SharePointSecurityMonitor — A comprehensive PowerShell-based SharePoint security monitoring solution with CVE-2025-53770 protection, advanced DLL analysis, threat detection, and automated alerting capabilities. | Kitploit
Tools / GitHub / paolokappa / sharepointsecuritymonitor
paolokappa/sharepointsecuritymonitor
SharePointSecurityMonitor A comprehensive PowerShell-based SharePoint security monitoring solution with CVE-2025-53770 protection, advanced DLL analysis, threat detection, and automated alerting capabilities.
Discover the most used tools by our community.
Last 7 Days Last 30 Days
🛡️ SharePoint Security Monitor v5.0
🚀 A comprehensive PowerShell-based SharePoint security monitoring solution with CVE-2023-29357 and CVE-2023-33157 protection, intelligent DLL management, advanced threat detection, and automated alerting capabilities.
📋 Table of Contents
🌟 Project Overview The original 5,519-line PowerShell script has been enhanced into a high-performance security monitoring solution while maintaining the PowerShell ecosystem. Although still a single script, it incorporates significant improvements in modularity and functionality.
✨ Key Features
🛡️ Security Features
🔍 CVE-Specific Protection : Dedicated detection for CVE-2023-29357 and CVE-2023-33157🧬 Intelligent DLL Management : Auto-approval system with pending review queue🎯 Real-time Threat Detection : Advanced threat actor identification and tracking📊 Comprehensive Attack Tracking : Unified attack timeline with 20+ attack types🔐 LSASS Memory Protection : Detection of credential theft attempts�️ Defender Tampering Detection : Monitoring for security software disabling📋 GPO Monitoring : Detection of suspicious Group Policy modifications🔄 Reflective DLL Injection Detection : Advanced memory injection detection🚨 Ransomware Detection : Multiple ransomware family identification🌐 C2 Communication Detection : Known C2 domains and IPs monitoring
🏗️ Architecture Features
📦 Enhanced Architecture : Single optimized script with modular functions⚡ Performance Optimized : Incremental log reading with smart bookmarks🔄 Event Caching : Efficient duplicate event filtering💾 Smart Caching : Daily cache files with automatic cleanup📊 Baseline Management : DLL and file integrity baseline systems🔒 Multi-Layer Security : ESET and Microsoft Defender compatibility
📢 Monitoring & Alerting
📧 Smart Email Alerting : Configurable alerts with -NoAlertOnWarnings option📈 Enhanced HTML Reports : Comprehensive attack timeline and statistics⚙️ Scheduled Task Management : Automated hourly, daily, and startup scans🔐 Detailed Attack Analysis : IP-based threat actor identification📊 Performance Metrics : Execution time tracking and cache hit rates🎯 Pending DLL Management : Review and approval workflow for DLLs
🏗️ Solution Architecture
🔧 Core Components
1️⃣ SharePoint-Security-Monitor.ps1 (Main Script)
🎯 Modular entry point with comprehensive parameter support
🛡️ Error handling and recovery mechanisms
📊 Progress reporting and execution time tracking
⚡ Support for quick scans, baseline creation, and task management
2️⃣ Core Functionality (Integrated Functions)
📝 Advanced Logging : Performance tracking with timer functions
🔬 DLL Analysis : Intelligent Test-SuspiciousDLL with auto-approval
🎯 Threat Detection : Real-time pattern matching and correlation
⚙️ Configuration : JSON-based configuration with secure handling
📊 Report Generation : Comprehensive HTML reports with attack timeline
3️⃣ Configuration System
📋 SharePointSecurityConfig.json : Production-ready configuration
🌍 Environment-specific overrides (Development, Testing, Production)
🔐 Secure credential handling with encryption support
4️⃣ Demonstration and Setup
🎮 Demo-EnhancedScript.ps1 : Interactive demonstration script
📊 Sample data structure creation
✅ Module verification and testing capabilities
🚀 Quick Start Guide
📌 Basic Usage # Standard security scan with email on alerts/warnings
.\SharePoint-Security-Monitor.ps1
# Standard scan with custom max days
.\SharePoint-Security-Monitor.ps1 -MaxDaysToScan 7
🎯 Common Operations # ⚡ Quick scan (last 12 hours)
.\SharePoint-Security-Monitor.ps1 -QuickScan
# 📐 Create DLL baseline
.\SharePoint-Security-Monitor.ps1 -CreateBaseline
# 👁️ Review and approve pending DLLs
.\SharePoint-Security-Monitor.ps1 -ReviewPendingDLLs
# 🤖 Auto-approve legitimate DLLs
.\SharePoint-Security-Monitor.ps1 -AutoApproveDLLs
# 🔍 Check SharePoint file integrity
.\SharePoint-Security-Monitor.ps1 -CheckIntegrity
# 📧 Force email alert
.\SharePoint-Security-Monitor.ps1 -ForceAlert
# 📊 Always send report regardless of findings
.\SharePoint-Security-Monitor.ps1 -AlwaysSendReport
# 🔕 Only alert on critical issues (not warnings)
.\SharePoint-Security-Monitor.ps1 -NoAlertOnWarnings
# 🗓️ Full historical scan (30 days)
.\SharePoint-Security-Monitor.ps1 -FullHistoricalScan
# 🔄 Reset log reading bookmarks
.\SharePoint-Security-Monitor.ps1 -ResetBookmarks
# 🗑️ Clear event cache
.\SharePoint-Security-Monitor.ps1 -ClearCache
# ⚙️ Manage scheduled tasks
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Install
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Status
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Remove
# 🚫 Disable event caching for debugging
.\SharePoint-Security-Monitor.ps1 -DisableEventCache
# 📏 Process larger log files (default 250MB)
.\SharePoint-Security-Monitor.ps1 -MaxLogSizeMB 500
# ✅ Auto-approve legitimate DLLs
.\SharePoint-Security-Monitor.ps1 -AutoApproveDLLs
📅 Task Management # 📥 Install scheduled tasks
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Install
# 📊 Check task status
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Status
# 🗑️ Remove scheduled tasks
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Remove
🔬 Advanced Features # 🔍 Verbose DLL analysis with auto-approval
.\SharePoint-Security-Monitor.ps1 -VerboseDLL -AutoApproveDLLs
# 🧹 Clear caches and reset bookmarks
.\SharePoint-Security-Monitor.ps1 -ClearCache -ResetBookmarks
📁 File Structure 📂 SharePoint Security Monitor/
├── 📄 SharePoint-Security-Monitor.ps1 # Main monitoring script
├── 🎮 Demo-EnhancedScript.ps1 # Demonstration script
├── ⚙️ SharePointSecurityConfig.json # Configuration file
├── 📋 README.md # Documentation
├── 📄 changelog-file.md # Version history
└── 📋 contributing-guide.md # Contribution guidelines
📂 Runtime Directories (auto-created)
├── Logs/ # Security logs
│ └── SecurityMonitor_YYYYMMDD.log # Daily log files
├── Reports/ # HTML reports
│ └── SecurityReport_YYYYMMDD_HHMMSS.html # Timestamped reports
├── Baselines/ # Baseline data
│ ├── DLL_Baseline.json # DLL inventory baseline
│ ├── SharePoint_Integrity.json # File integrity baseline
│ ├── PendingDLLApproval.json # DLLs awaiting approval
│ └── ApprovedDLLs.json # Whitelisted DLLs
├── Bookmarks/ # Log reading positions
│ └── LogReadingBookmarks.json # Incremental read tracking
└── Cache/ # Event processing cache
└── ProcessedEvents_YYYYMMDD.json # Daily event cache
🆕 What's New in Version 5.0
🛡️ Enhanced Security Detection
🔍 Real CVE Protection : Updated to detect CVE-2023-29357 and CVE-2023-33157 (real vulnerabilities)🎯 Advanced Threat Actor Tracking : Identifies known APT groups and ransomware operators🔐 Credential Theft Detection : LSASS memory access monitoring with intelligent process filtering🛡️ Security Software Monitoring : Detects Microsoft Defender and GPO tampering💉 Reflective DLL Injection Detection : Monitors CreateRemoteThread events🏷️ Comprehensive Attack Tracking : Unified timeline of all security events
🧬 Intelligent DLL Management
🤖 Auto-Approval System : Automatically approves legitimate Microsoft-signed DLLs📋 Pending Review Queue : DLLs requiring manual review are queued for approval✅ SharePoint Component Recognition : Smart detection of legitimate SharePoint ASP.NET components🔍 Enhanced Filtering : Reduced false positives with intelligent pattern matching📊 Approval Workflow : Interactive review process with hash-based tracking
📚 Incremental Log Reading : Bookmark system tracks last read position in logs💾 Event Caching : Daily cache files prevent duplicate event processing� Smart Skip Logic : Unchanged logs are automatically skipped📊 Cache Hit Tracking : Performance metrics show cache efficiency🧹 Automatic Cleanup : Old cache and log files are automatically removed
📊 Enhanced Reporting
📈 Attack Timeline : Complete chronological view of all attacks🎯 Attack Type Analysis : Statistical breakdown by attack category🌐 IP-Based Analysis : Detailed attacker IP tracking and correlation📊 Executive Dashboard : At-a-glance security metrics🔍 Detailed Drill-Down : Comprehensive attack details with threat actor attribution
🔧 Operational Features
📅 Automated Task Management : Built-in scheduled task installation and management🔄 Flexible Scan Modes : Quick (12h), Standard (configurable), Full Historical (30d)📧 Smart Email Alerts : Configurable alerting with -NoAlertOnWarnings option🧪 ESET Compatibility : Intelligent detection of ESET vs Microsoft Defender🔒 Baseline Systems : DLL baseline and SharePoint file integrity checking
🆕 Key Enhancements Over Original v3.9
📦 Optimized Design : Enhanced 4,823-line script with modular functions💾 Caching System : Event caching and log bookmarks for incremental processing🔄 Parallel Processing : Multi-threaded analysis for large datasets🧠 Memory Optimization : Configurable memory limits and compression caching📊 Progress Reporting : Real-time feedback on long-running operations
🔬 Advanced DLL Analysis System
✍️ Signature Validation : Digital certificate verification and trust analysis🧬 Behavioral Analysis : API import analysis and entropy calculation🤖 Machine Learning : Threat scoring algorithm with confidence levels📐 Baseline Management : Automated baseline creation and comparison✅ Approval Workflow : Interactive review process for suspicious DLLs🎯 Pattern Recognition : Legitimate vs malicious DLL identification
🛡️ Enhanced Threat Detection
🔍 CVE-Specific Patterns : Detection for CVE-2025-53770 and bypass vulnerabilities👤 Threat Actor Tools : Recognition of known attack tools and techniques🔗 Correlation Analysis : Multi-vector attack detection across time windows⚡ Real-time Processing : Incremental log reading with bookmarks🎨 Custom Patterns : Extensible threat pattern definitions⏰ Timeline Analysis : Event correlation within configurable time windows
⚙️ Configuration Management
🌍 Environment Support : Development, Testing, Production configurations✅ Validation System : Comprehensive configuration validation🔐 Secure Storage : Encrypted sensitive data handling💾 Backup/Restore : Automatic configuration versioning📋 Template Generation : Configuration template creation
📊 Comprehensive Reporting
🌐 HTML Reports : Interactive reports with CSS styling and responsive design📄 Multiple Formats : JSON, CSV, and future PDF export capabilities👔 Executive Summary : Risk assessment and key findings for management🔧 Technical Details : Detailed analysis for security teams📈 Charts & Graphs : Visual threat trends and analysis charts⚡ Performance Metrics : Execution time and system resource usage
⚙️ Technical Specifications
📦 Module Functions Summary
📝 SecurityLogger.psm1
Initialize-SecurityLogger: Set up logging systemWrite-SecurityLog: Write structured log entriesGet-SecurityLogs: Retrieve filtered logsExport-SecurityLogs: Export logs in multiple formatsClose-SecurityLogger: Cleanup logging resources
🔬 DLLAnalyzer.psm1
Start-DLLAnalysis: Comprehensive DLL analysisAnalyze-DLLFile: Individual file analysisCreate-DLLBaseline: Baseline establishmentReview-PendingDLLs: Interactive approval process
🎯 ThreatDetector.psm1
Start-ThreatDetection: Multi-pattern threat analysisAnalyze-LogPath: Process log directoriesAnalyze-LogFile: Individual log file processingInvoke-ThreatCorrelation: Attack pattern correlationReset-LogBookmarks: Clear processing bookmarksClear-EventCache: Reset event cache
⚙️ ConfigManager.psm1
Initialize-SecurityConfig: Load and validate configurationImport-SecurityConfig: Import from JSON filesExport-SecurityConfig: Save configuration with encryptionTest-SecurityConfig: Validate configuration integrityGet-ConfigValue: Retrieve configuration valuesSet-ConfigValue: Update configuration valuesNew-ConfigTemplate: Generate configuration templatesBackup-SecurityConfig: Create configuration backups
📊 ReportGenerator.psm1
New-SecurityReport: Generate comprehensive reportsPrepare-ReportData: Process and analyze resultsNew-HTMLReport: Create interactive HTML reports
⚙️ Configuration Categories
📧 EmailSettings : SMTP configuration and alert preferences🔍 ScanSettings : Scanning parameters and performance tuning🔬 DLLAnalysisSettings : DLL analysis behavior and thresholds🎯 ThreatDetectionSettings : Threat pattern and correlation settings📝 LoggingSettings : Log level, format, and retention policies⚡ PerformanceSettings : Memory limits and processing optimization🔐 SecuritySettings : Encryption and privilege requirements📅 ScheduledTaskSettings : Automated execution configuration🚨 AlertingSettings : Real-time alerting and escalation rules📊 ReportingSettings : Report generation and formatting options
🔧 Deployment and Setup
📋 Prerequisites
✅ Windows PowerShell 5.1 or PowerShell Core 6.0+
✅ SharePoint 2019 or SharePoint Online environment
✅ Administrative privileges for full functionality
✅ SMTP server access for email alerts (optional)
📥 Installation Steps
📂 Extract all files to a secure directory
⚙️ Review and customize SharePointSecurityConfig.json
🎮 Run demonstration: .\Demo-EnhancedScript.ps1 -CreateSampleData
📐 Create DLL baseline: .\SharePoint-Security-Monitor.ps1 -CreateBaseline
📅 Install scheduled tasks: .\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Install
🔍 Perform initial scan: .\SharePoint-Security-Monitor.ps1
🔐 Security Considerations
👤 Run with appropriate administrative privileges
🔒 Store configuration files in secure locations
🔐 Use encrypted storage for sensitive credentials
🛡️ Implement proper access controls on log files
💾 Regular backup of configuration and baseline data
⚙️ Configuration Edit SharePointSecurityConfig.json to customize:
📧 Email settings (SMTP server, recipients)
🔍 Scan parameters (time ranges, file size limits)
🎯 Security thresholds and alert levels
⚡ Performance optimization settings
🛡️ Threat detection patterns and correlation rules
📧 Email Configuration The script is pre-configured to send alerts to:
🚪 Exit Codes
✅ 0 : No security issues detected⚠️ 1 : Warnings detected🚨 2 : Critical security issues detected❌ 99 : Script execution error
🎯 Benefits Achieved
👥 For Security Teams
⚡ Faster Analysis : Modular design enables focused analysis of specific threats👁️ Better Visibility : Comprehensive reporting with visual charts and trends🎯 Reduced False Positives : ML-based scoring and behavioral analysis🔄 Streamlined Workflow : Automated approval processes and task management
🔧 For System Administrators
🛠️ Easier Maintenance : Modular architecture simplifies updates and customization⚡ Better Performance : Optimized algorithms and caching reduce resource usage⚙️ Flexible Configuration : Environment-specific settings and validation🤖 Automated Operations : Scheduled tasks and automated baseline management
👔 For Management
📊 Executive Reporting : Clear risk assessment and key findings summary✅ Compliance Support : Detailed audit trails and comprehensive documentation💰 Cost Efficiency : Reduced manual effort and faster incident response📈 Risk Visibility : Real-time threat level assessment and trend analysis
📅 Version History
🆕 v4.0 : Modular architecture with specialized modules, ML-based threat scoring, and enhanced reporting📦 v3.9 : Enhanced DLL validation and pattern analysis (original comprehensive single-file script)🔄 v3.8 : Auto-approval workflows and detailed attack reporting
🔮 Future Enhancement Opportunities
🤖 Machine Learning Integration : Advanced ML models for threat prediction☁️ Cloud Integration : Azure/Office 365 security center integration🔌 API Development : REST API for integration with external systems📱 Mobile Dashboard : Mobile-friendly reporting interface🌐 Threat Intelligence Feeds : Integration with commercial threat intelligence🤖 Automated Response : Automated containment and remediation actions
📄 License This project is designed for SharePoint security monitoring and threat detection.
💬 Support
🛡️ Protecting SharePoint Environments Since 2024 🛡️
Made with ❤️ by the Security Operations Center
paolokappa/sharepointsecuritymonitor
