---

# Strict encoding enforcement
[Console]::OutputEncoding = [System.Text.Encoding]::GetEncoding(866)
Write-Host "=== FORCED REAL SYSTEM EVENT GENERATION ===" -ForegroundColor Cyan

# 1. GENERATE: 5142 & 5143 (Network Shares)
# Direct API invocation via netapi32.dll mechanisms via net.exe
net share SIEM_SHARE=C:\Windows /grant:everyone,READ /users:5 | Out-Null
net share SIEM_SHARE /users:10 | Out-Null  # Triggers 5143 (Modification)
net share SIEM_SHARE /delete | Out-Null

# 2. GENERATE: 4656 & 4663 (File Access with active SACL)
$Path = "C:\SIEM_Real_File.txt"
"Trigger" | Out-File $Path -Force
$Acl = Get-Acl $Path
# Injecting actual binary Security Identifier (Everyone SID: S-1-1-0)
$Sid = New-Object System.Security.Principal.SecurityIdentifier("S-1-1-0")
$Rule = New-Object System.Security.AccessControl.FileSystemAuditRule($Sid, "Write,Delete", "None", "None", "Success")
$Acl.SetAuditRule($Rule)
Set-Acl $Path $Acl
# Real Win32 File I/O operations to trigger security subsystem descriptors
[System.IO.File]::AppendAllText($Path, "AppendData")
Remove-Item $Path -Force

# 3. GENERATE: 4657 (Registry Modification)
$RegPath = "HKLM:\Software\SIEM_Real_Reg"
if (-not (Test-Path $RegPath)) { New-Item $RegPath -Force | Out-Null }
$RegAcl = Get-Acl $RegPath
$RegRule = New-Object System.Security.AccessControl.RegistryAuditRule($Sid, "SetValue,Delete", "None", "None", "Success")
$RegAcl.SetAuditRule($RegRule)
Set-Acl $RegPath $RegAcl
# Physical modification inside the registry hive
Set-ItemProperty -Path $RegPath -Name "SIEM_Val" -Value 1 -Force
Remove-ItemProperty -Path $RegPath -Name "SIEM_Val" -Force
Remove-Item $RegPath -Force

# 4. GENERATE: 5156 & 5157 (WFP Firewall Connections)
# Instantly creates a native block/allow state via genuine local network traffic
$Listener = New-Object System.Net.Sockets.TcpListener([System.Net.IPAddress]::Loopback, 9999)
$Listener.Start()
try {
    $Client = New-Object System.Net.Sockets.TcpClient
    $Client.ConnectAsync("127.0.0.1", 9999).Wait(100)
    $Client.Close()
} catch {}
$Listener.Stop()

# 5. GENERATE: 4771 (Kerberos Pre-Authentication Failure)
# Forces LSASS to issue a genuine Kerberos TGT request packet with an invalid hash
if ((Get-CimInstance Win32_ComputerSystem).PartOfDomain) {
    try {
        $DnsDomain = (Get-CimInstance Win32_NTDomain -Filter "Primary=True").DnsForestName
        # Genuine Active Directory Management API call
        Add-Type -AssemblyName System.DirectoryServices.AccountManagement
        $Context = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::Domain, $DnsDomain)
        $Context.ValidateCredentials("SIEM_FAKE_USER_TRIG", "WrongPass123!") | Out-Null
    } catch {}
}

# 6. GENERATE: 4868, 4869, 4871 (Active Directory Certificate Services)
if (Get-Service -Name "CertSvc" -ErrorAction SilentlyContinue) {
    # Forces the CA DB engine to dump metadata and execute an interface backup operation
    certutil -backup -f C:\Windows\Temp\SIEM_CA_Bkp | Out-Null
    Remove-Item C:\Windows\Temp\SIEM_CA_Bkp -Recurse -Force -ErrorAction SilentlyContinue
}

# 7. GENERATE: 1006 (Windows Defender Operational Start)
if (Get-Command Start-MpScan -ErrorAction SilentlyContinue) {
    # Fires up a true malware-engine validation thread
    Start-MpScan -ScanType QuickScan -AsJob | Out-Null
}

# 8. GENERATE: 20001 (PnP Manager Hardware Rescan)
# Forces the kernel PnP subsystem to re-enumerate every virtual bus device descriptor
$Storage = New-Object -ComObject WindowsInstaller.Installer
$Storage.Products | Out-Null

Write-Host "=== TRIGGERS EXECUTED SUCCESSFULLY ===" -ForegroundColor Green