paolokappa/sharepointsecuritymonitor포괄적인 PowerShell 기반 SharePoint 보안 모니터링 솔루션으로, CVE-2025-53770 보호, 고급 DLL 분석, 위협 탐지 및 자동 경고 기능을 제공합니다.
🚀 CVE-2023-29357 및 CVE-2023-33157 보호, 지능형 DLL 관리, 고급 위협 탐지, 자동 알림 기능을 갖춘 포괄적인 PowerShell 기반 SharePoint 보안 모니터링 솔루션입니다.
원본 5,519줄 PowerShell 스크립트는 PowerShell 생태계를 유지하면서 고성능 보안 모니터링 솔루션으로 향상되었습니다. 여전히 단일 스크립트이지만 모듈성과 기능 면에서 상당한 개선이 포함되어 있습니다.
# Standard security scan with email on alerts/warnings
.\SharePoint-Security-Monitor.ps1
# Standard scan with custom max days
.\SharePoint-Security-Monitor.ps1 -MaxDaysToScan 7
# ⚡ Quick scan (last 12 hours)
.\SharePoint-Security-Monitor.ps1 -QuickScan
# 📐 Create DLL baseline
.\SharePoint-Security-Monitor.ps1 -CreateBaseline
# 👁️ Review and approve pending DLLs
.\SharePoint-Security-Monitor.ps1 -ReviewPendingDLLs
# 🤖 Auto-approve legitimate DLLs
.\SharePoint-Security-Monitor.ps1 -AutoApproveDLLs
# 🔍 Check SharePoint file integrity
.\SharePoint-Security-Monitor.ps1 -CheckIntegrity
# 📧 Force email alert
.\SharePoint-Security-Monitor.ps1 -ForceAlert
# 📊 Always send report regardless of findings
.\SharePoint-Security-Monitor.ps1 -AlwaysSendReport
# 🔕 Only alert on critical issues (not warnings)
.\SharePoint-Security-Monitor.ps1 -NoAlertOnWarnings
# 🗓️ Full historical scan (30 days)
.\SharePoint-Security-Monitor.ps1 -FullHistoricalScan
# 🔄 Reset log reading bookmarks
.\SharePoint-Security-Monitor.ps1 -ResetBookmarks
# 🗑️ Clear event cache
.\SharePoint-Security-Monitor.ps1 -ClearCache
# ⚙️ Manage scheduled tasks
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Install
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Status
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Remove
# 🚫 Disable event caching for debugging
.\SharePoint-Security-Monitor.ps1 -DisableEventCache
# 📏 Process larger log files (default 250MB)
.\SharePoint-Security-Monitor.ps1 -MaxLogSizeMB 500
# ✅ Auto-approve legitimate DLLs
.\SharePoint-Security-Monitor.ps1 -AutoApproveDLLs
# 📥 Install scheduled tasks
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Install
# 📊 Check task status
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Status
# 🗑️ Remove scheduled tasks
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Remove
# 🔍 Verbose DLL analysis with auto-approval
.\SharePoint-Security-Monitor.ps1 -VerboseDLL -AutoApproveDLLs
# 🧹 Clear caches and reset bookmarks
.\SharePoint-Security-Monitor.ps1 -ClearCache -ResetBookmarks
📂 SharePoint Security Monitor/
├── 📄 SharePoint-Security-Monitor.ps1 # Main monitoring script
├── 🎮 Demo-EnhancedScript.ps1 # Demonstration script
├── ⚙️ SharePointSecurityConfig.json # Configuration file
├── 📋 README.md # Documentation
├── 📄 changelog-file.md # Version history
└── 📋 contributing-guide.md # Contribution guidelines
📂 Runtime Directories (auto-created)
├── Logs/ # Security logs
│ └── SecurityMonitor_YYYYMMDD.log # Daily log files
├── Reports/ # HTML reports
│ └── SecurityReport_YYYYMMDD_HHMMSS.html # Timestamped reports
├── Baselines/ # Baseline data
│ ├── DLL_Baseline.json # DLL inventory baseline
│ ├── SharePoint_Integrity.json # File integrity baseline
│ ├── PendingDLLApproval.json # DLLs awaiting approval
│ └── ApprovedDLLs.json # Whitelisted DLLs
├── Bookmarks/ # Log reading positions
│ └── LogReadingBookmarks.json # Incremental read tracking
└── Cache/ # Event processing cache
└── ProcessedEvents_YYYYMMDD.json # Daily event cache