---

# Mandatory console fix
[Console]::OutputEncoding = [System.Text.Encoding]::GetEncoding(866)
Write-Host "=== TRIGGERING PROBLEM IDS ONLY ===" -ForegroundColor Cyan

# 1. FIX FOR: 4663, 4656, 5142, 5143 (Files & Network Shares)
$SharePath = "C:\SIEM_Network_Share"
if (-not (Test-Path $SharePath)) { New-Item -ItemType Directory -Path $SharePath | Out-Null }
$Acl = Get-Acl $SharePath
$AuditRule = New-Object System.Security.AccessControl.FileSystemAuditRule("Everyone", "ReadAndExecute,Write,Delete", "None", "None", "Success,Failure")
$Acl.SetAuditRule($AuditRule)
Set-Acl $SharePath $Acl

if (-not (Get-SmbShare -Name "SIEM_Share" -ErrorAction SilentlyContinue)) {
    New-SmbShare -Name "SIEM_Share" -Path $SharePath -FullAccess "Everyone" | Out-Null
    Set-SmbShare -Name "SIEM_Share" -Description "SIEM" -Force | Out-Null
}
$TriggerFile = "$SharePath\audit_trigger.pfx"
"SIEM" | Out-File $TriggerFile -Force
Get-Content $TriggerFile | Out-Null
Remove-Item $TriggerFile -Force

# 2. FIX FOR: 4657 (Registry)
$RegPath = "HKLM:\Software\SIEM_Registry_Audit"
if (-not (Test-Path $RegPath)) { New-Item $RegPath -Force | Out-Null }
$RegAcl = Get-Acl $RegPath
$RegAuditRule = New-Object System.Security.AccessControl.RegistryAuditRule("Everyone", "SetValue,Delete", "None", "None", "Success,Failure")
$RegAcl.SetAuditRule($RegAuditRule)
Set-Acl $RegPath $RegAcl
Set-ItemProperty -Path $RegPath -Name "SIEM_Metric" -Value 777 -Force
Remove-ItemProperty -Path $RegPath -Name "SIEM_Metric" -Force

# 3. FIX FOR: 5156, 5157 (WFP Firewall Connection)
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True
netsh advfirewall firewall add rule name="SIEM_WFP" dir=in action=block protocol=TCP localport=9999 security=authenticate | Out-Null
try {
    $TcpClient = New-Object System.Net.Sockets.TcpClient
    $TcpClient.ConnectAsync("127.0.0.1", 9999).Wait(300)
    $TcpClient.Close()
} catch {}
netsh advfirewall firewall delete rule name="SIEM_WFP" | Out-Null

# 4. FIX FOR: 4868, 4869, 4871 (Active Directory CA)
if (Get-Service -Name "CertSvc" -ErrorAction SilentlyContinue) {
    certutil -setreg CA\AuditFilter 127 | Out-Null
    Restart-Service -Name "CertSvc" -Force
    certutil -verify -urlfetch "1234567890" | Out-Null
}

# 5. FIX FOR: 4771 (Kerberos Pre-Auth Failure)
if ((Get-WmiObject Win32_ComputerSystem).PartofDomain) {
    try {
        Add-Type -AssemblyName System.DirectoryServices.AccountManagement
        $PrincipalContext = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::Domain, $env:USERDOMAIN)
        $PrincipalContext.ValidateCredentials($env:USERNAME, "WrongPassword123!!") | Out-Null
    } catch {}
}

# 6. FIX FOR: 20001 (PnP Manager Native Emulation)
$PnpGuid = "c214254f-1234-41e1-813d-ca9d9a10aa1a"
try {
    $Prov = New-Object System.Diagnostics.Eventing.EventProvider([Guid]$PnpGuid)
    $Desc = New-Object System.Diagnostics.Eventing.EventDescriptor(20001, 0, 0, 4, 0, 0, 0x4000000000000000)
    $Null = $Prov.WriteEvent([ref]$Desc, [object[]]@("PCI\VEN_8086&DEV_15B8", "1", "0"))
    $Prov.Dispose()
} catch {}

# 7. FIX FOR: 1006 (Defender Start Scan)
if (Get-Command Start-MpScan -ErrorAction SilentlyContinue) {
    Start-MpScan -ScanType QuickScan -AsJob | Out-Null
}

Write-Host "=== DONE ===" -ForegroundColor Green