SecurityMonitor.ps1

param(
    [string]$ConfigPath = ".\SecurityMonitor-Config.json",
    [string]$LogPath = "",
    [switch]$SetupAudit,
    [switch]$InstallSysmon,
    [switch]$RunOnce,
    [switch]$TestMode,
    [switch]$NonInteractive,
    [switch]$JsonLog,
    [string]$JsonLogPath = "",
    [int]$MinSeverity = 0,
    [int]$CheckInterval = 60
)


function New-EventList { return [System.Collections.Generic.List[object]]::new() }

function ConvertTo-Hashtable {
    param([Parameter(ValueFromPipeline)]$InputObject)
    process {
        if ($null -eq $InputObject) { return $null }
        if ($InputObject -is [System.Collections.IEnumerable] -and $InputObject -isnot [string]) {
            $collection = @(foreach ($obj in $InputObject) { ConvertTo-Hashtable $obj })
            return , $collection
        }
        if ($InputObject -is [psobject]) {
            $hash = @{}
            foreach ($prop in $InputObject.PSObject.Properties) {
                $hash[$prop.Name] = ConvertTo-Hashtable $prop.Value
            }
            return $hash
        }
        return $InputObject
    }
}

$Script:HasSysmon = $false
$Script:IsDomainController = $false
$Script:SysmonLogName = "Microsoft-Windows-Sysmon/Operational"
$Script:SIDCache = @{}
$Script:JsonLogFilePath = ""

function Detect-Capabilities {
    # Check Sysmon
    try {
        $svc = Get-Service -Name "Sysmon*" -ErrorAction SilentlyContinue
        if ($svc -and $svc.Status -eq "Running") {
            $Script:HasSysmon = $true
            Write-Host "[OK] Sysmon detected and running" -ForegroundColor Green
        }
        else {
            Write-Host "[--] Sysmon not running (Sysmon events will be skipped)" -ForegroundColor Yellow
        }
    }
    catch { Write-Host "[--] Sysmon not available" -ForegroundColor Yellow }

    # Check if Domain Controller
    try {
        $dcRole = (Get-WmiObject Win32_ComputerSystem -ErrorAction SilentlyContinue).DomainRole
        if ($dcRole -ge 4) {
            $Script:IsDomainController = $true
            Write-Host "[OK] Domain Controller detected — AD events enabled" -ForegroundColor Green
        }
        else {
            Write-Host "[--] Not a DC (AD-specific events will be skipped)" -ForegroundColor Yellow
        }
    }
    catch { Write-Host "[--] Could not determine DC role" -ForegroundColor Yellow }
}

$Script:Config = @{
    EventIDs            = @{
        Logon                    = @(4624, 4625, 4648, 4672, 4627, 4634, 4647, 4768, 4769, 4771, 4776)
        Process                  = @(4688, 4689, 4696)
        File                     = @(4660, 4661, 4663, 4656, 4658, 4699, 4654, 4670)
        Account                  = @(4720, 4722, 4724, 4726, 4728, 4732, 4733, 4756, 4735, 4737, 4740, 4767, 4782)
        Service                  = @(7045, 4697, 7034, 7035, 7036, 7040)
        Policy                   = @(4719, 4738, 4904, 4905, 4907, 4912)
        Network                  = @(5156, 5157, 5158, 5159)
        ScheduledTask            = @(4698, 4700, 4701, 4702)
        ScheduledTaskOperational = @(106, 140, 141, 200, 201)
        PowerShell               = @(4103, 4104, 4105, 4106)
        ObjectAccess             = @(4654, 4670, 4907)
        Registry                 = @(4657)
        AD                       = @(4662, 4742, 4780, 4781, 5136, 5137, 5138, 5139, 5141)
        Kerberos                 = @(4768, 4769, 4771, 4776)
    }
    SysmonEventIDs      = @(1, 3, 5, 7, 8, 10, 11, 12, 13, 15, 17, 18, 22, 23, 25)
    SuspiciousProcesses = @(
        "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
        "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe",
        "bitsadmin.exe", "wmic.exe", "schtasks.exe", "at.exe",
        "msiexec.exe", "installutil.exe", "regasm.exe", "regsvcs.exe",
        "msbuild.exe", "cmstp.exe", "msxsl.exe", "nltest.exe",
        "esentutl.exe", "expand.exe", "extrac32.exe",
        "net.exe", "net1.exe", "whoami.exe", "hostname.exe",
        "systeminfo.exe", "tasklist.exe", "sc.exe", "reg.exe",
        "bcdedit.exe", "vssadmin.exe", "wbadmin.exe", "ntdsutil.exe",
        "procdump.exe", "procdump64.exe", "mimikatz.exe",
        "psexec.exe", "psexec64.exe", "rubeus.exe", "sharphound.exe"
    )
    NoiseFilters        = @{
        Users = @("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE", "SERVICE")
        Paths = @("SRU.chk", "LogFiles", "wbem", "Microsoft\\\\Windows\\\\PowerShell", "Microsoft\\\\Windows\\\\AppReadiness")
    }
    BruteForceThreshold = 5
    LookbackMinutes     = 5
    SystemName          = $env:COMPUTERNAME
    Domain              = "YOURORG.COM"
    WMIWhitelist        = @("SCM Event Log Filter", "SCM Event Log Consumer", "BVTFilter")
}

Write-Host "===================================================================" -ForegroundColor Cyan
Write-Host "POWERSHELL SECURITY MONITOR v2.0" -ForegroundColor Cyan
Write-Host "===================================================================" -ForegroundColor Cyan

Write-Host ""

Detect-Capabilities

Write-Host ""
if (-not (Test-Path $ConfigPath)) {
    Write-Host "Config file not found at: $ConfigPath" -ForegroundColor Yellow
}
else {
    Write-Host "Config file found at: $ConfigPath" -ForegroundColor Green
}
if (-not $NonInteractive) {
    $newConfigPath = Read-Host "Enter config file path (or press Enter to use: $ConfigPath)"
}
else { $newConfigPath = "" }
if (-not [string]::IsNullOrWhiteSpace($newConfigPath)) { $ConfigPath = $newConfigPath }

if (Test-Path $ConfigPath) {
    try {
        $loaded = Get-Content $ConfigPath -Raw | ConvertFrom-Json | ConvertTo-Hashtable
        # Merge loaded config into defaults (loaded values override defaults)
        foreach ($key in $loaded.Keys) {
            $Script:Config[$key] = $loaded[$key]
        }
        Write-Host "[OK] Loaded configuration from: $ConfigPath" -ForegroundColor Green
    }
    catch {
        Write-Host "[X] Error loading config: $($_.Exception.Message). Using defaults." -ForegroundColor Red
    }
}
else {
    Write-Host "[--] Config file not found. Using default configuration." -ForegroundColor Yellow
}

Write-Host ""
$defaultLogPath = ".\SecurityMonitor_$(Get-Date -Format 'yyyyMMdd').log"
if ([string]::IsNullOrWhiteSpace($LogPath)) {
    Write-Host "Log file path not specified." -ForegroundColor Yellow
}
else {
    Write-Host "Log file path specified: $LogPath" -ForegroundColor Green
}
if (-not $NonInteractive) {
    $userLogPath = Read-Host "Enter log file path (or press Enter for default: $defaultLogPath)"
}
else { $userLogPath = "" }
if (-not [string]::IsNullOrWhiteSpace($userLogPath)) {
    $LogPath = $userLogPath
}
elseif ([string]::IsNullOrWhiteSpace($LogPath)) {
    $LogPath = $defaultLogPath
}

Write-Host ""
$defaultVerifyPath = ".\Verify-AuditPolicies.ps1"
if (-not (Test-Path $defaultVerifyPath)) {
    Write-Host "Verify script not found at: $defaultVerifyPath" -ForegroundColor Yellow
}
else {
    Write-Host "Verify script found at: $defaultVerifyPath" -ForegroundColor Green
}
if (-not $NonInteractive) {
    $verifyPath = Read-Host "Enter verify script path (or press Enter for default: $defaultVerifyPath)"
}
else { $verifyPath = "" }
if ([string]::IsNullOrWhiteSpace($verifyPath)) { $verifyPath = $defaultVerifyPath }
$Script:VerifyScriptPath = $verifyPath

$logDirectory = Split-Path -Path $LogPath -Parent
if (-not [string]::IsNullOrWhiteSpace($logDirectory) -and -not (Test-Path $logDirectory)) {
    try {
        New-Item -ItemType Directory -Path $logDirectory -Force | Out-Null
        Write-Host "[OK] Created log directory: $logDirectory" -ForegroundColor Green
    }
    catch {
        Write-Host "[X] Could not create log directory. Logs screen-only." -ForegroundColor Yellow
        $LogPath = ""
    }
}

$Script:LogFilePath = $LogPath
Write-Host "[OK] Log file: $LogPath" -ForegroundColor Green
Write-Host "===================================================================" -ForegroundColor Cyan
Write-Host ""

function Write-Log {
    param([string]$Message, [string]$Level = "INFO")
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $color = switch ($Level) {
        "WARNING" { "Yellow" }
        "ERROR" { "Red" }
        "SUCCESS" { "Green" }
        "CRITICAL" { "Red" }
        default { "White" }
    }
    Write-Host "[$timestamp] " -NoNewline -ForegroundColor Gray
    Write-Host "[$Level] " -NoNewline -ForegroundColor $color
    Write-Host $Message
    if ($Script:LogFilePath -and -not [string]::IsNullOrWhiteSpace($Script:LogFilePath)) {
        try { Add-Content -Path $Script:LogFilePath -Value "[$timestamp] [$Level] $Message" -ErrorAction SilentlyContinue } catch {}
    }
}

function Get-SeverityScore {
    param([hashtable]$Event, [array]$Reasons)
    $score = 1
    # Base scores by event type
    if ($Event.EventID -in @(4625)) { $score = [Math]::Max($score, 4) }
    if ($Event.EventID -in @(4720, 4722, 4724, 4726, 4728, 4732, 4756)) { $score = [Math]::Max($score, 6) }
    if ($Event.EventID -in @(4698, 7045, 4697)) { $score = [Math]::Max($score, 5) }
    if ($Event.EventID -in @(1102, 104)) { $score = [Math]::Max($score, 9) }
    if ($Event.Source -eq "WMI Persistence") { $score = [Math]::Max($score, 8) }
    if ($Event.Source -eq "Sysmon" -and $Event.EventID -eq 8) { $score = [Math]::Max($score, 8) }
    if ($Event.Source -eq "Sysmon" -and $Event.EventID -eq 10) { $score = [Math]::Max($score, 7) }
    # Boost for specific indicators
    foreach ($r in $Reasons) {
        if ($r -match "Brute force|DCSync|DCShadow|Golden Ticket|credential dump|LSASS") { $score = [Math]::Max($score, 9) }
        if ($r -match "Kerberoast|AS-REP|lateral movement") { $score = [Math]::Max($score, 7) }
        if ($r -match "Suspicious process|PowerShell command") { $score = [Math]::Max($score, 5) }
        if ($r -match "Log cleared|Defender.*tamper|disabled") { $score = [Math]::Max($score, 9) }
    }
    # Admin activity boost
    if ($Event.User -match "Administrator|Admin" -and $score -ge 4) { $score = [Math]::Min($score + 1, 10) }
    # External IP boost
    if ($Event.IPAddress -and $Event.IPAddress -ne "N/A" -and $Event.IPAddress -ne "-" -and
        $Event.IPAddress -ne "127.0.0.1" -and $Event.IPAddress -ne "::1" -and
        $Event.IPAddress -notmatch "^192\.168\.|^10\.|^172\.(1[6-9]|2[0-9]|3[0-1])\.") {
        $score = [Math]::Min($score + 2, 10)
    }
    return [Math]::Min($score, 10)
}

function Get-SeverityLabel {
    param([int]$Score)
    switch ($Score) {
        { $_ -le 3 } { return "INFORMATIONAL" }
        { $_ -le 5 } { return "LOW" }
        { $_ -le 7 } { return "MEDIUM" }
        { $_ -le 9 } { return "HIGH" }
        default { return "CRITICAL" }
    }
}

function Write-JsonLog {
    param([hashtable]$Event, [int]$Severity, [string]$SeverityLabel, [array]$Reasons)
    if (-not $JsonLog -or -not $Script:JsonLogFilePath) { return }
    try {
        $obj = [ordered]@{
            timestamp      = (Get-Date -Format "yyyy-MM-ddTHH:mm:ss.fffZ")
            severity       = $Severity
            severity_label = $SeverityLabel
            event_id       = $Event.EventID
            source         = $Event.Source
            machine        = $Event.Machine
            user           = $Event.User
            ip_address     = $Event.IPAddress
            process        = $Event.ProcessName
            file_path      = $Event.FilePath
            flags          = $Reasons
            message        = ($Event.Message -split "`n" | Select-Object -First 2) -join " | "
        }
        $json = $obj | ConvertTo-Json -Compress
        Add-Content -Path $Script:JsonLogFilePath -Value $json -ErrorAction SilentlyContinue
    }
    catch {}
}

# Setup JSON log path
if ($JsonLog) {
    if ([string]::IsNullOrWhiteSpace($JsonLogPath)) {
        $Script:JsonLogFilePath = ".\SecurityMonitor_$(Get-Date -Format 'yyyyMMdd').jsonl"
    }
    else {
        $Script:JsonLogFilePath = $JsonLogPath
    }
    Write-Host "[OK] JSON log: $($Script:JsonLogFilePath)" -ForegroundColor Green
}

# Apply MinSeverity from config if not set via parameter
if ($MinSeverity -eq 0) {
    if ($Script:Config.MinSeverity) { $MinSeverity = $Script:Config.MinSeverity }
    else { $MinSeverity = 1 }
}


function Get-EventField {
    param(
        [System.Diagnostics.Eventing.Reader.EventLogRecord]$Event,
        [string]$FieldName
    )
    try {
        $xml = [xml]$Event.ToXml()
        $ns = New-Object System.Xml.XmlNamespaceManager($xml.NameTable)
        $ns.AddNamespace("ns", "http://schemas.microsoft.com/win/2004/08/events/event")
        # Fix: use Data[@Name='...'] for EventData fields
        $field = $xml.SelectSingleNode("//ns:Data[@Name='$FieldName']", $ns)
        if ($field) { return $field.InnerText }
        # Fallback: try direct element (for System fields)
        $field = $xml.SelectSingleNode("//ns:$FieldName", $ns)
        if ($field) { return $field.InnerText }
    }
    catch {}
    return $null
}

function Get-UserFromSID {
    param([string]$SID)
    if ([string]::IsNullOrWhiteSpace($SID) -or $SID -eq "-") { return "N/A" }
    try {
        $objSID = New-Object System.Security.Principal.SecurityIdentifier($SID)
        $objUser = $objSID.Translate([System.Security.Principal.NTAccount])
        return $objUser.Value
    }
    catch { return $SID }
}

function Install-Sysmon {
    Write-Log "Installing Sysmon..." "INFO"
    $sysmonExe = ".\Sysmon.exe"
    $sysmonConfig = ".\sysmonconfig.xml"
    $sysmonUrl = "https://live.sysinternals.com/Sysmon.exe"
    $configUrl = "https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml"

    # Check if already running
    $existingSvc = Get-Service -Name "Sysmon*" -ErrorAction SilentlyContinue
    if ($existingSvc -and $existingSvc.Status -eq "Running") {
        Write-Log "Sysmon is already installed and running." "SUCCESS"
        $update = Read-Host "Update config? (y/N)"
        if ($update -ne "y") { return }
    }

    # Download if needed
    if (-not (Test-Path $sysmonExe)) {
        Write-Log "Downloading Sysmon.exe..." "INFO"
        try {
            Invoke-WebRequest -Uri $sysmonUrl -OutFile $sysmonExe -UseBasicParsing -ErrorAction Stop
            Write-Log "Downloaded Sysmon.exe" "SUCCESS"
        }
        catch {
            Write-Log "Failed to download Sysmon. Place Sysmon.exe manually in $(Get-Location)" "ERROR"
            return
        }
    }

    if (-not (Test-Path $sysmonConfig)) {
        Write-Log "Downloading SwiftOnSecurity Sysmon config..." "INFO"
        try {
            Invoke-WebRequest -Uri $configUrl -OutFile $sysmonConfig -UseBasicParsing -ErrorAction Stop
            Write-Log "Downloaded sysmonconfig.xml" "SUCCESS"
        }
        catch {
            Write-Log "Failed to download config. Place sysmonconfig.xml manually." "ERROR"
            return
        }
    }

    # Install or update
    try {
        if ($existingSvc) {
            Write-Log "Updating Sysmon config..." "INFO"
            & $sysmonExe -c $sysmonConfig 2>&1 | Out-Null
        }
        else {
            Write-Log "Installing Sysmon service..." "INFO"
            & $sysmonExe -accepteula -i $sysmonConfig 2>&1 | Out-Null
        }
        Start-Sleep -Seconds 2
        $svc = Get-Service -Name "Sysmon*" -ErrorAction SilentlyContinue
        if ($svc -and $svc.Status -eq "Running") {
            $Script:HasSysmon = $true
            Write-Log "Sysmon installed and running!" "SUCCESS"
        }
        else {
            Write-Log "Sysmon service not detected after install. Check manually." "WARNING"
        }
    }
    catch {
        Write-Log "Sysmon install failed: $($_.Exception.Message)" "ERROR"
    }
}

if ($InstallSysmon) {
    Install-Sysmon
    if (-not $SetupAudit -and $RunOnce -eq $false) { exit 0 }
}

function Get-EventDetails {
    param([System.Diagnostics.Eventing.Reader.EventLogRecord]$Event)
    $details = @{
        Time = $Event.TimeCreated; EventID = $Event.Id; Level = $Event.LevelDisplayName
        Source = $Event.ProviderName; Machine = $Event.MachineName; Message = $Event.Message
        User = "N/A"; IPAddress = "N/A"; ProcessName = "N/A"; FilePath = "N/A"
        AccessMask = "N/A"; RecordId = $Event.RecordId; Reasons = @()
    }
    try {
        switch ($Event.Id) {
            { $_ -in @(4624, 4625) } {
                $details.User = Get-EventField -Event $Event -FieldName "TargetUserName"
                $details.IPAddress = Get-EventField -Event $Event -FieldName "IpAddress"
                if (-not $details.User -or $details.User -eq "N/A") {
                    $sid = Get-EventField -Event $Event -FieldName "TargetUserSid"
                    if ($sid) { $details.User = Get-UserFromSID -SID $sid }
                }
            }
            4688 {
                $details.ProcessName = Get-EventField -Event $Event -FieldName "NewProcessName"
                $details.FilePath = $details.ProcessName
                $details.User = Get-EventField -Event $Event -FieldName "SubjectUserName"
                $cmdLine = Get-EventField -Event $Event -FieldName "CommandLine"
                if ($cmdLine) { $details.Message += " | Command: $cmdLine" }
                if (-not $details.User -or $details.User -eq "N/A") {
                    $sid = Get-EventField -Event $Event -FieldName "SubjectUserSid"
                    if ($sid) { $details.User = Get-UserFromSID -SID $sid }
                }
            }
            { $_ -in @(4663, 4660, 4654, 4670) } {
                $details.FilePath = Get-EventField -Event $Event -FieldName "ObjectName"
                $details.User = Get-EventField -Event $Event -FieldName "SubjectUserName"
                if ($_ -eq 4663) {
                    $details.AccessMask = Get-EventField -Event $Event -FieldName "AccessMask"
                    $accesses = Get-EventField -Event $Event -FieldName "Accesses"
                    if ($accesses) { $details.Message += " | Access: $accesses" }
                }
                if (-not $details.User -or $details.User -eq "N/A") {
                    $sid = Get-EventField -Event $Event -FieldName "SubjectUserSid"
                    if ($sid) { $details.User = Get-UserFromSID -SID $sid }
                }
            }
            4657 {
                $details.FilePath = Get-EventField -Event $Event -FieldName "ObjectName"
                $details.User = Get-EventField -Event $Event -FieldName "SubjectUserName"
                $val = Get-EventField -Event $Event -FieldName "ObjectValueName"
                if ($val) { $details.Message += " | Value: $val" }
            }
            4698 {
                $taskName = Get-EventField -Event $Event -FieldName "TaskName"
                if ($taskName) { $details.Message += " | Task: $taskName" }
                $details.User = Get-EventField -Event $Event -FieldName "SubjectUserName"
            }
            4648 {
                $details.User = Get-EventField -Event $Event -FieldName "SubjectUserName"
                $target = Get-EventField -Event $Event -FieldName "TargetServerName"
                if ($target) { $details.Message += " | Target: $target" }
            }
            4769 {
                $details.User = Get-EventField -Event $Event -FieldName "TargetUserName"
                $encType = Get-EventField -Event $Event -FieldName "TicketEncryptionType"
                $svcName = Get-EventField -Event $Event -FieldName "ServiceName"
                if ($encType) { $details.Message += " | EncType: $encType" }
                if ($svcName) { $details.Message += " | Service: $svcName" }
            }
            4771 {
                $details.User = Get-EventField -Event $Event -FieldName "TargetUserName"
                $details.IPAddress = Get-EventField -Event $Event -FieldName "IpAddress"
            }
            default {
                $details.User = Get-EventField -Event $Event -FieldName "SubjectUserName"
                if (-not $details.User -or $details.User -eq "N/A") {
                    $details.User = Get-EventField -Event $Event -FieldName "TargetUserName"
                }
                if (-not $details.User -or $details.User -eq "N/A") {
                    $sid = Get-EventField -Event $Event -FieldName "SubjectUserSid"
                    if ($sid) { $details.User = Get-UserFromSID -SID $sid }
                }
            }
        }
    }
    catch {
        Write-Log "Error extracting details for Event $($Event.Id): $($_.Exception.Message)" "WARNING"
    }
    return $details
}

function Get-SecurityEvents {
    param([datetime]$Since)
    $events = New-EventList
    try {
        $allIDs = @()
        foreach ($cat in $Script:Config.EventIDs.Values) {
            if ($cat -is [Array]) { $allIDs += $cat } else { $allIDs += $cat }
        }
        $allIDs = $allIDs | Sort-Object -Unique

        $fileIDs = @(4660, 4661, 4663, 4656, 4658, 4699, 4654, 4670)
        $registryIDs = @(4657)
        $otherIDs = $allIDs | Where-Object { $_ -notin ($fileIDs + $registryIDs) }

        # File events — filter 4663 to only destructive actions
        $raw = Get-WinEvent -FilterHashtable @{LogName = "Security"; ID = $fileIDs; StartTime = $Since } -ErrorAction SilentlyContinue
        foreach ($evt in $raw) {
            $d = Get-EventDetails -Event $evt
            if ($d.EventID -eq 4663) {
                if ($d.Message -match "DELETE|WriteData|ChangePermissions") { $events.Add($d) }
            }
            else { $events.Add($d) }
        }

        # Registry events
        $raw = Get-WinEvent -FilterHashtable @{LogName = "Security"; ID = $registryIDs; StartTime = $Since } -ErrorAction SilentlyContinue
        foreach ($evt in $raw) { $events.Add((Get-EventDetails -Event $evt)) }

        # All other security events
        if ($otherIDs.Count -gt 0) {
            $raw = Get-WinEvent -FilterHashtable @{LogName = "Security"; ID = $otherIDs; StartTime = $Since } -ErrorAction SilentlyContinue
            foreach ($evt in $raw) { $events.Add((Get-EventDetails -Event $evt)) }
        }
    }
    catch {
        Write-Log "Error retrieving Security events: $($_.Exception.Message)" "ERROR"
    }
    return $events
}

function Get-SysmonEvents {
    param([datetime]$Since)
    $events = New-EventList
    if (-not $Script:HasSysmon) { return $events }
    try {
        $sysIDs = $Script:Config.SysmonEventIDs
        if (-not $sysIDs -or $sysIDs.Count -eq 0) { $sysIDs = @(1, 3, 5, 7, 8, 10, 11, 12, 13, 22, 23, 25) }

        $raw = Get-WinEvent -FilterHashtable @{
            LogName = $Script:SysmonLogName; ID = $sysIDs; StartTime = $Since
        } -ErrorAction SilentlyContinue

        foreach ($evt in $raw) {
            $d = @{
                Time = $evt.TimeCreated; EventID = $evt.Id; Level = $evt.LevelDisplayName
                Source = "Sysmon"; Machine = $evt.MachineName; Message = $evt.Message
                User = "N/A"; IPAddress = "N/A"; ProcessName = "N/A"; FilePath = "N/A"
                RecordId = $evt.RecordId; Reasons = @()
            }
            try {
                $xml = [xml]$evt.ToXml()
                $ns = New-Object System.Xml.XmlNamespaceManager($xml.NameTable)
                $ns.AddNamespace("ns", "http://schemas.microsoft.com/win/2004/08/events/event")
                switch ($evt.Id) {
                    1 {
                        # Process Create
                        $img = $xml.SelectSingleNode("//ns:Data[@Name='Image']", $ns)
                        $cmd = $xml.SelectSingleNode("//ns:Data[@Name='CommandLine']", $ns)
                        $parent = $xml.SelectSingleNode("//ns:Data[@Name='ParentImage']", $ns)
                        $usr = $xml.SelectSingleNode("//ns:Data[@Name='User']", $ns)
                        $hash = $xml.SelectSingleNode("//ns:Data[@Name='Hashes']", $ns)
                        if ($img) { $d.ProcessName = $img.InnerText; $d.FilePath = $img.InnerText }
                        if ($cmd) { $d.Message = "Command: $($cmd.InnerText)" }
                        if ($parent) { $d.Message += " | Parent: $($parent.InnerText)" }
                        if ($usr) { $d.User = $usr.InnerText }
                        if ($hash) { $d.Message += " | Hash: $($hash.InnerText)" }
                    }
                    3 {
                        # Network Connection
                        $img = $xml.SelectSingleNode("//ns:Data[@Name='Image']", $ns)
                        $dstIP = $xml.SelectSingleNode("//ns:Data[@Name='DestinationIp']", $ns)
                        $dstPort = $xml.SelectSingleNode("//ns:Data[@Name='DestinationPort']", $ns)
                        $usr = $xml.SelectSingleNode("//ns:Data[@Name='User']", $ns)
                        if ($img) { $d.ProcessName = $img.InnerText }
                        if ($dstIP) { $d.IPAddress = $dstIP.InnerText }
                        if ($dstPort) { $d.Message = "Connection to $($dstIP.InnerText):$($dstPort.InnerText)" }
                        if ($usr) { $d.User = $usr.InnerText }
                    }
                    { $_ -in @(8, 10) } {
                        # CreateRemoteThread / ProcessAccess
                        $src = $xml.SelectSingleNode("//ns:Data[@Name='SourceImage']", $ns)
                        $tgt = $xml.SelectSingleNode("//ns:Data[@Name='TargetImage']", $ns)
                        if ($src) { $d.ProcessName = $src.InnerText }
                        if ($tgt) { $d.Message = "Target: $($tgt.InnerText)" }
                    }
                    { $_ -in @(11, 15, 23) } {
                        # FileCreate / FileCreateStreamHash / FileDelete
                        $img = $xml.SelectSingleNode("//ns:Data[@Name='Image']", $ns)
                        $tgtFn = $xml.SelectSingleNode("//ns:Data[@Name='TargetFilename']", $ns)
                        if ($img) { $d.ProcessName = $img.InnerText }
                        if ($tgtFn) { $d.FilePath = $tgtFn.InnerText }
                    }
                    { $_ -in @(12, 13) } {
                        # Registry events
                        $img = $xml.SelectSingleNode("//ns:Data[@Name='Image']", $ns)
                        $tgtObj = $xml.SelectSingleNode("//ns:Data[@Name='TargetObject']", $ns)
                        if ($img) { $d.ProcessName = $img.InnerText }
                        if ($tgtObj) { $d.FilePath = $tgtObj.InnerText }
                    }
                    22 {
                        # DNS Query
                        $img = $xml.SelectSingleNode("//ns:Data[@Name='Image']", $ns)
                        $query = $xml.SelectSingleNode("//ns:Data[@Name='QueryName']", $ns)
                        if ($img) { $d.ProcessName = $img.InnerText }
                        if ($query) { $d.Message = "DNS: $($query.InnerText)"; $d.FilePath = $query.InnerText }
                    }
                    { $_ -in @(19, 20, 21) } {
                        # WMI Activity
                        $operation = $xml.SelectSingleNode("//ns:Data[@Name='Operation']", $ns)
                        $user = $xml.SelectSingleNode("//ns:Data[@Name='User']", $ns)
                        $flt = $xml.SelectSingleNode("//ns:Data[@Name='Name']", $ns)
                        if ($operation) { $d.Message = "WMI $($operation.InnerText) | " }
                        if ($flt) { 
                            $d.Message += "Filter/Consumer: $($flt.InnerText)"
                            $d.FilePath = $flt.InnerText
                        }
                        if ($user) { $d.User = $user.InnerText }
                        $d.Source = "Sysmon-WMI"
                    }
                }
            }
            catch {}
            $events.Add($d)
        }
    }
    catch {
        Write-Log "Sysmon query failed (non-fatal): $($_.Exception.Message)" "WARNING"
    }
    return $events
}

function Get-ADEvents {
    param([datetime]$Since)
    $events = New-EventList
    if (-not $Script:IsDomainController) { return $events }
    try {
        $adIDs = $Script:Config.EventIDs.AD
        if (-not $adIDs -or $adIDs.Count -eq 0) { return $events }

        # Directory Service Changes log
        $raw = Get-WinEvent -FilterHashtable @{
            LogName = "Security"; ID = $adIDs; StartTime = $Since
        } -ErrorAction SilentlyContinue
        foreach ($evt in $raw) { $events.Add((Get-EventDetails -Event $evt)) }

        # DS replication events (DCShadow / DCSync detection)
        $dsRepIDs = @(4928, 4929, 4930, 4931, 4932, 4933, 4934, 4935, 4936)
        $raw2 = Get-WinEvent -FilterHashtable @{
            LogName = "Security"; ID = $dsRepIDs; StartTime = $Since
        } -ErrorAction SilentlyContinue
        foreach ($evt in $raw2) { $events.Add((Get-EventDetails -Event $evt)) }
    }
    catch {
        Write-Log "AD event query failed (non-fatal): $($_.Exception.Message)" "WARNING"
    }
    return $events
}

function Check-WMIPersistence {
    param([datetime]$Since)
    $events = New-EventList
    try {
        $whitelist = $Script:Config.WMIWhitelist
        if (-not $whitelist) { $whitelist = @("SCM Event Log Filter", "SCM Event Log Consumer", "BVTFilter") }

        $filters = Get-WmiObject -Namespace "root\subscription" -Class __EventFilter -ErrorAction SilentlyContinue
        foreach ($f in $filters) {
            $isWhitelisted = $false
            foreach ($w in $whitelist) { if ($f.Name -match $w) { $isWhitelisted = $true; break } }
            if (-not $isWhitelisted) {
                $events.Add(@{
                        Time = Get-Date; EventID = "WMI-Filter"; Level = "Critical"
                        Source = "WMI Persistence"; Machine = $env:COMPUTERNAME
                        Message = "Suspicious WMI EventFilter: $($f.Name) | Query: $($f.Query)"
                        User = "N/A"; IPAddress = "N/A"; ProcessName = "WMI"
                        FilePath = $f.Name; RecordId = "WMI-$($f.Name)"; Reasons = @("WMI persistence detected")
                    })
            }
        }

        $consumers = Get-WmiObject -Namespace "root\subscription" -Class CommandLineEventConsumer -ErrorAction SilentlyContinue
        foreach ($c in $consumers) {
            $isWhitelisted = $false
            foreach ($w in $whitelist) { if ($c.Name -match $w) { $isWhitelisted = $true; break } }
            if (-not $isWhitelisted) {
                $events.Add(@{
                        Time = Get-Date; EventID = "WMI-Consumer"; Level = "Critical"
                        Source = "WMI Persistence"; Machine = $env:COMPUTERNAME
                        Message = "Suspicious CommandLineConsumer: $($c.Name) | Cmd: $($c.CommandLineTemplate)"
                        User = "N/A"; IPAddress = "N/A"; ProcessName = "WMI"
                        FilePath = $c.Name; RecordId = "WMI-$($c.Name)"; Reasons = @("WMI consumer persistence")
                    })
            }
        }

        $bindings = Get-WmiObject -Namespace "root\subscription" -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue
        foreach ($b in $bindings) {
            $isWhitelisted = $false
            foreach ($w in $whitelist) { if ($b.Filter -match $w) { $isWhitelisted = $true; break } }
            if (-not $isWhitelisted) {
                $events.Add(@{
                        Time = Get-Date; EventID = "WMI-Binding"; Level = "Critical"
                        Source = "WMI Persistence"; Machine = $env:COMPUTERNAME
                        Message = "Suspicious WMI Binding: Filter=$($b.Filter) Consumer=$($b.Consumer)"
                        User = "N/A"; IPAddress = "N/A"; ProcessName = "WMI"
                        FilePath = "Binding"; RecordId = "WMI-Bind-$($b.Filter.GetHashCode())"; Reasons = @("WMI binding persistence")
                    })
            }
        }
    }
    catch {
        Write-Log "WMI persistence check failed (non-fatal): $($_.Exception.Message)" "WARNING"
    }
    return $events
}

function Get-TaskSchedulerEvents {
    param([datetime]$Since)
    $events = New-EventList
    try {
        $taskIDs = $Script:Config.EventIDs.ScheduledTaskOperational
        if (-not $taskIDs) { $taskIDs = @(106, 140, 141, 200, 201) }
        $raw = Get-WinEvent -FilterHashtable @{
            LogName = "Microsoft-Windows-TaskScheduler/Operational"; ID = $taskIDs; StartTime = $Since
        } -ErrorAction SilentlyContinue
        foreach ($evt in $raw) {
            $d = @{
                Time = $evt.TimeCreated; EventID = $evt.Id; Level = $evt.LevelDisplayName
                Source = "TaskScheduler"; Machine = $evt.MachineName; Message = $evt.Message
                User = "N/A"; IPAddress = "N/A"; ProcessName = "TaskScheduler"; FilePath = "N/A"
                RecordId = $evt.RecordId; Reasons = @()
            }
            try {
                $xml = [xml]$evt.ToXml()
                $ns = New-Object System.Xml.XmlNamespaceManager($xml.NameTable)
                $ns.AddNamespace("ns", "http://schemas.microsoft.com/win/2004/08/events/event")
                $tn = $xml.SelectSingleNode("//ns:Data[@Name='TaskName']", $ns)
                if ($tn) { $d.FilePath = $tn.InnerText; $d.Message += " | Task: $($tn.InnerText)" }
            }
            catch {}
            if ($d.FilePath -eq "N/A" -and $evt.Message -match "Task Name:\s*([^\r\n]+)") {
                $d.FilePath = $matches[1].Trim()
            }
            $events.Add($d)
        }
    }
    catch {}
    return $events
}

function Get-ServiceEvents {
    param([datetime]$Since)
    $events = New-EventList
    try {
        $svcIDs = @(7034, 7035, 7036, 7040, 7045)
        $raw = Get-WinEvent -FilterHashtable @{LogName = "System"; ID = $svcIDs; StartTime = $Since } -ErrorAction SilentlyContinue
        foreach ($evt in $raw) {
            $d = @{
                Time = $evt.TimeCreated; EventID = $evt.Id; Level = $evt.LevelDisplayName
                Source = "Service Control Manager"; Machine = $evt.MachineName; Message = $evt.Message
                User = "N/A"; IPAddress = "N/A"; ProcessName = "Services"; FilePath = "N/A"
                RecordId = $evt.RecordId; Reasons = @()
            }
            try {
                $xml = [xml]$evt.ToXml()
                $ns = New-Object System.Xml.XmlNamespaceManager($xml.NameTable)
                $ns.AddNamespace("ns", "http://schemas.microsoft.com/win/2004/08/events/event")
                $p1 = $xml.SelectSingleNode("//ns:Data[@Name='param1']", $ns)
                if ($p1) { $d.FilePath = $p1.InnerText; $d.Message += " | Service: $($p1.InnerText)" }
            }
            catch {}
            $events.Add($d)
        }
        # Security log service install (4697)
        $raw2 = Get-WinEvent -FilterHashtable @{LogName = "Security"; ID = 4697; StartTime = $Since } -ErrorAction SilentlyContinue
        foreach ($evt in $raw2) { $events.Add((Get-EventDetails -Event $evt)) }
    }
    catch {}
    return $events
}

function Get-PowerShellEvents {
    param([datetime]$Since)
    $events = New-EventList
    $selfName = "SecurityMonitor"
    try {
        $psIDs = $Script:Config.EventIDs.PowerShell
        if (-not $psIDs) { $psIDs = @(4103, 4104, 4105, 4106) }
        $raw = Get-WinEvent -FilterHashtable @{
            LogName = "Microsoft-Windows-PowerShell/Operational"; ID = $psIDs; StartTime = $Since
        } -ErrorAction SilentlyContinue
        foreach ($evt in $raw) {
            $msg = $evt.Message
            # Skip self-generated events
            if ($msg -match [regex]::Escape($selfName)) { continue }
            if ($evt.Id -eq 4104) {
                if ($msg -match "Creating Scriptblock text \(1 of 1\):\s*([^\r\n]+)") {
                    $cmd = $matches[1].Trim()
                    if ($cmd -match "^\s*prompt\s*$|^\s*cd\s+\S+\s*$|^\s*\$Host\s*$|Get-Location\s*$|Get-Command\s*$|Get-Help\s*$|^\s*dir\s*$|^\s*ls\s*$|^\s*pwd\s*$|^\s*clear\s*$|Set-StrictMode|ErrorCategory_Message|PSMessageDetails") {
                        continue
                    }
                }
            }
            if ($evt.Id -in @(4105, 4106)) {
                if ($msg -match "prompt|Runspace|ScriptBlock ID|Completed invocation|Started invocation") { continue }
            }
            $userId = "N/A"
            try {
                $xml = [xml]$evt.ToXml()
                $ns = New-Object System.Xml.XmlNamespaceManager($xml.NameTable)
                $ns.AddNamespace("ns", "http://schemas.microsoft.com/win/2004/08/events/event")
                $userSid = $xml.SelectSingleNode("//ns:UserId", $ns)
                if ($userSid) { $userId = Get-UserFromSID -SID $userSid.InnerText }
            }
            catch {}
            if ($userId -eq "N/A") { $userId = $env:USERNAME }
            $events.Add(@{
                    Time = $evt.TimeCreated; EventID = $evt.Id; Level = "Warning"
                    Source = "PowerShell"; Machine = $evt.MachineName; Message = $msg
                    User = $userId; IPAddress = "N/A"; ProcessName = "PowerShell"; FilePath = "N/A"
                    RecordId = $evt.RecordId; Reasons = @()
                })
        }
    }
    catch {}
    return $events
}

function Test-NoiseFilter {
    param([hashtable]$Event)
    if ($Event.User -in $Script:Config.NoiseFilters.Users) {
        foreach ($np in $Script:Config.NoiseFilters.Paths) {
            if ($Event.FilePath -match $np -or $Event.Message -match $np) { return $true }
        }
    }
    return $false
}

function Test-SuspiciousActivity {
    param([hashtable]$Event)
    $isSuspicious = $false
    $reasons = [System.Collections.Generic.List[string]]::new()

    # Suspicious process
    if ($Event.ProcessName) {
        $procBase = Split-Path -Leaf $Event.ProcessName -ErrorAction SilentlyContinue
        if ($procBase -and $procBase -in $Script:Config.SuspiciousProcesses) {
            $isSuspicious = $true; $reasons.Add("Suspicious process: $procBase")
        }
    }

    # Suspicious file type
    if ($Event.FilePath -match "\.(exe|dll|bat|cmd|ps1|vbs|js|jar|hta|scr)$") {
        $isSuspicious = $true; $reasons.Add("Suspicious file type: $($Event.FilePath)")
    }

    # Failed logon
    if ($Event.EventID -eq 4625) { $isSuspicious = $true; $reasons.Add("Failed logon attempt") }

    # Admin activity (not PS noise)
    if ($Event.User -match "Administrator|Admin" -and $Event.EventID -notin @(4104, 4105, 4106)) {
        if ($Event.EventID -in @(4624, 4648, 4672, 4720, 4722, 4724, 4726, 4728, 4732, 4733, 4756)) {
            $isSuspicious = $true; $reasons.Add("Administrator account activity")
        }
    }

    # External IP — fixed to exclude localhost/loopback
    if ($Event.IPAddress -and $Event.IPAddress -ne "N/A" -and $Event.IPAddress -ne "-" -and
        $Event.IPAddress -ne "127.0.0.1" -and $Event.IPAddress -ne "::1" -and
        $Event.IPAddress -notmatch "^192\.168\.|^10\.|^172\.(1[6-9]|2[0-9]|3[0-1])\.") {
        $isSuspicious = $true; $reasons.Add("External IP: $($Event.IPAddress)")
    }

    # Account modification
    if ($Event.EventID -in $Script:Config.EventIDs.Account) {
        $isSuspicious = $true; $reasons.Add("Account modification detected")
    }

    # PowerShell attack patterns
    if ($Event.EventID -in @(4104, 4105, 4106)) {
        if ($Event.Message -match "Invoke-Expression|IEX|DownloadString|WebClient|Net\.WebClient|Start-Process.*-WindowStyle.*Hidden|Invoke-WebRequest.*-UseBasicParsing|base64.*encoded|bypass.*execution|obfuscated|Invoke-Mimikatz|Invoke-Kerberoast|Invoke-BloodHound|Invoke-SMBExec|Invoke-WMIExec|Invoke-DCSync|SharpHound|Rubeus") {
            $isSuspicious = $true; $reasons.Add("Suspicious PowerShell command")
        }
    }

    # Kerberoasting: TGS request with RC4 encryption
    if ($Event.EventID -eq 4769 -and $Event.Message -match "EncType:\s*0x17") {
        $isSuspicious = $true; $reasons.Add("Possible Kerberoasting (RC4 TGS request)")
    }

    # AS-REP Roasting
    if ($Event.EventID -eq 4768 -and $Event.Message -match "EncType:\s*0x17") {
        $isSuspicious = $true; $reasons.Add("Possible AS-REP roasting (RC4 TGT)")
    }

    # Pre-auth failure
    if ($Event.EventID -eq 4771) { $isSuspicious = $true; $reasons.Add("Kerberos pre-auth failure") }

    # Sysmon: CreateRemoteThread (injection)
    if ($Event.Source -eq "Sysmon" -and $Event.EventID -eq 8) {
        $isSuspicious = $true; $reasons.Add("Remote thread injection (Sysmon)")
    }

    # Sysmon: Process Access (credential dumping — lsass)
    if ($Event.Source -eq "Sysmon" -and $Event.EventID -eq 10) {
        if ($Event.Message -match "lsass\.exe") {
            $isSuspicious = $true; $reasons.Add("LSASS access detected (credential dumping?)")
        }
    }

    # WMI persistence
    if ($Event.Source -match "WMI Persistence|WMI-Activity|Sysmon-WMI") {
        $isSuspicious = $true
        $reasons.Add("WMI persistence activity detected: $($Event.Source)")
    }

    # AD replication events (DCSync)
    if ($Event.EventID -in @(4928, 4929, 4662)) {
        if ($Event.Message -match "Replicating Directory Changes|DS-Replication-Get-Changes") {
            $isSuspicious = $true; $reasons.Add("Possible DCSync attack")
        }
    }

    return @{ IsSuspicious = $isSuspicious; Reasons = $reasons }
}

function Remove-DuplicateEvents {
    param([System.Collections.Generic.List[object]]$Events)
    $unique = New-EventList
    $seen = @{}
    foreach ($evt in $Events) {
        $key = "$($evt.RecordId)-$($evt.EventID)-$($evt.Time.ToString('yyyyMMddHHmmss'))"
        if (-not $seen.ContainsKey($key)) { $seen[$key] = $true; $unique.Add($evt) }
    }
    return $unique
}

function Detect-BruteForce {
    param([System.Collections.Generic.List[object]]$Events)
    $threshold = $Script:Config.BruteForceThreshold
    if (-not $threshold) { $threshold = 5 }
    $failedLogons = $Events | Where-Object { $_.EventID -eq 4625 }
    if ($failedLogons.Count -lt $threshold) { return }

    # Group by source IP
    $byIP = @{}
    foreach ($evt in $failedLogons) {
        $ip = if ($evt.IPAddress -and $evt.IPAddress -ne "N/A") { $evt.IPAddress } else { "Unknown" }
        if (-not $byIP.ContainsKey($ip)) { $byIP[$ip] = 0 }
        $byIP[$ip]++
    }
    foreach ($ip in $byIP.Keys) {
        if ($byIP[$ip] -ge $threshold) {
            Write-Log "BRUTE FORCE: $($byIP[$ip]) failed logons from $ip in last check window!" "CRITICAL"
            $alert = @{
                Time = Get-Date; EventID = "BruteForce"; Level = "Critical"
                Source = "BruteForce Detection"; Machine = $env:COMPUTERNAME
                Message = "$($byIP[$ip]) failed logon attempts from IP: $ip"
                User = "Multiple"; IPAddress = $ip; ProcessName = "N/A"; FilePath = "N/A"
                RecordId = "BF-$ip"; Reasons = @("Brute force: $($byIP[$ip]) attempts from $ip")
            }
            Show-Alert -Events @($alert) -AlertType "BRUTE FORCE ATTACK DETECTED"
        }
    }

    # Group by target user
    $byUser = @{}
    foreach ($evt in $failedLogons) {
        $user = if ($evt.User -and $evt.User -ne "N/A") { $evt.User } else { "Unknown" }
        if (-not $byUser.ContainsKey($user)) { $byUser[$user] = 0 }
        $byUser[$user]++
    }
    foreach ($user in $byUser.Keys) {
        if ($byUser[$user] -ge $threshold -and $user -ne "Unknown") {
            Write-Log "BRUTE FORCE: $($byUser[$user]) failed logons targeting user '$user'!" "CRITICAL"
        }
    }
}

function Write-AlertToLog {
    param([array]$Events, [string]$AlertType = "Security Event")
    if (-not $Script:LogFilePath -or [string]::IsNullOrWhiteSpace($Script:LogFilePath)) { return }
    try {
        $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
        $logEntry = "`n" + ("=" * 100)
        $logEntry += "`n$AlertType - $($Events.Count) Event(s) - $timestamp"
        $logEntry += "`nSystem: $($Script:Config.SystemName) | Domain: $($Script:Config.Domain)"
        $logEntry += "`n" + ("-" * 100)
        foreach ($evt in $Events) {
            $logEntry += "`nEvent ID: $($evt.EventID) | Level: $($evt.Level) | Time: $($evt.Time.ToString('yyyy-MM-dd HH:mm:ss'))"
            $logEntry += "`nUser: $($evt.User)"
            if ($evt.IPAddress -ne "N/A") { $logEntry += " | IP: $($evt.IPAddress)" }
            if ($evt.ProcessName -ne "N/A") { $logEntry += "`nProcess: $($evt.ProcessName)" }
            if ($evt.FilePath -ne "N/A" -and $evt.FilePath -ne $evt.ProcessName) { $logEntry += "`nPath: $($evt.FilePath)" }
            if ($evt.Reasons -and $evt.Reasons.Count -gt 0) { $logEntry += "`nFlags: $($evt.Reasons -join ', ')" }
            $msgLines = ($evt.Message -split "`n" | Select-Object -First 3) -join " | "
            $logEntry += "`nDetails: $msgLines"
            $logEntry += "`n" + ("-" * 100)
        }
        $logEntry += "`n" + ("=" * 100)
        Add-Content -Path $Script:LogFilePath -Value $logEntry -ErrorAction SilentlyContinue
    }
    catch {}
}

function Show-Alert {
    param([array]$Events, [string]$AlertType = "Security Event")
    $isSuspicious = $AlertType -match "SUSPICIOUS|BRUTE|WMI"
    $sep = "".PadRight(100, "=")
    $dash = "".PadRight(100, "-")
    Write-Host ""
    Write-Host $sep -ForegroundColor Cyan
    if ($isSuspicious) {
        Write-Host "$AlertType - $($Events.Count) Event(s)" -ForegroundColor Red -BackgroundColor Yellow
    }
    else {
        Write-Host "$AlertType - $($Events.Count) Event(s)" -ForegroundColor Yellow
    }
    Write-Host $sep -ForegroundColor Cyan
    Write-Host "System: " -NoNewline -ForegroundColor Gray; Write-Host $Script:Config.SystemName -ForegroundColor White
    Write-Host "Time: " -NoNewline -ForegroundColor Gray; Write-Host (Get-Date -Format "yyyy-MM-dd HH:mm:ss") -ForegroundColor White
    Write-Host $dash -ForegroundColor DarkGray
    Write-AlertToLog -Events $Events -AlertType $AlertType

    foreach ($ev in $Events) {
        $ec = if ($isSuspicious) { "Red" } else { "Yellow" }
        Write-Host "Event ID: " -NoNewline -ForegroundColor $ec; Write-Host "$($ev.EventID)" -ForegroundColor White
        Write-Host "Source: " -NoNewline -ForegroundColor Gray; Write-Host "$($ev.Source)" -ForegroundColor White
        Write-Host "Time: " -NoNewline -ForegroundColor Gray; Write-Host "$($ev.Time.ToString('MM/dd/yyyy HH:mm:ss'))" -ForegroundColor White
        Write-Host "User: " -NoNewline -ForegroundColor Gray; Write-Host "$($ev.User)" -ForegroundColor White
        if ($ev.IPAddress -ne "N/A") { Write-Host "IP: " -NoNewline -ForegroundColor Gray; Write-Host "$($ev.IPAddress)" -ForegroundColor White }
        if ($ev.ProcessName -ne "N/A") {
            $procBase = Split-Path -Leaf $ev.ProcessName -ErrorAction SilentlyContinue
            if ($procBase -and $procBase -in $Script:Config.SuspiciousProcesses) {
                Write-Host "Process: " -NoNewline -ForegroundColor Gray; Write-Host "$($ev.ProcessName) [SUSPICIOUS]" -ForegroundColor Red
            }
            else {
                Write-Host "Process: " -NoNewline -ForegroundColor Gray; Write-Host "$($ev.ProcessName)" -ForegroundColor White
            }
        }
        if ($ev.FilePath -ne "N/A" -and $ev.FilePath -ne $ev.ProcessName) {
            Write-Host "Path: " -NoNewline -ForegroundColor Gray; Write-Host "$($ev.FilePath)" -ForegroundColor White
        }
        if ($ev.EventID -eq 4104 -and $ev.Message -match "Creating Scriptblock text \(1 of 1\):\s*([^\r\n]+)") {
            Write-Host "Command: " -NoNewline -ForegroundColor Cyan; Write-Host $matches[1].Trim() -ForegroundColor Yellow
        }
        if ($ev.Reasons -and $ev.Reasons.Count -gt 0) {
            Write-Host "Flags:" -ForegroundColor Red
            foreach ($r in $ev.Reasons) { Write-Host "  $r" -ForegroundColor Red }
        }
        # Show first 3 lines of message
        $msgLines = $ev.Message -split "`n" | Select-Object -First 3
        foreach ($line in $msgLines) {
            $t = $line.Trim()
            if ($t -and $t -notmatch "Creating Scriptblock text") { Write-Host "  $t" -ForegroundColor DarkGray }
        }
        Write-Host $dash -ForegroundColor DarkGray
    }
    Write-Host $sep -ForegroundColor Cyan
    Write-Host ""
}

function Set-AuditPolicies {
    Write-Log "Setting up audit policies..." "INFO"
    $policies = @(
        @{Subcategory = "Process Creation"; Include = "Command Line" },
        @{Subcategory = "File System" }, @{Subcategory = "Logon" }, @{Subcategory = "Logoff" },
        @{Subcategory = "Account Lockout" }, @{Subcategory = "User Account Management" },
        @{Subcategory = "Security Group Management" }, @{Subcategory = "Audit Policy Change" },
        @{Subcategory = "Security System Extension" }, @{Subcategory = "Other System Events" },
        @{Subcategory = "Other Object Access Events" }, @{Subcategory = "Registry" },
        @{Subcategory = "Kerberos Authentication Service" }, @{Subcategory = "Kerberos Service Ticket Operations" }
    )
    $ok = 0; $fail = 0
    foreach ($p in $policies) {
        $result = auditpol /set /subcategory:"$($p.Subcategory)" /success:enable /failure:enable 2>&1
        if ($LASTEXITCODE -eq 0) { Write-Log "$($p.Subcategory): Enabled" "SUCCESS"; $ok++ }
        else { Write-Log "Failed: $($p.Subcategory): $result" "ERROR"; $fail++ }
        if ($p.Include -eq "Command Line") {
            $regPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit"
            try {
                if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null }
                Set-ItemProperty -Path $regPath -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -Type DWord -Force
                Write-Log "Command Line in Process Creation: Enabled" "SUCCESS"
            }
            catch { Write-Log "Failed cmd line audit: $($_.Exception.Message)" "ERROR"; $fail++ }
        }
    }
    Write-Log "Applied $ok policies, $fail failed" "INFO"
}

function Enable-PowerShellLogging {
    Write-Log "Enabling PowerShell logging..." "INFO"
    try {
        $mp = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging"
        if (-not (Test-Path $mp)) { New-Item -Path $mp -Force | Out-Null }
        Set-ItemProperty -Path $mp -Name "EnableModuleLogging" -Value 1 -Type DWord -Force
        Write-Log "Module logging enabled" "SUCCESS"
    }
    catch { Write-Log "Module logging failed: $($_.Exception.Message)" "ERROR" }
    try {
        $sp = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
        if (-not (Test-Path $sp)) { New-Item -Path $sp -Force | Out-Null }
        Set-ItemProperty -Path $sp -Name "EnableScriptBlockLogging" -Value 1 -Type DWord -Force
        Set-ItemProperty -Path $sp -Name "EnableScriptBlockInvocationLogging" -Value 1 -Type DWord -Force
        Write-Log "Script block logging enabled" "SUCCESS"
    }
    catch { Write-Log "Script block logging failed: $($_.Exception.Message)" "ERROR" }
    try {
        $tp = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription"
        if (-not (Test-Path $tp)) { New-Item -Path $tp -Force | Out-Null }
        Set-ItemProperty -Path $tp -Name "EnableTranscripting" -Value 1 -Type DWord -Force
        Set-ItemProperty -Path $tp -Name "EnableInvocationHeader" -Value 1 -Type DWord -Force
        Set-ItemProperty -Path $tp -Name "OutputDirectory" -Value "C:\PowerShell_Transcripts" -Type String -Force
        Write-Log "Transcription enabled" "SUCCESS"
    }
    catch { Write-Log "Transcription failed: $($_.Exception.Message)" "WARNING" }
    Write-Log "PowerShell logging complete. Restart PS sessions for effect." "SUCCESS"
}

function Detect-WMIActivity {
    param([datetime]$Since)
    $events = New-EventList
    try {
        $logName = "Microsoft-Windows-WMI-Activity/Operational"
        # 5861: A permanent event consumer was created
        $raw = Get-WinEvent -FilterHashtable @{LogName = $logName; ID = 5861; StartTime = $Since } -ErrorAction SilentlyContinue
        foreach ($evt in $raw) {
            $events.Add(@{
                    Time = $evt.TimeCreated; EventID = $evt.Id; Level = "Critical"
                    Source = "WMI-Activity"; Machine = $evt.MachineName
                    Message = "Permanent WMI Consumer Created: $($evt.Message)"
                    User = "N/A"; IPAddress = "N/A"; ProcessName = "WMI"
                    FilePath = "WMI-Consumer"; RecordId = $evt.RecordId
                    Reasons = @("Real-time WMI persistence detection")
                })
        }
    }
    catch {
        Write-Log "WMI Activity check failed: $($_.Exception.Message)" "WARNING"
    }
    return $events
    if ($check.IsSuspicious) {
        $evt.Reasons = $check.Reasons
        $suspiciousEvents.Add($evt)
        $suspiciousRecordIds["$($evt.RecordId)-$($evt.EventID)"] = $true
        continue  # Don't double-display
    }

    # Otherwise classify as important
    $isImportant = $false
    if ($evt.EventID -in @(4688, 4625)) { $isImportant = $true }
    if ($evt.EventID -in $Script:Config.EventIDs.Account) { $isImportant = $true }
    if ($evt.EventID -in @(4660, 4663, 4658, 4699, 4654, 4670, 4657)) { $isImportant = $true }
    if ($evt.EventID -in $Script:Config.EventIDs.ScheduledTask) { $isImportant = $true }
    if ($evt.EventID -in $Script:Config.EventIDs.ScheduledTaskOperational) { $isImportant = $true }
    if ($evt.EventID -in @(4697, 7034, 7035, 7036, 7040, 7045)) { $isImportant = $true }
    if ($evt.EventID -in @(4768, 4769, 4771, 4776, 4782)) { $isImportant = $true }
    if ($evt.EventID -eq 4104) { $isImportant = $true }
    if ($evt.Source -eq "Sysmon") { $isImportant = $true }
    if ($evt.Source -eq "WMI Persistence") { $isImportant = $true }
    if ($isImportant) { $importantEvents.Add($evt) }
}

Write-Log "Important: $($importantEvents.Count), Suspicious: $($suspiciousEvents.Count)" "INFO"

if ($importantEvents.Count -gt 0) {
    Show-Alert -Events $importantEvents -AlertType "Security Events Detected"
    $wmiPersistence = Check-WMIPersistence -Since $Since
    if ($wmiPersistence.Count -gt 0) { Write-Log "WMI Persistence (Scan): $($wmiPersistence.Count) FOUND!" "CRITICAL" }

    $wmiActivity = Detect-WMIActivity -Since $Since
    if ($wmiActivity.Count -gt 0) { Write-Log "WMI Activity (Real-time): $($wmiActivity.Count) DETECTED!" "CRITICAL" }

    # Merge all
    $allEvents = New-EventList
    foreach ($src in @($secEvents, $psEvents, $taskEvents, $svcEvents, $sysmonEvents, $adEvents, $wmiPersistence, $wmiActivity)) {
        # Brute force detection
        Detect-BruteForce -Events $allEvents
    }

    return $currentTime
}

function Show-AuditStatus {
    Write-Host ""
    Write-Host "===================================================================" -ForegroundColor Cyan
    Write-Host "AUDIT POLICY STATUS" -ForegroundColor Cyan
    Write-Host "===================================================================" -ForegroundColor Cyan
    $policies = @(
        @{Name = "Process Creation"; Subcategory = "Process Creation" },
        @{Name = "Command Line"; Type = "Registry" },
        @{Name = "File System"; Subcategory = "File System" },
        @{Name = "Logon"; Subcategory = "Logon" },
        @{Name = "Other System Events"; Subcategory = "Other System Events" },
        @{Name = "Other Object Access Events"; Subcategory = "Other Object Access Events" },
        @{Name = "Kerberos Auth"; Subcategory = "Kerberos Authentication Service" },
        @{Name = "Kerberos TGS"; Subcategory = "Kerberos Service Ticket Operations" }
    )
    foreach ($p in $policies) {
        if ($p.Type -eq "Registry") {
            try {
                $reg = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -ErrorAction SilentlyContinue
                if ($reg -and $reg.ProcessCreationIncludeCmdLine_Enabled -eq 1) {
                    Write-Host "[OK] $($p.Name): ENABLED" -ForegroundColor Green
                }
                else { Write-Host "[X] $($p.Name): DISABLED" -ForegroundColor Red }
            }
            catch { Write-Host "[X] $($p.Name): DISABLED" -ForegroundColor Red }
        }
        else {
            $status = auditpol /get /subcategory:"$($p.Subcategory)" 2>&1 | Out-String
            if ($status -match "Success and Failure") { Write-Host "[OK] $($p.Name): ENABLED" -ForegroundColor Green }
            else { Write-Host "[X] $($p.Name): DISABLED" -ForegroundColor Red }
        }
    }
    Write-Host ""
    # Sysmon status
    if ($Script:HasSysmon) { Write-Host "[OK] Sysmon: RUNNING" -ForegroundColor Green }
    else { Write-Host "[--] Sysmon: NOT RUNNING" -ForegroundColor Yellow }
    if ($Script:IsDomainController) { Write-Host "[OK] Domain Controller: YES" -ForegroundColor Green }
    else { Write-Host "[--] Domain Controller: NO" -ForegroundColor Yellow }
    Write-Host ""
    Write-Host "Press any key to continue..." -ForegroundColor Gray
    $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
}

function Enable-IndividualAudit {
    Write-Host ""
    Write-Host "===================================================================" -ForegroundColor Cyan
    Write-Host "ENABLE INDIVIDUAL AUDIT POLICY" -ForegroundColor Cyan
    Write-Host "===================================================================" -ForegroundColor Cyan
    Write-Host "1. Process Creation" -ForegroundColor Yellow
    Write-Host "2. Command Line" -ForegroundColor Yellow
    Write-Host "3. File System" -ForegroundColor Yellow
    Write-Host "4. Logon" -ForegroundColor Yellow
    Write-Host "5. Other System Events (Scheduled Tasks)" -ForegroundColor Yellow
    Write-Host "6. Other Object Access Events" -ForegroundColor Yellow
    Write-Host "7. Kerberos Auditing" -ForegroundColor Yellow
    Write-Host "8. Enable All" -ForegroundColor Yellow
    Write-Host "9. Back" -ForegroundColor Yellow
    $choice = Read-Host "Select option (1-9)"
    switch ($choice) {
        "1" { auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable; Write-Host "Enabled" -ForegroundColor Green }
        "2" {
            $rp = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit"
            if (-not (Test-Path $rp)) { New-Item -Path $rp -Force | Out-Null }
            Set-ItemProperty -Path $rp -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -Type DWord -Force
            Write-Host "Enabled" -ForegroundColor Green
        }
        "3" { auditpol /set /subcategory:"File System" /success:enable /failure:enable; Write-Host "Enabled" -ForegroundColor Green }
        "4" { auditpol /set /subcategory:"Logon" /success:enable /failure:enable; Write-Host "Enabled" -ForegroundColor Green }
        "5" { auditpol /set /subcategory:"Other System Events" /success:enable /failure:enable; Write-Host "Enabled" -ForegroundColor Green }
        "6" { auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable; Write-Host "Enabled" -ForegroundColor Green }
        "7" {
            auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
            auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
            Write-Host "Kerberos auditing enabled" -ForegroundColor Green
        }
        "8" { Set-AuditPolicies; Write-Host "All enabled" -ForegroundColor Green }
    }
    if ($choice -ne "9") {
        Write-Host "Press any key..." -ForegroundColor Gray
        $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
    }
}

function List-SACLs {
    Write-Host ""
    Write-Host "===================================================================" -ForegroundColor Cyan
    Write-Host "FOLDERS WITH SACLs" -ForegroundColor Cyan
    Write-Host "===================================================================" -ForegroundColor Cyan
    $paths = @(
        "C:\Windows\System32\drivers\etc", "C:\Windows\System32\Tasks",
        "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup",
        "C:\inetpub", "C:\Windows\Temp"
    )
    $found = 0
    foreach ($path in $paths) {
        if (Test-Path $path) {
            try {
                $acl = Get-Acl $path -Audit -ErrorAction SilentlyContinue
                if ($acl -and $acl.Audit) {
                    $rules = $acl.Audit | Where-Object { $_.AuditFlags -ne "None" }
                    if ($rules) {
                        $found++
                        Write-Host "[OK] $path" -ForegroundColor Green
                        foreach ($r in $rules) {
                            Write-Host "  Identity: $($r.IdentityReference) | Rights: $($r.FileSystemRights) | Flags: $($r.AuditFlags)" -ForegroundColor Gray
                        }
                    }
                }
            }
            catch {}
        }
    }
    if ($found -eq 0) {
        Write-Host "[X] No SACLs found. Use option 5 to add them." -ForegroundColor Red
    }
    Write-Host ""
    Write-Host "Press any key..." -ForegroundColor Gray
    $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
}

function Add-SACL {
    Write-Host ""
    Write-Host "===================================================================" -ForegroundColor Cyan
    Write-Host "ADD SACL TO FOLDER" -ForegroundColor Cyan
    Write-Host "===================================================================" -ForegroundColor Cyan
    Write-Host "WARNING: Do NOT add SACLs to entire System32!" -ForegroundColor Yellow
    Write-Host "Recommended: drivers\etc, Tasks, Startup folders" -ForegroundColor Green
    $folderPath = Read-Host "Folder path (Enter for C:\Windows\System32\Tasks)"
    if ([string]::IsNullOrWhiteSpace($folderPath)) { $folderPath = "C:\Windows\System32\Tasks" }
    if (-not (Test-Path $folderPath)) { Write-Host "ERROR: Path not found" -ForegroundColor Red; return }
    try {
        $acl = Get-Acl $folderPath
        $rule = New-Object System.Security.AccessControl.FileSystemAuditRule(
            "Everyone", "Delete, WriteData, CreateFiles, WriteAttributes, ChangePermissions, TakeOwnership",
            "ContainerInherit,ObjectInherit", "None", "Success, Failure"
        )
        $acl.SetAuditRule($rule)
        Set-Acl $folderPath $acl
        Write-Host "[OK] SACL added to $folderPath" -ForegroundColor Green
    }
    catch { Write-Host "[X] Failed: $($_.Exception.Message)" -ForegroundColor Red }
    Write-Host "Press any key..." -ForegroundColor Gray
    $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
}

function Change-LogPath {
    Write-Host "Current: $Script:LogFilePath" -ForegroundColor Yellow
    $newPath = Read-Host "New log path (Enter for default)"
    if ([string]::IsNullOrWhiteSpace($newPath)) { $newPath = ".\SecurityMonitor_$(Get-Date -Format 'yyyyMMdd').log" }
    $dir = Split-Path -Path $newPath -Parent
    if (-not [string]::IsNullOrWhiteSpace($dir) -and -not (Test-Path $dir)) {
        try { New-Item -ItemType Directory -Path $dir -Force | Out-Null } catch { Write-Host "[X] Can't create dir" -ForegroundColor Red; return }
    }
    $Script:LogFilePath = $newPath
    Write-Log "Log path changed to: $newPath" "INFO"
    Write-Host "Press any key..." -ForegroundColor Gray
    $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
}

function Start-Monitoring {
    Write-Log "Starting Security Monitor on $($Script:Config.SystemName)" "INFO"
    Write-Log "Interval: ${CheckInterval}s | Lookback: $($Script:Config.LookbackMinutes)m" "INFO"
    if ($Script:HasSysmon) { Write-Log "Sysmon: ACTIVE" "SUCCESS" }
    if ($Script:IsDomainController) { Write-Log "AD Monitoring: ACTIVE" "SUCCESS" }

    $lastCheck = (Get-Date).AddMinutes(-$Script:Config.LookbackMinutes)
    $nextAutoCheck = (Get-Date).AddSeconds($CheckInterval)
    $lastMenuDisplay = (Get-Date).AddSeconds(-10)

    while ($true) {
        if ((Get-Date) -ge $nextAutoCheck) {
            Write-Host ""
            Write-Host "===================================================================" -ForegroundColor Cyan
            Write-Host "AUTOMATIC CHECK" -ForegroundColor Cyan
            Write-Host "===================================================================" -ForegroundColor Cyan
            $lastCheck = Check-Events -Since $lastCheck
            $nextAutoCheck = (Get-Date).AddSeconds($CheckInterval)
            $lastMenuDisplay = Get-Date
        }

        if ((Get-Date) -ge $lastMenuDisplay.AddSeconds(5)) {
            Write-Host ""
            Write-Host "===================================================================" -ForegroundColor Cyan
            Write-Host "MONITORING MENU (v2.0)" -ForegroundColor Cyan
            Write-Host "===================================================================" -ForegroundColor Cyan
            Write-Host "ENTER - Force check now" -ForegroundColor Yellow
            Write-Host "1 - Verify audit policies" -ForegroundColor Yellow
            Write-Host "2 - Audit policy status" -ForegroundColor Yellow
            Write-Host "3 - Enable individual audit" -ForegroundColor Yellow
            Write-Host "4 - List SACLs" -ForegroundColor Yellow
            Write-Host "5 - Add SACL to folder" -ForegroundColor Yellow
            Write-Host "6 - Change log path" -ForegroundColor Yellow
            Write-Host "7 - WMI persistence scan" -ForegroundColor Yellow
            Write-Host "Q - Quit" -ForegroundColor Yellow
            Write-Host "===================================================================" -ForegroundColor Cyan
            $caps = @()
            if ($Script:HasSysmon) { $caps += "Sysmon" }
            if ($Script:IsDomainController) { $caps += "AD" }
            $caps += "WMI"
            Write-Host "Active: $($caps -join ', ') | Next check: $($nextAutoCheck.ToString('HH:mm:ss'))" -ForegroundColor Gray
            Write-Host "Log: $Script:LogFilePath" -ForegroundColor Gray
            $lastMenuDisplay = Get-Date
        }

        if ($Host.UI.RawUI.KeyAvailable) {
            $key = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
            if ($key.Character -eq 'q' -or $key.Character -eq 'Q') {
                Write-Log "Stopping monitor..." "INFO"; break
            }
            elseif ($key.VirtualKeyCode -eq 13 -or $key.Character -eq "`r") {
                Write-Host "FORCING CHECK..." -ForegroundColor Cyan
                $lastCheck = Check-Events -Since $lastCheck
                $nextAutoCheck = (Get-Date).AddSeconds($CheckInterval)
                $lastMenuDisplay = Get-Date
            }
            elseif ($key.Character -eq '1') {
                if (Test-Path $Script:VerifyScriptPath) { & $Script:VerifyScriptPath }
                else { Write-Host "[X] Verify script not found: $Script:VerifyScriptPath" -ForegroundColor Red }
                $lastMenuDisplay = Get-Date
            }
            elseif ($key.Character -eq '2') { Show-AuditStatus; $lastMenuDisplay = Get-Date }
            elseif ($key.Character -eq '3') { Enable-IndividualAudit; $lastMenuDisplay = Get-Date }
            elseif ($key.Character -eq '4') { List-SACLs; $lastMenuDisplay = Get-Date }
            elseif ($key.Character -eq '5') { Add-SACL; $lastMenuDisplay = Get-Date }
            elseif ($key.Character -eq '6') { Change-LogPath; $lastMenuDisplay = Get-Date }
            elseif ($key.Character -eq '7') {
                Write-Host "Running WMI persistence scan..." -ForegroundColor Cyan
                $wmiResults = Check-WMIPersistence -Since (Get-Date)
                if ($wmiResults.Count -gt 0) {
                    Show-Alert -Events $wmiResults -AlertType "WMI PERSISTENCE DETECTED"
                }
                else { Write-Host "[OK] No suspicious WMI persistence found" -ForegroundColor Green }
                Write-Host "Press any key..." -ForegroundColor Gray
                $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
                $lastMenuDisplay = Get-Date
            }
        }
        Start-Sleep -Milliseconds 100
    }
}

if ($SetupAudit) {
    Write-Log "Running audit setup..." "INFO"
    Set-AuditPolicies
    Enable-PowerShellLogging
    $ml = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Name "EnableModuleLogging" -ErrorAction SilentlyContinue
    $sb = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -ErrorAction SilentlyContinue
    if ($ml.EnableModuleLogging -eq 1) { Write-Log "Module Logging: ENABLED" "SUCCESS" }
    else { Write-Log "Module Logging: NOT ENABLED" "ERROR" }
    if ($sb.EnableScriptBlockLogging -eq 1) { Write-Log "Script Block Logging: ENABLED" "SUCCESS" }
    else { Write-Log "Script Block Logging: NOT ENABLED" "ERROR" }
    Write-Log "Setup complete! Restart PowerShell for changes." "SUCCESS"
    exit 0
}

Clear-Host
Write-Host "POWERSHELL SECURITY MONITOR v2.0" -ForegroundColor Cyan
Write-Host ""

$isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) { Write-Warning "Run as Administrator for full functionality" }

$auditStatus = auditpol /get /subcategory:"Process Creation" 2>&1 | Out-String
if ($auditStatus -notmatch "Success and Failure") {
    Write-Host "WARNING: Process Creation auditing NOT enabled!" -ForegroundColor Red
    Write-Host "Run: .\SecurityMonitor.ps1 -SetupAudit" -ForegroundColor Yellow
    Write-Host ""
}

Write-Log "Monitor initialized" "INFO"
Write-Log "System: $($Script:Config.SystemName)" "INFO"
Write-Log "Domain: $($Script:Config.Domain)" "INFO"
if ($Script:HasSysmon) { Write-Log "Sysmon: ACTIVE" "SUCCESS" } else { Write-Log "Sysmon: INACTIVE (install with -InstallSysmon)" "WARNING" }
if ($Script:IsDomainController) { Write-Log "AD Monitoring: ACTIVE" "SUCCESS" } else { Write-Log "AD Monitoring: INACTIVE (not a DC)" "INFO" }
Write-Log "WMI Persistence Scanning: ACTIVE" "SUCCESS"

if ($Script:LogFilePath) { Write-Log "Logging to: $Script:LogFilePath" "INFO" }
else { Write-Log "File logging: DISABLED" "WARNING" }

Start-Monitoring
Write-Log "Monitor initialized" "INFO"
Write-Log "System: $($Script:Config.SystemName)" "INFO"
Write-Log "Domain: $($Script:Config.Domain)" "INFO"
if ($Script:HasSysmon) { Write-Log "Sysmon: ACTIVE" "SUCCESS" } else { Write-Log "Sysmon: INACTIVE (install with -InstallSysmon)" "WARNING" }
if ($Script:IsDomainController) { Write-Log "AD Monitoring: ACTIVE" "SUCCESS" } else { Write-Log "AD Monitoring: INACTIVE (not a DC)" "INFO" }
Write-Log "WMI Persistence Scanning: ACTIVE" "SUCCESS"

if ($Script:LogFilePath) { Write-Log "Logging to: $Script:LogFilePath" "INFO" }
else { Write-Log "File logging: DISABLED" "WARNING" }

Start-Monitoring
            elseif ($key.Character -eq '7') {
                Write-Host "Running WMI persistence scan..." -ForegroundColor Cyan
                $wmiResults = Check-WMIPersistence -Since (Get-Date)
                if ($wmiResults.Count -gt 0) {
                    Show-Alert -Events $wmiResults -AlertType "WMI PERSISTENCE DETECTED"
                }
                else { Write-Host "[OK] No suspicious WMI persistence found" -ForegroundColor Green }
                Write-Host "Press any key..." -ForegroundColor Gray
                $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
                $lastMenuDisplay = Get-Date
            }
        }
        Start-Sleep -Milliseconds 100
    }
}

if ($SetupAudit) {
    Write-Log "Running audit setup..." "INFO"
    Set-AuditPolicies
    Enable-PowerShellLogging
    $ml = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Name "EnableModuleLogging" -ErrorAction SilentlyContinue
    $sb = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -ErrorAction SilentlyContinue
    if ($ml.EnableModuleLogging -eq 1) { Write-Log "Module Logging: ENABLED" "SUCCESS" }
    else { Write-Log "Module Logging: NOT ENABLED" "ERROR" }
    if ($sb.EnableScriptBlockLogging -eq 1) { Write-Log "Script Block Logging: ENABLED" "SUCCESS" }
    else { Write-Log "Script Block Logging: NOT ENABLED" "ERROR" }
    Write-Log "Setup complete! Restart PowerShell for changes." "SUCCESS"
    exit 0
}

Clear-Host
Write-Host "POWERSHELL SECURITY MONITOR v2.0" -ForegroundColor Cyan
Write-Host ""

$isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) { Write-Warning "Run as Administrator for full functionality" }

$auditStatus = auditpol /get /subcategory:"Process Creation" 2>&1 | Out-String
if ($auditStatus -notmatch "Success and Failure") {
    Write-Host "WARNING: Process Creation auditing NOT enabled!" -ForegroundColor Red
    Write-Host "Run: .\SecurityMonitor.ps1 -SetupAudit" -ForegroundColor Yellow
    Write-Host ""
}

Write-Log "Monitor initialized" "INFO"
Write-Log "System: $($Script:Config.SystemName)" "INFO"
Write-Log "Domain: $($Script:Config.Domain)" "INFO"
if ($Script:HasSysmon) { Write-Log "Sysmon: ACTIVE" "SUCCESS" } else { Write-Log "Sysmon: INACTIVE (install with -InstallSysmon)" "WARNING" }
if ($Script:IsDomainController) { Write-Log "AD Monitoring: ACTIVE" "SUCCESS" } else { Write-Log "AD Monitoring: INACTIVE (not a DC)" "INFO" }
Write-Log "WMI Persistence Scanning: ACTIVE" "SUCCESS"

if ($Script:LogFilePath) { Write-Log "Logging to: $Script:LogFilePath" "INFO" }
else { Write-Log "File logging: DISABLED" "WARNING" }

Start-Monitoring
            $caps = @()
            if ($Script:HasSysmon) { $caps += "Sysmon" }
            if ($Script:IsDomainController) { $caps += "AD" }
            $caps += "WMI"
            Write-Host "Active: $($caps -join ', ') | Next check: $($nextAutoCheck.ToString('HH:mm:ss'))" -ForegroundColor Gray
            Write-Host "Log: $Script:LogFilePath" -ForegroundColor Gray
            $lastMenuDisplay = Get-Date
        }

        if ($Host.UI.RawUI.KeyAvailable) {
            $key = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
            if ($key.Character -eq 'q' -or $key.Character -eq 'Q') {
                Write-Log "Stopping monitor..." "INFO"; break
            }
            elseif ($key.VirtualKeyCode -eq 13 -or $key.Character -eq "`r") {
                Write-Host "FORCING CHECK..." -ForegroundColor Cyan
                $lastCheck = Check-Events -Since $lastCheck
                $nextAutoCheck = (Get-Date).AddSeconds($CheckInterval)
                $lastMenuDisplay = Get-Date
            }
            elseif ($key.Character -eq '1') {
                if (Test-Path $Script:VerifyScriptPath) { & $Script:VerifyScriptPath }
                else { Write-Host "[X] Verify script not found: $Script:VerifyScriptPath" -ForegroundColor Red }
                $lastMenuDisplay = Get-Date
            }
            elseif ($key.Character -eq '2') { Show-AuditStatus; $lastMenuDisplay = Get-Date }
            elseif ($key.Character -eq '3') { Enable-IndividualAudit; $lastMenuDisplay = Get-Date }
            elseif ($key.Character -eq '4') { List-SACLs; $lastMenuDisplay = Get-Date }
            elseif ($key.Character -eq '5') { Add-SACL; $lastMenuDisplay = Get-Date }
            elseif ($key.Character -eq '6') { Change-LogPath; $lastMenuDisplay = Get-Date }
            elseif ($key.Character -eq '7') {
                Write-Host "Running WMI persistence scan..." -ForegroundColor Cyan
                $wmiResults = Check-WMIPersistence -Since (Get-Date)
                if ($wmiResults.Count -gt 0) {
                    Show-Alert -Events $wmiResults -AlertType "WMI PERSISTENCE DETECTED"
                } else { Write-Host "[OK] No suspicious WMI persistence found" -ForegroundColor Green }
                Write-Host "Press any key..." -ForegroundColor Gray
                $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
                $lastMenuDisplay = Get-Date
            }
        }
        Start-Sleep -Milliseconds 100
    }
}

if ($SetupAudit) {
    Write-Log "Running audit setup..." "INFO"
    Set-AuditPolicies
    Enable-PowerShellLogging
    $ml = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Name "EnableModuleLogging" -ErrorAction SilentlyContinue
    $sb = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -ErrorAction SilentlyContinue
    if ($ml.EnableModuleLogging -eq 1) { Write-Log "Module Logging: ENABLED" "SUCCESS" }
    else { Write-Log "Module Logging: NOT ENABLED" "ERROR" }
    if ($sb.EnableScriptBlockLogging -eq 1) { Write-Log "Script Block Logging: ENABLED" "SUCCESS" }
    else { Write-Log "Script Block Logging: NOT ENABLED" "ERROR" }
    Write-Log "Setup complete! Restart PowerShell for changes." "SUCCESS"
    exit 0
}

Clear-Host
Write-Host "POWERSHELL SECURITY MONITOR v3.0" -ForegroundColor Cyan
Write-Host ""

$isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) { Write-Warning "Run as Administrator for full functionality" }

$auditStatus = auditpol /get /subcategory:"Process Creation" 2>&1 | Out-String
if ($auditStatus -notmatch "Success and Failure") {
    Write-Host "WARNING: Process Creation auditing NOT enabled!" -ForegroundColor Red
    Write-Host "Run: .\SecurityMonitor.ps1 -SetupAudit" -ForegroundColor Yellow
    Write-Host ""
}

Write-Log "Monitor initialized" "INFO"
Write-Log "System: $($Script:Config.SystemName)" "INFO"
Write-Log "Domain: $($Script:Config.Domain)" "INFO"
if ($Script:HasSysmon) { Write-Log "Sysmon: ACTIVE" "SUCCESS" } else { Write-Log "Sysmon: INACTIVE (install with -InstallSysmon)" "WARNING" }
if ($Script:IsDomainController) { Write-Log "AD Monitoring: ACTIVE" "SUCCESS" } else { Write-Log "AD Monitoring: INACTIVE (not a DC)" "INFO" }
Write-Log "WMI Persistence Scanning: ACTIVE" "SUCCESS"

if ($Script:LogFilePath) { Write-Log "Logging to: $Script:LogFilePath" "INFO" }
else { Write-Log "File logging: DISABLED" "WARNING" }

Start-Monitoring