paolokappa/sharepointsecuritymonitor一个全面的基于 PowerShell 的 SharePoint 安全监控解决方案，具备 CVE-2025-53770 防护、高级 DLL 分析、威胁检测和自动化告警功能。
原始的 5,519 行 PowerShell 脚本已增强为高性能安全监控解决方案，同时保持了 PowerShell 生态系统。虽然仍是一个单一脚本，但它在模块化和功能方面引入了显著的改进。
# Standard security scan with email on alerts/warnings
.\SharePoint-Security-Monitor.ps1
# Standard scan with custom max days
.\SharePoint-Security-Monitor.ps1 -MaxDaysToScan 7
# ⚡ Quick scan (last 12 hours)
.\SharePoint-Security-Monitor.ps1 -QuickScan
# 📐 Create DLL baseline
.\SharePoint-Security-Monitor.ps1 -CreateBaseline
# 👁️ Review and approve pending DLLs
.\SharePoint-Security-Monitor.ps1 -ReviewPendingDLLs
# 🤖 Auto-approve legitimate DLLs
.\SharePoint-Security-Monitor.ps1 -AutoApproveDLLs
# 🔍 Check SharePoint file integrity
.\SharePoint-Security-Monitor.ps1 -CheckIntegrity
# 📧 Force email alert
.\SharePoint-Security-Monitor.ps1 -ForceAlert
# 📊 Always send report regardless of findings
.\SharePoint-Security-Monitor.ps1 -AlwaysSendReport
# 🔕 Only alert on critical issues (not warnings)
.\SharePoint-Security-Monitor.ps1 -NoAlertOnWarnings
# 🗓️ Full historical scan (30 days)
.\SharePoint-Security-Monitor.ps1 -FullHistoricalScan
# 🔄 Reset log reading bookmarks
.\SharePoint-Security-Monitor.ps1 -ResetBookmarks
# 🗑️ Clear event cache
.\SharePoint-Security-Monitor.ps1 -ClearCache
# ⚙️ Manage scheduled tasks
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Install
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Status
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Remove
# 🚫 Disable event caching for debugging
.\SharePoint-Security-Monitor.ps1 -DisableEventCache
# 📏 Process larger log files (default 250MB)
.\SharePoint-Security-Monitor.ps1 -MaxLogSizeMB 500
# ✅ Auto-approve legitimate DLLs
.\SharePoint-Security-Monitor.ps1 -AutoApproveDLLs
# 📥 Install scheduled tasks
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Install
# 📊 Check task status
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Status
# 🗑️ Remove scheduled tasks
.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Remove
# 🔍 Verbose DLL analysis with auto-approval
.\SharePoint-Security-Monitor.ps1 -VerboseDLL -AutoApproveDLLs
# 🧹 Clear caches and reset bookmarks
.\SharePoint-Security-Monitor.ps1 -ClearCache -ResetBookmarks
📂 SharePoint Security Monitor/
├── 📄 SharePoint-Security-Monitor.ps1 # Main monitoring script
├── 🎮 Demo-EnhancedScript.ps1 # Demonstration script
├── ⚙️ SharePointSecurityConfig.json # Configuration file
├── 📋 README.md # Documentation
├── 📄 changelog-file.md # Version history
└── 📋 contributing-guide.md # Contribution guidelines
📂 Runtime Directories (auto-created)
├── Logs/ # Security logs
│ └── SecurityMonitor_YYYYMMDD.log # Daily log files
├── Reports/ # HTML reports
│ └── SecurityReport_YYYYMMDD_HHMMSS.html # Timestamped reports
├── Baselines/ # Baseline data
│ ├── DLL_Baseline.json # DLL inventory baseline
│ ├── SharePoint_Integrity.json # File integrity baseline
│ ├── PendingDLLApproval.json # DLLs awaiting approval
│ └── ApprovedDLLs.json # Whitelisted DLLs
├── Bookmarks/ # Log reading positions
│ └── LogReadingBookmarks.json # Incremental read tracking
└── Cache/ # Event processing cache
└── ProcessedEvents_YYYYMMDD.json # Daily event cache
Initialize-SecurityLogger：设置日志系统Write-SecurityLog：写入结构化日志条目Get-SecurityLogs：检索过滤后的日志Export-SecurityLogs：以多种格式导出日志Close-SecurityLogger：清理日志资源Start-DLLAnalysis：全面的 DLL 分析Analyze-DLLFile：单个文件分析Create-DLLBaseline：建立基线Review-PendingDLLs：交互式批准流程Start-ThreatDetection：多模式威胁分析Analyze-LogPath：处理日志目录Analyze-LogFile：单个日志文件处理Invoke-ThreatCorrelation：攻击模式关联Reset-LogBookmarks：清除处理书签Clear-EventCache：重置事件缓存Initialize-SecurityConfig：加载并验证配置Import-SecurityConfig：从 JSON 文件导入Export-SecurityConfig：加密保存配置Test-SecurityConfig：验证配置完整性Get-ConfigValue：检索配置值Set-ConfigValue：更新配置值New-ConfigTemplate：生成配置模板Backup-SecurityConfig：创建配置备份New-SecurityReport：生成全面报告Prepare-ReportData：处理和分析结果New-HTMLReport：创建交互式 HTML 报告SharePointSecurityConfig.json.\Demo-EnhancedScript.ps1 -CreateSampleData.\SharePoint-Security-Monitor.ps1 -CreateBaseline.\SharePoint-Security-Monitor.ps1 -ManageTasks -TaskAction Install.\SharePoint-Security-Monitor.ps1编辑 SharePointSecurityConfig.json 以自定义：
该脚本已预先配置为向以下地址发送告警：
本项目专为 SharePoint 安全监控和威胁检测而设计。
如需技术支持或报告安全事件，请联系：[email protected]
🛡️ 自 2024 年起保护 SharePoint 环境 🛡️
由安全运营中心用 ❤️ 制作