 +110,7 @@ For detailed information about Immy deployments, tasks, and maintenance sessions Kaseya VSA 1. Go to **Agent Procedures** → **Installer Wizards** → **Application Deploy** -2. Upload a .ps1 of the [#powershell](manual-deployment.md#powershell "mention") script +2. Upload the [#powershell](manual-deployment.md#powershell "mention") script as a `.ps1` file 3. Choose Private or Shared Files 4. Select installer type 5. Add command-line options @@ -137,7 +137,7 @@ For detailed information about Immy deployments, tasks, and maintenance sessions 10. Click **Distribute** {% hint style="warning" %} -ManageEngine's documentation is not clear how to manage the settings for the extension via this method. It may be necessary to transition to scripted deployment. +ManageEngine's documentation is not clear about how to manage the extension settings through this method. It may be necessary to transition to scripted deployment. {% endhint %} @@ -151,7 +151,7 @@ ManageEngine's documentation is not clear how to manage the settings for the ext 3. Choose: 1. Script Type: **PowerShell** 2. Operating System: **Windows** -4. Upload a .ps1 of the [#powershell](manual-deployment.md#powershell "mention") script or paste the script directly +4. Upload the [#powershell](manual-deployment.md#powershell "mention") script as a `.ps1` file or paste the script directly 5. Name the script `Check Browser Extension Deployment` 6. Save the script 7. Go to **Configuration** → **Scheduled Task** → **Add Task** @@ -160,7 +160,7 @@ ManageEngine's documentation is not clear how to manage the settings for the ext 10. Configure the task 1. Name: **Check Browser Extension Deployment** 2. Target Devices: Choose specific devices, groups, or filters - 3. Schedule: Set to your desired interval. We recommend on login/startup for best results but a lower frequency can also ensure deployment to all macines + 3. Schedule: Set your desired interval. We recommend running on login or startup for the best results, but a lower frequency can also ensure deployment to all machines 4. Execution Context: **System Account** 11. Click **Save and Activate** @@ -174,15 +174,15 @@ ManageEngine's documentation is not clear how to manage the settings for the ext 2. Click **New** 3. Enter `Check Browser Extension Deployment` for the name and a brief description 4. Set a timeout period for the script of 600 seconds -5. Upload a .ps1 file of the [#powershell](manual-deployment.md#powershell "mention") script leaving `Script check and automated task` selected +5. Upload the [#powershell](manual-deployment.md#powershell "mention") script as a `.ps1` file, leaving `Script check and automated task` selected 6. Click **Save** 7. On the **All Devices** view, right-click your targeted Client or Site 8. Select **Task** → **Add** 9. Select the script you just uploaded -10. Enter a name for the task, e.g. ` Check Browser Extension Deployment` +10. Enter a name for the task, e.g., ` Check Browser Extension Deployment` 11. Select `Once per day` for the frequency method 12. Set a **Start Date**, **Start Time**, **End Date**, and **End Time** as desired -13. Set a maximum permitted execution time e.g. 600 seconds +13. Set a maximum permitted execution time, e.g., 600 seconds 14. Set `Run task as soon as possible if schedule is missed` 15. Select **Next** 16. Select the targeted devices and click **Add Task** @@ -195,24 +195,24 @@ ManageEngine's documentation is not clear how to manage the settings for the ext 1. Go to **Administration** → **Library** → **Automation** → **Add** → **New Script** -1) Enter: +1. Enter: 1. Name `Check Browser Extension Deployment` 2. Description: To deploy Check by CyberDrain for Edge and Chrome - 3. Categories: Select as approriate for your environment + 3. Categories: Select as appropriate for your environment 4. Language: PowerShell 5. Operating System: Windows - 6. Architechture: All + 6. Architecture: All 7. Run As: System 8. Script Variables: Add as desired to customize -2) Copy the [#powershell](manual-deployment.md#powershell "mention") script into the editor -3) Click **Save** -4) Go to **Administration** → **Policies** -5) Options are to create a new policy or add the automation to an existing policy targeting Windows devices -6) Select **Scheduled Automation** on the left -7) Click **Add a Scheduled automation** button -8) Select the script and set the options for frequency, add variables, etc. -9) Click **Add** -10) Click **Save** +2. Copy the [#powershell](manual-deployment.md#powershell "mention") script into the editor +3. Click **Save** +4. Go to **Administration** → **Policies** +5. Create a new policy or add the automation to an existing policy that targets Windows devices +6. Select **Scheduled Automation** on the left +7. Click **Add a Scheduled automation** button +8. Select the script and set the options for frequency, add variables, etc. +9. Click **Add** +10. Click **Save** @@ -243,14 +243,14 @@ ManageEngine's documentation is not clear how to manage the settings for the ext SuperOps.ai 1. Navigate to **Modules** → **Scripts** -2. Click **+ Scrip**t -3. Name the script `Check Browser Extension Depoloyment` +2. Click **+ Script** +3. Name the script `Check Browser Extension Deployment` 4. Choose **PowerShell** as the language 5. Paste the [#powershell](manual-deployment.md#powershell "mention") script 6. Set a timeout of 600 seconds 7. Choose to run as **System/Root User** 8. Save the script -9. SuperOps has multiple ways to deploy a scheduled action. Please review their documentation for your preferred method +9. SuperOps has multiple ways to deploy a scheduled action. Review its documentation to choose your preferred method. @@ -268,10 +268,10 @@ ManageEngine's documentation is not clear how to manage the settings for the ext 8. Navigate to **Policies** 9. Click **+New Policy** 10. Name the policy `Check Browser Extension Deployment` -11. Choose **Scripting** policy category +11. Choose the **Scripting** policy category 12. Click **+Add Entry** -13. Select the script you just created from the drop down -14. Select your desired frequency. We recommend at least daily +13. Select the script you just created from the drop-down list +14. Select your desired frequency. We recommend running it at least daily. 15. Click **Save Policy** diff --git a/docs/deployment/firefox-deployment.md b/docs/deployment/firefox-deployment.md index 9b9d4d3..0dc23a9 100644 --- a/docs/deployment/firefox-deployment.md +++ b/docs/deployment/firefox-deployment.md @@ -30,23 +30,23 @@ Before deploying Check to Firefox: 1. **Firefox 109 or later** installed on target systems 2. **Administrator/root access** for system-wide deployment -3. **Signed extension package** (.xpi file) for production deployment -4. **Template policies.json** from `enterprise/firefox/policies.json` in the repository +3. **Signed extension package** (`.xpi` file) for production deployment +4. **Template `policies.json`** from `enterprise/firefox/policies.json` in the repository ## Deployment Steps ### 1. Prepare the Extension Package -For production deployment, you need a signed .xpi file: +For production deployment, you need a signed `.xpi` file: #### Option A: Mozilla Add-ons Signing (Recommended) -1. Build the Firefox version: +1. Build the Firefox version: ```bash npm run build:firefox ``` -2. Package the extension: +2. Package the extension: ```bash zip -r check-firefox.zip . \ @@ -65,7 +65,7 @@ For production deployment, you need a signed .xpi file: For testing or development: * Use temporary add-on installation (no signing required) -* Enable unsigned extensions in Firefox developer edition +* Enable unsigned extensions in Firefox Developer Edition * Not recommended for production deployments ### 2. Configure policies.json @@ -135,12 +135,12 @@ Create or modify `policies.json` based on the template in `enterprise/firefox/po **Manual Deployment:** -1. Create the distribution folder if it doesn't exist: +1. Create the distribution folder if it doesn't exist: ```powershell New-Item -ItemType Directory -Force -Path "$env:ProgramFiles\Mozilla Firefox\distribution" ``` -2. Copy your configured `policies.json`: +2. Copy your configured `policies.json`: ```powershell Copy-Item policies.json "$env:ProgramFiles\Mozilla Firefox\distribution\policies.json" @@ -190,17 +190,17 @@ Write-Output "Firefox policies deployed successfully" **Manual Deployment:** -1. Create the distribution folder: +1. Create the distribution folder: ```bash sudo mkdir -p "/Applications/Firefox.app/Contents/Resources/distribution" ``` -2. Copy your configured `policies.json`: +2. Copy your configured `policies.json`: ```bash sudo cp policies.json "/Applications/Firefox.app/Contents/Resources/distribution/policies.json" ``` -3. Set appropriate permissions: +3. Set appropriate permissions: ```bash sudo chmod 644 "/Applications/Firefox.app/Contents/Resources/distribution/policies.json" @@ -246,17 +246,17 @@ Some MDM systems support Firefox configuration profiles. Check your MDM document **System-Wide Deployment:** -1. Create the policies directory: +1. Create the policies directory: ```bash sudo mkdir -p /etc/firefox/policies ``` -2. Copy your configured `policies.json`: +2. Copy your configured `policies.json`: ```bash sudo cp policies.json /etc/firefox/policies/policies.json ``` -3. Set proper permissions: +3. Set proper permissions: ```bash sudo chmod 644 /etc/firefox/policies/policies.json @@ -306,7 +306,7 @@ file { '/etc/firefox/policies/policies.json': ## Configuration Options -All Check configuration options are available through the `3rdparty.Extensions` section of policies.json. +All Check configuration options are available through the `3rdparty.Extensions` section of `policies.json`. ### Security Settings @@ -401,16 +401,16 @@ After deployment, verify policies are applied: ### Verify Extension Installation 1. Navigate to `about:addons` -2. Confirm Check extension is installed +2. Confirm that the Check extension is installed 3. Verify it shows as "Managed by your organization" 4. Check that users cannot disable or remove it (if locked) ### Test Functionality 1. Visit a test phishing site -2. Verify the extension detects and blocks/warns appropriately +2. Verify that the extension detects the site and blocks it or displays an appropriate warning 3. Check the extension popup for status -4. Test branding appears correctly +4. Verify that branding appears correctly ## Updating the Extension @@ -420,7 +420,7 @@ When a new version is released: 1. Build and sign the new version 2. Upload to your distribution server -3. Update the `install_url` in policies.json if the URL changed +3. Update the `install_url` in `policies.json` if the URL changed 4. Firefox will automatically update the extension based on the update manifest ### Force Immediate Update @@ -438,7 +438,7 @@ To force an immediate update: **Check these items:** -1. **File location**: Verify policies.json is in the correct path for your OS +1. **File location**: Verify that `policies.json` is in the correct path for your OS 2. **File permissions**: Must be readable by Firefox (644 recommended) 3. **JSON syntax**: Validate your JSON at jsonlint.com 4. **Firefox restart**: Policies apply on Firefox startup @@ -448,8 +448,8 @@ To force an immediate update: **Common causes:** -1. **Unsigned extension**: Production deployments require signed .xpi -2. **Unreachable URL**: Verify the install\_url is accessible +1. **Unsigned extension**: Production deployments require a signed `.xpi` file +2. **Unreachable URL**: Verify that the `install_url` is accessible 3. **Network restrictions**: Check firewall/proxy settings 4. **Firefox version**: Ensure Firefox 109+ @@ -468,7 +468,7 @@ To force an immediate update: 1. Extension is in the `Locked` array 2. `installation_mode` is set to `force_installed` -3. Policies.json was properly deployed +3. `policies.json` was properly deployed 4. Firefox has been restarted since deployment ## Removal @@ -477,7 +477,7 @@ To remove the Check extension: ### Option 1: Update policies.json -Remove the extension from Install and ExtensionSettings: +Remove the extension from `Install` and `ExtensionSettings`: ```json { @@ -491,7 +491,7 @@ Remove the extension from Install and ExtensionSettings: ### Option 2: Delete policies.json -Remove the entire policies file (will remove all managed extensions and policies). +Removing the entire policies file will remove all managed extensions and policies. ## Best Practices @@ -499,8 +499,8 @@ Remove the entire policies file (will remove all managed extensions and policies 2. **Version Control**: Keep policies.json in version control 3. **Monitor Logs**: Check Firefox logs during initial deployment 4. **Document Changes**: Record configuration changes and reasons -5. **Update Regularly**: Keep the extension updated for latest protections -6. **Validate JSON**: Always validate policies.json syntax before deployment +5. **Update Regularly**: Keep the extension updated for the latest protections +6. **Validate JSON**: Always validate `policies.json` syntax before deployment ## Support Resources diff --git a/docs/features/domain-squatting-detection.md b/docs/features/domain-squatting-detection.md index fae350b..e7ac749 100644 --- a/docs/features/domain-squatting-detection.md +++ b/docs/features/domain-squatting-detection.md @@ -36,9 +36,9 @@ Finds domains using special characters that look similar to normal letters. Identifies domains based on common typing errors and keyboard slip-ups. **Examples Check catches:** -- `micrisoft.com` → finger slipped to nearby key +- `micrisoft.com` → finger slipped to a nearby key - `microssoft.com` → double-typed a letter -- `microosft.com` → typo mixing up letters +- `microosft.com` → transposed letters ### 4. **Suspicious Word Combination Detection** Spots domains that add words before or after legitimate domains to look more official. @@ -49,7 +49,7 @@ Spots domains that add words before or after legitimate domains to look more off - `microsoft-auth.com` - `official-microsoft-support.com` -Common suspicious words attackers use: `login`, `secure`, `verify`, `official`, `support`, `auth`, `signin`, `portal` +Common suspicious words attackers use: `login`, `secure`, `verify`, `official`, `support`, `auth`, `signin`, `portal`. ## What Domains Are Protected? @@ -73,12 +73,12 @@ For example, if you add `https://yourcompany.com/*` to your allowlist, Check wil When you visit a website, Check automatically: -1. **Checks** if the domain looks similar to any protected domain -2. **Analyzes** using all four detection methods +1. **Checks** whether the domain looks similar to any protected domain +2. **Analyzes** the domain using all four detection methods 3. **Warns** you if it finds a suspicious match 4. **Blocks** the page if it's clearly a phishing attempt -You don't need to do anything - the protection works automatically in the background! +You don't need to do anything—the protection works automatically in the background! ## Configuration @@ -156,7 +156,7 @@ Note: Page blocking also requires "Enable Page Blocking" to be turned ON in sett } ``` -You can turn individual detection methods on/off. We recommend keeping all four enabled for maximum protection. +You can turn individual detection methods on or off. We recommend keeping all four enabled for maximum protection. ## For MSPs and Enterprise IT @@ -174,21 +174,22 @@ Domain squatting detection can be managed through Group Policy (GPO) or Microsof - Default protected domains list - Detection rules and patterns -This separation gives you flexibility - you control the core security settings through your detection rules file, while still allowing policy-based customization for different clients or departments. +This separation gives you flexibility: you control the core security settings through your detection rules file while still allowing policy-based customization for different clients or departments. ### Adding Organization-Specific Domains {% hint style="info" %} -**Use the URL Allowlist!** +**Use the URL Allowlist!** The easiest way to protect your organization's domains is to add them to the URL Allowlist in Detection Rules settings. This automatically: + 1. Prevents false positives on your internal sites 2. Protects those domains from squatting attempts 3. Works without modifying detection rules files {% endhint %} **Example:** Adding `https://contoso.com/*` to your allowlist protects against fake domains like: -- `cont0so.com` (zero instead of o) +- `cont0so.com` (zero instead of the letter "o") - `contos0.com` (zero at the end) - `login-contoso.com` (suspicious prefix) @@ -222,7 +223,7 @@ Domain squatting detection works alongside Check's other phishing protections. I ### "Settings are grayed out" -If you can't see or change domain squatting settings, your IT department has configured these centrally. This is normal for managed deployments - contact your IT team if you need adjustments. +If you can't see or change domain squatting settings, your IT department has configured these centrally. This is normal for managed deployments—contact your IT team if you need adjustments. ## Related Documentation diff --git a/docs/firefox-support.md b/docs/firefox-support.md index b74c482..e311c72 100644 --- a/docs/firefox-support.md +++ b/docs/firefox-support.md @@ -69,13 +69,13 @@ Firefox supports enterprise deployment through the `policies.json` file. This me #### Windows Deployment -1. Create or edit the policies file at: +1. Create or edit the policies file at: ``` %ProgramFiles%\Mozilla Firefox\distribution\policies.json ``` 2. Use the template from `enterprise/firefox/policies.json` in the repository -3. Update the `install_url` to point to your signed .xpi file: +3. Update the `install_url` to point to your signed `.xpi` file: ```json { @@ -93,7 +93,7 @@ Firefox supports enterprise deployment through the `policies.json` file. This me * **macOS**: `/Applications/Firefox.app/Contents/Resources/distribution/policies.json` * **Linux**: `/etc/firefox/policies/policies.json` or `/usr/lib/firefox/distribution/policies.json` 2. Use the template from `enterprise/firefox/policies.json` -3. Set proper permissions: +3. Set proper permissions: ```bash sudo chmod 644 /path/to/policies.json @@ -187,21 +187,21 @@ Disabling signature verification is only recommended for development and testing For production deployment, you need to sign the extension with Mozilla: 1. Create a Mozilla Add-ons account at [addons.mozilla.org](https://addons.mozilla.org) -2. Package your extension: +2. Package your extension: ```bash npm run build:firefox zip -r check-firefox.zip . -x ".*" "node_modules/*" "tests/*" "*.md" "manifest.chrome.json" ``` 3. Submit to Mozilla for signing (unlisted distribution for enterprise) -4. Download the signed .xpi file -5. Host the .xpi file on your server or use Mozilla's CDN +4. Download the signed `.xpi` file +5. Host the `.xpi` file on your server or use Mozilla's CDN ### Self-Distribution -For enterprise environments, you can self-distribute the signed .xpi: +For enterprise environments, you can self-distribute the signed `.xpi` file: -1. Host the .xpi file on an internal web server +1. Host the `.xpi` file on an internal web server 2. Configure `policies.json` with your internal URL 3. Deploy the policies file to managed devices @@ -227,13 +227,13 @@ For enterprise environments, you can self-distribute the signed .xpi: When contributing or making changes, always test in both Chrome/Edge and Firefox: -1. Test in Chrome/Edge: +1. Test in Chrome/Edge: ```bash npm run build:chrome # Load in Chrome ``` -2. Test in Firefox: +2. Test in Firefox: ```bash npm run build:firefox @@ -261,7 +261,7 @@ When contributing or making changes, always test in both Chrome/Edge and Firefox **Solutions**: -* Firefox uses `background.scripts` not `service_worker` +* Firefox uses `background.scripts`, not `service_worker` * Verify the build script ran successfully * Check for module loading errors in the Browser Console @@ -271,11 +271,11 @@ When contributing or making changes, always test in both Chrome/Edge and Firefox **Solutions**: -* Verify policies.json is in the correct location for your OS +* Verify that `policies.json` is in the correct location for your OS * Check file permissions (must be readable by Firefox) -* Restart Firefox after adding/modifying policies +* Restart Firefox after adding or modifying policies * Use `about:policies` to verify policy application -* Check JSON syntax in policies.json +* Check the JSON syntax in `policies.json` ### Extension Removed on Restart @@ -283,8 +283,8 @@ When contributing or making changes, always test in both Chrome/Edge and Firefox **Solutions**: -* Temporary add-ons are removed on restart - this is expected -* For permanent installation, use enterprise deployment with signed .xpi +* Temporary add-ons are removed on restart—this is expected +* For permanent installation, use enterprise deployment with a signed `.xpi` file * Alternatively, sign the extension through Mozilla's process ### Content Scripts Not Injecting @@ -293,9 +293,9 @@ When contributing or making changes, always test in both Chrome/Edge and Firefox **Solutions**: -* Firefox doesn't support `file:///` protocol in content scripts +* Firefox doesn't support the `file:///` protocol in content scripts * Ensure you're testing on `http://` or `https://` URLs -* Check content script permissions in manifest +* Check the content script permissions in the manifest ## Firefox Extension ID diff --git a/docs/removal/windows/chrome-edge.md b/docs/removal/windows/chrome-edge.md index 674428e..bacbbdb 100644 --- a/docs/removal/windows/chrome-edge.md +++ b/docs/removal/windows/chrome-edge.md @@ -7,7 +7,7 @@ This removes all extension-specific policy values created during deployment for ## Uninstall Script 1. Run the script as Administrator on the target endpoint. -2. Use this when testing policy changes and you want a clean baseline before re-deploying. -3. After running, restart Chrome and Edge to ensure policy refresh. +2. Use the script when testing policy changes and you want a clean baseline before redeploying. +3. After running the script, restart Chrome and Edge to ensure that their policies refresh. Download the Uninstall Script from GitHub diff --git a/docs/settings/about.md b/docs/settings/about.md index 1651eee..d5c1458 100644 --- a/docs/settings/about.md +++ b/docs/settings/about.md @@ -37,7 +37,7 @@ The About section provides quick access to essential resources: ### Extension Stores * [**Chrome Web Store**](https://chromewebstore.google.com/detail/benimdeioplgkhanklclahllklceahbe) - Download, rate, and review the extension for Chrome and Chromium-based browsers -* [**Edge Add Ons Store**](https://microsoftedge.microsoft.com/addons/detail/check-by-cyberdrain/knepjpocdagponkonnbggpcnhnaikajg) - Download and rate the extension for Microsoft Edge +* [**Microsoft Edge Add-ons**](https://microsoftedge.microsoft.com/addons/detail/check-by-cyberdrain/knepjpocdagponkonnbggpcnhnaikajg) - Download and rate the extension for Microsoft Edge * Firefox Add-Ons - Coming soon! ### Development and Support diff --git a/docs/settings/activity-logs.md b/docs/settings/activity-logs.md index fbd606c..ecaae1d 100644 --- a/docs/settings/activity-logs.md +++ b/docs/settings/activity-logs.md @@ -22,7 +22,7 @@ Enables additional console logging visible in the browser's Developer Tools. Thi ### **Simulate Enterprise Policy Mode (Dev Only)** -This development-only feature simulates how the extension behaves when managed by enterprise policies. Useful for administrators testing policy deployments or understanding the end-user experience under policy management. +This development-only feature simulates how the extension behaves when managed by enterprise policies. It is useful for administrators testing policy deployments or understanding the end-user experience under policy management. ## Log Filtering and Management @@ -54,17 +54,17 @@ When you open the Activity Logs section, you'll see a table with recent activity - **Action Taken** - What Check did about it - **Details** - A summary of what happened -Additionally, clicking on a row will allow you to review detailed information on the event and the criteria used to make the threat level determination. +Additionally, clicking a row allows you to review detailed information about the event and the criteria used to determine the threat level. {% hint style="info" %} -By default, Check only logs blocked pages. If you want to show valid login pages, check `Enable Debug Logging.` +By default, Check only logs blocked pages. If you want to show valid login pages, check `Enable Debug Logging`. {% endhint %} ### Understanding Common Log Entries **"Page Scanned" with Threat Level "None"** -- This is normal - Check scanned a page and found it safe +- This is normal—Check scanned a page and found it safe - You'll see lots of these for legitimate websites **"Threat Blocked" with Threat Level "High"** @@ -88,7 +88,15 @@ If you think something suspicious happened: **Example Investigation:** -You tried to log into Office 365 but got blocked. Looking at logs:​Timestamp: 2024-01-15 14:30:22Event Type: Threat BlockedURL: office365-login-secure.com (suspicious domain)Threat Level: HighDetails: Phishing page impersonating Microsoft loginThis shows Check correctly blocked a fake Office 365 page. +You tried to log in to Office 365 but were blocked. The logs show: + +* **Timestamp:** 2024-01-15 14:30:22 +* **Event Type:** Threat Blocked +* **URL:** office365-login-secure.com (suspicious domain) +* **Threat Level:** High +* **Details:** Phishing page impersonating Microsoft login + +This shows that Check correctly blocked a fake Office 365 page. ### Configuring Log Detail Level @@ -106,10 +114,10 @@ You tried to log into Office 365 but got blocked. Looking at logs:​Timestamp: 4. Send logs to support (see [Common Issues](../troubleshooting/common-issues.md) for additional troubleshooting steps) 5. Uncheck debug logging when done (saves storage space) -**For admins wanting to simulate end-user experience** +**For admins wanting to simulate the end-user experience:** 1. Click "Simulate Enterprise Policy Mode (Dev Only)" -2. Review behavior, investigate setting, grab screenshots for documentation, etc. +2. Review behavior, investigate settings, and capture screenshots for documentation 3. Uncheck the setting when done and refresh the page to return to normal operations ### Managing Your Log Data diff --git a/docs/settings/branding.md b/docs/settings/branding.md index 9ba3fed..0bf45f2 100644 --- a/docs/settings/branding.md +++ b/docs/settings/branding.md @@ -1,6 +1,6 @@ # Branding -The Branding section lets you customize how Check looks, especially useful for organizations that want consistent branding. +The Branding section lets you customize how Check looks. This is especially useful for organizations that want consistent branding. {% hint style="info" %} **For individual users** @@ -22,7 +22,7 @@ All user-facing components (suspicious login banner, blocked page, extension pop {% hint style="warning" %} **What if Settings Are Not Visible?** -If some settings do not appear on your version, it means your organization's IT department has set these for you. This is normal in business environments - your IT team wants to make sure everyone has the same security settings. You will also see text indicating that the extension is being managed by policy. +If some settings do not appear in your version, it means your organization's IT department has set them for you. This is normal in business environments—your IT team wants to make sure everyone has the same security settings. You will also see text indicating that the extension is being managed by policy. {% endhint %} ### Branding Properties @@ -31,7 +31,7 @@ You can customize the following properties: 1. **Company Name** - Enter your organization's name. This appears in the extension interface and blocked page messages (displayed as "Protected by \[Company Name]"). 2. **Product Name** - What you want to call the extension (like "Contoso Security" instead of "Check"). This replaces the default "Check" branding throughout the interface. -3. **Support Email** - Where users should go for help. This email address is used in the "Contact Admin" button when phishing sites are blocked. +3. **Support Email** - The email address users should contact for help. This address is used by the "Contact Admin" button when phishing sites are blocked. 4. **Support URL** - URL opened by the popup **Support** link (for example, `https://support.yourcompany.com`). 5. **Privacy Policy URL** (`privacyPolicyUrl`) - URL opened by the popup **Privacy** link (for example, `https://yourcompany.com/privacy`). 6. **About URL** (`aboutUrl`) - URL opened by the popup **About** link. Leave empty to use the built-in extension About page. @@ -67,7 +67,7 @@ The branding preview shows you exactly how your customizations will appear to us * About URL 4. Click "Save" -Your branding will be immediately applied to all components. +Your branding will be applied immediately to all components. ### Method 2: Group Policy (GPO) - Chrome & Edge @@ -131,11 +131,11 @@ For Firefox deployments, configure branding through the `policies.json` file: 3. Save the file and restart Firefox -**Note:** The Firefox extension ID is `check@cyberdrain.com` +**Note:** The Firefox extension ID is `check@cyberdrain.com`. ### Method 4: Microsoft Intune - Chrome & Edge -For organizations using Microsoft Intune with Chrome/Edge: +For organizations using Microsoft Intune for Chrome and Edge: 1. Create a new Configuration Profile 2. Select "Custom" configuration @@ -156,7 +156,7 @@ For organizations using Microsoft Intune with Chrome/Edge: ``` 4. Assign the profile to user or device groups -5. Branding will be applied on enrolled devices +5. Branding will be applied to enrolled devices ### Method 5: Chrome Enterprise Policy @@ -200,12 +200,12 @@ Enterprise policies always take precedence over manual settings. * Use a square logo for best results * Ensure it looks good on both light and dark backgrounds -* Keep it simple - small logos need to be clear +* Keep it simple—small logos need to be clear ### **Common logo hosting options:** * Your company website: `https://yourcompany.com/logo.png` -* Cloud storage: Upload to Google Drive, Dropbox, etc. and get a public link +* Cloud storage: Upload to Google Drive, Dropbox, etc., and get a public link * Image hosting: Use services like Imgur or similar ## Browser-Specific Notes @@ -213,12 +213,12 @@ Enterprise policies always take precedence over manual settings. ### Firefox * Uses extension ID: `check@cyberdrain.com` -* Configuration is managed through `policies.json` file +* Configuration is managed through the `policies.json` file * Policies file location varies by operating system ### Chrome & Edge -* Configuration through GPO, Intune, or Chrome Enterprise Policy +* Configuration is available through GPO, Intune, or Chrome Enterprise Policy * Uses Windows Registry for advanced configurations * Supports standard Chrome extension policy format @@ -230,8 +230,8 @@ Enterprise policies always take precedence over manual settings. 2. Try opening the logo URL in a new browser tab 3. Make sure the URL starts with `https://` 4. Verify the image file isn't too large -5. Verify logo URLs are publicly accessible (if using external URL) -6. Check image format (PNG, JPG, SVG supported) +5. Verify that logo URLs are publicly accessible (if using an external URL) +6. Check the image format (PNG, JPG, and SVG are supported) 7. Ensure image size is reasonable ### **Colors not applying:** diff --git a/docs/settings/detection-rules.md b/docs/settings/detection-rules.md index 1babb7b..128dc4a 100644 --- a/docs/settings/detection-rules.md +++ b/docs/settings/detection-rules.md @@ -1,10 +1,10 @@ # Detection Rules -This section controls how Check recognizes and responds to phishing threats. Most users can leave these at default settings, but here's how to manage them. +This section controls how Check recognizes and responds to phishing threats. Most users can leave these at their default settings, but here's how to manage them. ## Understanding How Detection Works -Check uses a constantly updated list of rules to identify fake Microsoft login pages. Think of it like antivirus definitions - they need to be kept current to protect against new threats. +Check uses a constantly updated list of rules to identify fake Microsoft login pages. Think of them like antivirus definitions—they need to be kept current to protect against new threats. ## Detection Configuration @@ -21,13 +21,13 @@ This field allows you to specify a custom URL for fetching detection rules. Leav **For organizations with custom security rules:** 1. Enter your organization's custom rules URL (provided by IT) -2. Custom rules, including allow lists, can be created using [creating-detection-rules.md](../advanced/creating-detection-rules.md "mention"). +2. Custom rules, including allowlists, can be created using the [Creating Detection Rules](../advanced/creating-detection-rules.md "mention") guide. ### **Update Interval (hours)** -Controls how often Check fetches updated detection rules. The default is 24 hours. Set update interval based on your security requirements: +Controls how often Check fetches updated detection rules. The default is 24 hours. Set the update interval based on your security requirements: -* High security environments: 6-12 hours +* High-security environments: 6-12 hours * Standard environments: 24 hours * Limited bandwidth: 48-72 hours @@ -42,14 +42,15 @@ MSPs and IT departments commonly need to exclude phishing training platforms (li Add URLs or patterns that should be excluded from phishing detection. This is useful for internal company sites or trusted third-party services that might trigger false positives. **Dual Protection:** Your allowlist serves two purposes: -1. **Prevents false positives** - Sites you add won't be flagged as phishing -2. **Domain squatting protection** - Domains extracted from your allowlist are automatically protected against typosquatting and look-alike attacks + +1. **Prevents false positives**—Sites you add won't be flagged as phishing +2. **Domain squatting protection**—Domains extracted from your allowlist are automatically protected against typosquatting and look-alike attacks For example, adding `https://yourcompany.com/*` will both allow that site AND protect against fake domains like `yourcompany.net`, `your-company.com`, or `y0urcompany.com`. Learn more about [Domain Squatting Detection](../features/domain-squatting-detection.md). -**How it works:** Your allowlist patterns are **added to** (not replacing) the default CyberDrain exclusions, providing additional protection without losing baseline coverage. +**How it works:** Your allowlist patterns **supplement rather than replace** the default CyberDrain exclusions, providing additional protection without losing baseline coverage. You can use: @@ -76,9 +77,9 @@ Sometimes you need to update rules immediately: 1. **When to do this:** * You've heard about a new phishing campaign * Check isn't detecting a threat it should - * Your IT department asks you to update + * Your IT department asks you to update them 2. **How to do it:** - * Go to Detection Rules section + * Go to the Detection Rules section * Click "Update Rules Now" * Wait for the "Rules updated successfully" message @@ -91,7 +92,7 @@ The Configuration Overview section displays your current detection rules in two * **Version number** - Higher numbers are newer * **Last Updated** - Should be recent (within your update interval) * **Total Rules** - More rules generally mean better protection -* **Rule Categories** - Shows breakdown by rule type (exclusions, indicators, etc.) +* **Rule Categories** - Shows a breakdown by rule type (exclusions, indicators, etc.) **Raw JSON View:** @@ -108,7 +109,7 @@ The Configuration Overview section displays your current detection rules in two {% hint style="warning" %} #### What if Settings Are Not Visible? -If some settings do not appear in your version, it means your organization's IT department has set these for you. This is normal in business environments - your IT team wants to make sure everyone has the same security settings. You will also see text indicating that the extension is being managed by policy. +If some settings do not appear in your version, it means your organization's IT department has set them for you. This is normal in business environments—your IT team wants to make sure everyone has the same security settings. You will also see text indicating that the extension is being managed by policy. {% endhint %} ## Troubleshooting Rule Updates @@ -117,7 +118,7 @@ If some settings do not appear in your version, it means your organization's IT 1. Check your internet connection 2. Try clicking "Update Rules Now" again -3. If using custom rules URL, verify the URL is correct +3. If using a custom rules URL, verify that the URL is correct 4. Contact your IT department if the problem persists ### **Problem: Extension seems slow after rule update** @@ -129,35 +130,35 @@ If some settings do not appear in your version, it means your organization's IT ## Using the Rule Playground {% hint style="warning" %} -Note that the Rule Playground is in Beta. Some limitations exist around how the rule playground can handle more complex detection filters so results may not be identical to the extension's behavior. +Note that the Rule Playground is in beta. Some limitations affect how it handles more complex detection filters, so results may not be identical to the extension's behavior. {% endhint %} The rule playground is your chance to prototype and test detection rules locally. ### Setting Up Candidate Rules -There are two options for how to build out your candidate rules: +There are two ways to build your candidate rules: -1. You can use the `Load Current` button to pull in the configured detection rules for the browser. You can test as is or add/edit the rules JSON until you have the candidate rules you want to test. -2. Create a fully custom candidate ruleset. These should be array. See the format of the default rule detection set for the structure of the data. +1. You can use the `Load Current` button to pull in the configured detection rules for the browser. You can test them as-is or add or edit the rules JSON until you have the candidate rules you want to test. +2. Create a fully custom candidate ruleset. This should be an array. See the format of the default detection rule set for the data structure. -Once created, you have additional tools to review your JSON. +Once created, you have additional tools to review your JSON. * [**Validate**](detection-rules.md#understanding-the-validation-tool) * [**Sanitize**](detection-rules.md#understanding-the-sanitize-tool) -* **Copy**: Copies the current JSON to your clipboard. This will allow you to paste it into the editor of your choice or use in creating a pull request to GitHub if you are contributing back to the source code. +* **Copy**: Copies the current JSON to your clipboard. This allows you to paste it into the editor of your choice or use it to create a pull request on GitHub if you are contributing back to the source code. #### Understanding the Validation Tool What it checks: 1. JSON validity - * Tries to parse the text. If parsing fails shows “Invalid JSON: \” and stops. + * Tries to parse the text. If parsing fails, it shows “Invalid JSON: \” and stops. 2. Overall shape (must be ONE of): * An array of rule objects * An object with a rules array (parsed.rules) * A single rule object that has both id and type - * If none match it will issue “JSON does not look like rule(s) array or object with 'rules'.” + * If none match, it will issue “JSON does not look like rule(s) array or object with 'rules'.” 3. For each rule it inspects ONLY these fields: * id: Missing → issue “Rule missing 'id'” * type: Missing → issue “Rule \ missing 'type'” @@ -181,26 +182,26 @@ What Validate does NOT do What Sanitize actually “fixes” -* Only whitespace / indentation / line structure, +* Only whitespace, indentation, and line structure. What Sanitize does NOT change * Field names, values, types * Order of object properties beyond natural JS enumeration * Array ordering -* Missing required fields (id/type etc.) +* Missing required fields (`id`, `type`, etc.) * Invalid logic or patterns * It does not validate anything beyond being parseable JSON ### Testing Your Rules -Once you have your candidate rules, you can test your rule set by providing a test URL and sample HTML from that site. It's required to copy the HTML from the site since the tool will not fetch that live. The URL is needed for the rule set evaluation. Once you have the test URL and sample HTML, hit `Test Rules`. If you need to start fresh on your test, you can hit `Clear`. +Once you have your candidate rules, you can test your ruleset by providing a test URL and sample HTML from that site. You must copy the HTML because the tool will not fetch it from the live site. The URL is needed for the ruleset evaluation. Once you have the test URL and sample HTML, select `Test Rules`. To start a fresh test, select `Clear`. ### Reading the Test Results Below the `Test Rules` button, you will see the output of your candidate rule set with the test URL and sample HTML. -* **Decision & Summary**: This will provide you with a high-level overview of the result of the test including the decision to allow, warn, or block. -* **Threats**: This will outline the rules that identified threats in the sample HTML along with a snippet of the HTML that resulted in the detection. -* **Unsupported Features**: An outline of the features that the playground was unable to check due to the more complex nature of those filters. +* **Decision & Summary**: This provides a high-level overview of the test result, including the decision to allow, warn, or block. +* **Threats**: This outlines the rules that identified threats in the sample HTML, along with a snippet of the HTML that triggered the detection. +* **Unsupported Features**: This outlines the features that the playground was unable to check because of the complexity of those filters. * **Raw JSON**: This will allow you to view the raw output of the playground's evaluation of the sample HTML. diff --git a/docs/settings/general.md b/docs/settings/general.md index 59f682e..47f84c0 100644 --- a/docs/settings/general.md +++ b/docs/settings/general.md @@ -8,11 +8,11 @@ description: This is where you control the main features of Check. ### **Enable Page Blocking** -This is Check's main job - blocking dangerous websites. When this is turned on (which we recommend), Check will stop you from visiting fake Microsoft login pages and show you a warning instead. There are times you need to disable the checkbox for testing purposes. Removing this checkbox removes most of your protection so it's recommended to leave this setting enabled. +This is Check's main job—blocking dangerous websites. When this setting is enabled, which we recommend, Check will stop you from visiting fake Microsoft login pages and show you a warning instead. You may need to disable it temporarily for testing. Disabling page blocking removes most of your protection, so we recommend leaving this setting enabled. ### Enable CIPP Reporting -CIPP is a system that IT professionals use to monitor security across multiple organizations. Enabling CIPP monitoring allows you to send detection information from Check directly to CIPP, thus allowing you to alert and report on what's happening with your endpoints. When enabled, you would configure the CIPP Server URL and Tenant ID/Domain below. +CIPP is a system that IT professionals use to monitor security across multiple organizations. Enabling CIPP monitoring allows you to send detection information from Check directly to CIPP, allowing you to alert and report on what's happening with your endpoints. When enabled, configure the CIPP Server URL and Tenant ID/Domain below. View CIPP reporting activity in the [Activity Logs](activity-logs.md) section. @@ -56,7 +56,7 @@ Your webhook endpoint will receive a POST request with `Content-Type: applicatio - `platform` - Operating system (e.g., "Linux x86_64", "Win32", "MacIntel") - `language` - Browser language setting (e.g., "en-US") - `vendor` - Browser vendor (e.g., "Google Inc.") -- `cookiesEnabled` - Boolean indicating if cookies are enabled +- `cookiesEnabled` - Boolean indicating whether cookies are enabled - `onLine` - Boolean indicating network connectivity status **screenResolution object:** @@ -68,14 +68,14 @@ Your webhook endpoint will receive a POST request with `Content-Type: applicatio **detectionDetails object:** - `url` - Original URL (non-defanged) -- `score` - Legitimacy score assigned by detection engine +- `score` - Legitimacy score assigned by the detection engine - `threshold` - Threshold value that triggered the block - `reason` - Detailed technical reason for blocking - `pageTitle` - Title of the blocked page - `timestamp` - When the page was blocked - `threats` - Array of threat objects with `id`, `type`, `description`, and `severity` - `phishingIndicators` - Array of specific indicators that triggered detection -- Additional fields depending on detection method used +- Additional fields depending on the detection method used #### Complete Payload Example @@ -147,6 +147,7 @@ Your webhook endpoint will receive a POST request with `Content-Type: applicatio #### Webhook Requirements Your webhook endpoint should: + 1. Accept POST requests with `Content-Type: application/json` 2. Respond with HTTP status codes: - `200 OK` - Report successfully received @@ -165,7 +166,7 @@ Your webhook endpoint should: ### **Show Notifications** -When Check blocks a dangerous website or finds something suspicious, it can show you a small popup message to let you know what's going on. We recommend leaving this setting enabled +When Check blocks a dangerous website or finds something suspicious, it can show you a small popup message to let you know what's going on. We recommend leaving this setting enabled. ### **Show Valid Page Badge** @@ -173,7 +174,7 @@ This adds a small green checkmark to real Microsoft login pages. This feature is ### **Valid Page Badge Timeout** -This setting controls how long the "Verified Microsoft Domain" badge stays visible on legitimate Microsoft login pages before automatically dismissing. +This setting controls how long the "Verified Microsoft Domain" badge stays visible on legitimate Microsoft login pages before it is automatically dismissed. - **Set to 0**: Badge stays visible until you manually dismiss it (no timeout) - **Set to 1-300 seconds**: Badge automatically disappears after the specified number of seconds @@ -184,5 +185,5 @@ This allows you to customize the badge experience based on your preferences. If {% hint style="warning" %} #### What if Settings Are Not Visible? -If some settings do not appear on my version, it means your organization's IT department has set these for you. This is normal in business environments - your IT team wants to make sure everyone has the same security settings. You will also see text indicating that the extension is being managed by policy. +If some settings do not appear in your version, it means your organization's IT department has set them for you. This is normal in business environments—your IT team wants to make sure everyone has the same security settings. You will also see text indicating that the extension is being managed by policy. {% endhint %} diff --git a/docs/troubleshooting/common-issues.md b/docs/troubleshooting/common-issues.md index 94dee7b..b21961b 100644 --- a/docs/troubleshooting/common-issues.md +++ b/docs/troubleshooting/common-issues.md @@ -4,10 +4,9 @@ Policies not appearing in Group Policy Management Console -- Verify ADMX/ADML files are in correct location (see [Windows deployment docs](../deployment/chrome-edge-deployment-instructions/windows/README.md)) - -* Ensure files are not blocked (right-click > Properties > Unblock) -* Refresh Group Policy Editor +- Verify that the ADMX/ADML files are in the correct location (see [Windows deployment docs](../deployment/chrome-edge-deployment-instructions/windows/README.md)) +- Ensure that the files are not blocked (right-click > Properties > Unblock) +- Refresh Group Policy Editor For complete deployment instructions, see [Domain Deployment guide](../deployment/chrome-edge-deployment-instructions/windows/domain-deployment.md). @@ -17,9 +16,9 @@ For complete deployment instructions, see [Domain Deployment guide](../deploymen Policies not applying to extension -- Check registry values are present (see [Manual Deployment guide](../deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md)) -- Restart browser after policy changes -- Verify extension has necessary permissions +- Check that the registry values are present (see [Manual Deployment guide](../deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md)) +- Restart the browser after policy changes +- Verify that the extension has the necessary permissions For troubleshooting policy deployment, consult the [Windows deployment documentation](../deployment/chrome-edge-deployment-instructions/windows/README.md). @@ -30,7 +29,7 @@ For troubleshooting policy deployment, consult the [Windows deployment documenta Custom branding not working - Verify URLs are accessible via HTTPS -- Check image formats are supported (PNG, JPG, SVG) -- Ensure color codes are valid hex format +- Check that the image format is supported (PNG, JPG, or SVG) +- Ensure that color codes use a valid hexadecimal format diff --git a/docs/troubleshooting/testing-check.md b/docs/troubleshooting/testing-check.md index 2643fb7..e8abfb0 100644 --- a/docs/troubleshooting/testing-check.md +++ b/docs/troubleshooting/testing-check.md @@ -3,7 +3,7 @@ Whether you are contributing to the Check repo, developing your own detection rules, or just want to see Check in action, the easiest way is to spin up Evilginx locally on your own hardware. {% hint style="danger" %} -We greatly caution against sharing phishing links. There is a security risk with client-side code being run from some phish kits in circulation. +We strongly caution against sharing phishing links because some phishing kits in circulation run potentially malicious client-side code. {% endhint %} Instructions for how to spin up Evilginx 3.0 can be found via [this blog post from Jan Bakker](https://janbakker.tech/running-evilginx-3-0-on-windows/).