A lightweight, real-time Windows security monitoring tool built entirely in PowerShell. Designed for blue team operators who need immediate visibility into security events without deploying heavy infrastructure.
- WMI Activity Monitoring — Real-time detection of WMI filter, consumer, and binding creation (Sysmon 19-21 + WMI-Activity 5861).
- Severity Scoring (1-10) — Events are now weighted by threat indicators (Admin activity, suspicious path, known attack pattern).
- Structured JSON Logging — Machine-parsable
.jsonloutput for easy SIEM ingestion (Splunk, ELK, etc.). - Non-Interactive Mode — Run as a service or scheduled task without prompt interruption using
-NonInteractive. - Advanced Threat Detection — New modules for Log Clearing, Windows Defender tampering, and Golden Ticket detection.
- Multi-Source Event Collection — Security, PowerShell, Sysmon, AD, Service, Task, and WMI events.
- Sysmon Integration — Auto-detects running Sysmon or installs it with
-InstallSysmon. - Active Directory Monitoring — Auto-detects Domain Controllers and enables AD-specific event monitoring (DCSync, replication).
- WMI Persistence Detection — Scans for malicious WMI EventFilters, Consumers, and Bindings AND monitors them in real-time.
- LOLBIN Detection — Flags 50+ suspicious process executions (recon tools, attack frameworks).
- PowerShell Threat Patterns — Catches Invoke-Mimikatz, download cradles, and encoded commands.
- Noise Filtering — Suppress SYSTEM/SERVICE events and common noisy paths.
# Run the monitor (basic)
.\SecurityMonitor.ps1
# Setup audit policies first (recommended on first run)
.\SecurityMonitor.ps1 -SetupAudit
# Install Sysmon and start monitoring with JSON logging
.\SecurityMonitor.ps1 -InstallSysmon -JsonLog| Parameter | Type | Description |
|---|---|---|
-ConfigPath |
string | Path to JSON configuration file |
-LogPath |
string | Path to human-readable log output |
-JsonLog |
switch | Enable structured JSON logging |
-NonInteractive |
switch | Skip all interactive prompts |
-MinSeverity |
int | Only log events above this score (1-10) |
-SetupAudit |
switch | Configure Windows audit policies |
-InstallSysmon |
switch | Install Sysmon with SwiftOnSecurity config |
| Source | Highlights |
|---|---|
| Logon | Failed logons, Brute-force detection, Kerberos roasting |
| Process | LOLBins (4688), Sysmon Process Create (1) |
| WMI | Persistence scanning & Real-time registration (Sysmon 19-21, 5861) |
| Detection | Defender tampering, Log clearing, DCShadow, DCSync |
| PowerShell | Script block (4104), Module logging (4103) |
Edit SecurityMonitor-Config.json to customize thresholds, whitelists, and suspicious patterns.
MIT