TLDR Tech / InfoSec
CanaryHunter
A PowerShell module aimed at red teamers that scans an environment for Thinkst Canary tokens before they fire, detecting tokens embedded in Docx, Xlsx, and PDF files, Windows SilentProcessExit registry entries, and AWS, WireGuard, Kube, and MySQL dump configs by regex-matching known canarytokens.org domains and IP addresses. It also ships an Invoke-BlockCanaries function that creates an outbound firewall rule against known canary IPs, so operators should confirm that their engagement rules permit suppressing defender telemetry before using it.
Read the full story