🛡️ SharePoint Security Monitor v5.0

🚀 A comprehensive PowerShell-based SharePoint security monitoring solution with CVE-2023-29357 and CVE-2023-33157 protection, intelligent DLL management, advanced threat detection, and automated alerting capabilities.

📋 Table of Contents

• 🌟 Project Overview
• ✨ Key Features
• 🏗️ Solution Architecture
• 🚀 Quick Start Guide
• 📁 File Structure
• 🆕 Key Enhancements
• ⚙️ Technical Specifications
• 🔧 Deployment and Setup
• 📧 Email Configuration
• 🎯 Benefits Achieved
• 📅 Version History
• 🔮 Future Enhancements
• 📄 License
• 💬 Support

🌟 Project Overview

The original 5,519-line PowerShell script has been enhanced into a high-performance security monitoring solution while maintaining the PowerShell ecosystem. Although still a single script, it incorporates significant improvements in modularity and functionality.

✨ Key Features

🛡️ Security Features

• 🔍 CVE-Specific Protection: Dedicated detection for CVE-2023-29357 and CVE-2023-33157
• 🧬 Intelligent DLL Management: Auto-approval system with pending review queue
• 🎯 Real-time Threat Detection: Advanced threat actor identification and tracking
• 📊 Comprehensive Attack Tracking: Unified attack timeline with 20+ attack types
• 🔐 LSASS Memory Protection: Detection of credential theft attempts
• �️ Defender Tampering Detection: Monitoring for security software disabling
• 📋 GPO Monitoring: Detection of suspicious Group Policy modifications
• 🔄 Reflective DLL Injection Detection: Advanced memory injection detection
• 🚨 Ransomware Detection: Multiple ransomware family identification
• 🌐 C2 Communication Detection: Known C2 domains and IPs monitoring

🏗️ Architecture Features

• 📦 Enhanced Architecture: Single optimized script with modular functions
• ⚡ Performance Optimized: Incremental log reading with smart bookmarks
• 🔄 Event Caching: Efficient duplicate event filtering
• 💾 Smart Caching: Daily cache files with automatic cleanup
• 📊 Baseline Management: DLL and file integrity baseline systems
• 🔒 Multi-Layer Security: ESET and Microsoft Defender compatibility

📢 Monitoring & Alerting

• 📧 Smart Email Alerting: Configurable alerts with -NoAlertOnWarnings option
• 📈 Enhanced HTML Reports: Comprehensive attack timeline and statistics
• ⚙️ Scheduled Task Management: Automated hourly, daily, and startup scans
• 🔐 Detailed Attack Analysis: IP-based threat actor identification
• 📊 Performance Metrics: Execution time tracking and cache hit rates
• 🎯 Pending DLL Management: Review and approval workflow for DLLs

🏗️ Solution Architecture

🔧 Core Components

1️⃣ SharePoint-Security-Monitor.ps1 (Main Script)

• 🎯 Modular entry point with comprehensive parameter support
• 🛡️ Error handling and recovery mechanisms
• 📊 Progress reporting and execution time tracking
• ⚡ Support for quick scans, baseline creation, and task management

2️⃣ Core Functionality (Integrated Functions)

• 📝 Advanced Logging: Performance tracking with timer functions
• 🔬 DLL Analysis: Intelligent Test-SuspiciousDLL with auto-approval
• 🎯 Threat Detection: Real-time pattern matching and correlation
• ⚙️ Configuration: JSON-based configuration with secure handling
• 📊 Report Generation: Comprehensive HTML reports with attack timeline

3️⃣ Configuration System

• 📋 SharePointSecurityConfig.json: Production-ready configuration
• 🌍 Environment-specific overrides (Development, Testing, Production)
• 🔐 Secure credential handling with encryption support

4️⃣ Demonstration and Setup

• 🎮 Demo-EnhancedScript.ps1: Interactive demonstration script
• 📊 Sample data structure creation
• ✅ Module verification and testing capabilities

🚀 Quick Start Guide

📌 Basic Usage

# Standard security scan with email on alerts/warnings
.\SharePoint-Security-Monitor.ps1

# Standard scan with custom max days
.\SharePoint-Security-Monitor.ps1 -MaxDaysToScan 7

🎯 Common Operations

# ⚡ Quick scan (last 12 hours)
.\SharePoint-Security-Monitor.ps1 -QuickScan

# 📐 Create DLL baseline
.\SharePoint-Security-Monitor.ps1 -CreateBaseline

# 👁️ Review and approve pending DLLs
.\SharePoint-Security-Monitor.ps1 -ReviewPendingDLLs

# 🤖 Auto-approve legitimate DLLs
.\SharePoint-Security-Monitor.ps1 -AutoApproveDLLs

# 🔍 Check SharePoint file integrity
.\SharePoint-Security-Monitor.ps1 -CheckIntegrity

# 📧 Force email alert
.\SharePoint-Security-Monitor.ps1 -ForceAlert

# 📊 Always send report regardless of findings
.\SharePoint-Security-Monitor.ps1 -AlwaysSendReport

# 🔕 Only alert on critical issues (not warnings)
.\SharePoint-Security-Monitor.ps1 -NoAlertOnWarnings

# 🗓️ Full historical scan (30 days)
.\SharePoint-Security-Monitor.ps1 -FullHistoricalScan

# 🔄 Reset log reading bookmarks
.\SharePoint-Security-Monitor.ps1 -ResetBookmarks

# 🗑️ Clear event cache
.\SharePoint-Security-Monitor.ps1 -ClearCache

# ⚙️ Manage scheduled tasks
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Install
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Status
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Remove

# 🚫 Disable event caching for debugging
.\SharePoint-Security-Monitor.ps1 -DisableEventCache

# 📏 Process larger log files (default 250MB)
.\SharePoint-Security-Monitor.ps1 -MaxLogSizeMB 500

# ✅ Auto-approve legitimate DLLs
.\SharePoint-Security-Monitor.ps1 -AutoApproveDLLs

📅 Task Management

# 📥 Install scheduled tasks
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Install

# 📊 Check task status
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Status

# 🗑️ Remove scheduled tasks
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Remove

🔬 Advanced Features

# 🔍 Verbose DLL analysis with auto-approval
.\SharePoint-Security-Monitor.ps1 -VerboseDLL -AutoApproveDLLs

# 🧹 Clear caches and reset bookmarks
.\SharePoint-Security-Monitor.ps1 -ClearCache -ResetBookmarks

📁 File Structure

📂 SharePoint Security Monitor/
├── 📄 SharePoint-Security-Monitor.ps1              # Main monitoring script
├── 🎮 Demo-EnhancedScript.ps1                     # Demonstration script
├── ⚙️  SharePointSecurityConfig.json               # Configuration file
├── 📋 README.md                                    # Documentation
├── 📄 changelog-file.md                            # Version history
└── 📋 contributing-guide.md                        # Contribution guidelines