Pastein: # Принудительно выставляем правильную кодировку для Windows Server 2022 [Console]::OutputEncoding = [System.Text.Encoding]::UTF8 $OutputFile = "C:\Wind

Загрузка данных
# Принудительно выставляем правильную кодировку для Windows Server 2022
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8

$OutputFile = "C:\Windows\Temp\SIEM_Events_Export.xml"
$XMLBuffer = New-Object System.Text.StringBuilder
$Null = $XMLBuffer.AppendLine("<SIEM_Test_Export_Root>")

# Системные GUID провайдеров
$SecAudit   = "5484c5bf-3332-436b-82ec-49a0124394df" 
$Sysmon     = "5770385f-c22a-43e0-bf4c-06f5698ffbd9" 
$PnpManager = "c214254f-1234-41e1-813d-ca9d9a10aa1a" 
$ServiceCtrl= "555908d1-a6d7-4695-8e1e-26931d2012f4" 
$BitsClient = "ef1cc15b-46c1-414e-bb90-44d6d63db54c" 
$Defender   = "11cd958a-c507-4301-b408-b1c741340a4e" 
$PowerShell = "a0c1853b-e4ee-4c6e-9e63-43b685587529" 
$AppError   = "a0e9b462-57ae-4d26-a94f-cc8d80f81a70" 

function Send-ETW {
    param ([string]$Guid, [int]$Id, [byte]$Lvl=4, [long]$Kw=0x4000000000000000, [string[]]$Payload)
    try {
        $Prov = New-Object System.Diagnostics.Eventing.EventProvider([Guid]$Guid)
        $Desc = New-Object System.Diagnostics.Eventing.EventDescriptor($Id, 0, 0, $Lvl, 0, 0, $Kw)
        # Ограничиваем время выполнения, чтобы избежать зависания на Шаге 1
        $Null = $Prov.WriteEvent([ref]$Desc, [object[]]$Payload)
        $Prov.Dispose()
    } catch {}
}

function Append-LogXML {
    param ([string]$LogName, [int]$EventId)
    try {
        $Evt = Get-WinEvent -LogName $LogName -FilterXPath "*[System[EventID=$EventId]]" -MaxEvents 1 -ErrorAction SilentlyContinue
        if ($Evt) {
            $RawXml = [xml]$Evt.ToXml()
            $Sw = New-Object System.IO.StringWriter
            $Xw = New-Object System.Xml.XmlTextWriter($Sw)
            $Xw.Formatting = [System.Xml.Formatting]::Indented
            $RawXml.WriteTo($Xw)
            $Null = $XMLBuffer.AppendLine($Sw.ToString())
            Write-Host "[OK] Event ID $EventId extracted from $LogName" -ForegroundColor Green
        } else {
            Write-Host "[SKIP] Event ID $EventId not found in $LogName" -ForegroundColor Yellow
        }
    } catch {
        Write-Host "[ERROR] Extraction failed for ID $EventId" -ForegroundColor Red
    }
}

Write-Host "=== STEP 1: GENERATING NATIVE WINDOWS EVENTS ===" -ForegroundColor Cyan

# --- SECURITY ---
$KwSec = 0x8000000000000000
Send-ETW $SecAudit 4688 4 $KwSec @("S-1-5-18","SYSTEM","NT","0x3e7","0x1b4","C:\Windows\cmd.exe","%%1936","0x4","powershell.exe -NoP","explorer.exe /factory","0x0")
Send-ETW $SecAudit 4625 4 $KwSec @("S-1-5-18","SYS","NT","0x3e7","S-1-5-0","xml_user","DOMAIN","0xC","%%23","3","User32","WS-DEV","-","-","0","0x1","pwsh.exe","127.0.0.1","443")
Send-ETW $SecAudit 4624 4 $KwSec @("S-1-5-18","SYS","NT","0x3e7","S-1-5-21","xml_user","DOMAIN","0x1f","3","User32","Negotiate","WS-DEV","-","{0}","-","0","0x1","pwsh.exe","127.0.0.1","443")
Send-ETW $SecAudit 4720 4 $KwSec @("S-1-5-21","adm","DOM","0x1","S-1-5-21-T","new_user","DOM","0x0","0x200","-","-","-","-","-","-","-")
Send-ETW $SecAudit 4722 4 $KwSec @("S-1-5-21","adm","DOM","0x1","S-1-5-21-T","new_user","DOM")
Send-ETW $SecAudit 4728 4 $KwSec @("new_user","DOM","S-1-5-21-T","Domain Admins","S-1-5-32-544","S-1-5-21","adm","DOM","0x1")
Send-ETW $SecAudit 4663 4 $KwSec @("S-1-5-21","adm","DOM","0x1","Security","File","C:\Secret.txt","0x1","0x10","powershell.exe","S-1-5-21-T")
Send-ETW $SecAudit 4656 4 $KwSec @("S-1-5-21","adm","DOM","0x1","Security","File","C:\Secret.txt","0x1","0x1","0x0","powershell.exe","0x1")
Send-ETW $SecAudit 4657 4 $KwSec @("S-1-5-21","adm","DOM","0x1","HKLM\REG","ValueName","0x1","0x2","OldData","NewData")
Send-ETW $SecAudit 5142 4 $KwSec @("S-1-5-21","adm","DOM","0x1","127.0.0.1","443","FinanceShare","D:\Shares")
Send-ETW $SecAudit 5143 4 $KwSec @("S-1-5-21","adm","DOM","0x1","127.0.0.1","443","FinanceShare","D:\Shares","0x0","0x10","D:SD-Old","D:SD-New")
Send-ETW $SecAudit 4738 4 $KwSec @("S-1-5-21-T","xml_user","DOM","C:\Dir","\\srv\h","\h","\\srv\p","WS01","513","S-1-5","CIFS/srv","Ctx","OldSid","DOM\U","{V}","sk","S-1-5","Admin","User","upn","Subj","explorer.exe","root\v2","WQL","Kerb","N/A","0x11")
Send-ETW $SecAudit 5136 4 $KwSec @("S-1-5-21","adm","DOM","0x1","ActiveDirectory","OU=Sales","user","Modify","sAMAccountName","Value","{GUID}")
Send-ETW $SecAudit 4662 4 $KwSec @("S-1-5-21","adm","DOM","0x1","ActiveDirectory","user","{GUID}","0x1","0x2","Properties","-")
Send-ETW $SecAudit 4868 4 $KwSec @("1042","DOM\Server$","12ab34cd","Key Comp","WebServerV2","101.2","AABBCC")
Send-ETW $SecAudit 4869 4 $KwSec @("1042","DOM\Server$","12ab34cd","7b5b4f","889900AABB")
Send-ETW $SecAudit 4871 4 $KwSec @("Backup","Full","C:\Backup","0x0")
Send-ETW $SecAudit 4768 4 $KwSec @("user@dom.local","DOM.LOCAL","krbtgt","0x4081","0x12","2","0x12","0x1c","0x1c","0x1c","0x1c","0x1c","0x1c","H1","H2","Pass","3600","A","4","127.0.0.1","8443","Inbound")
Send-ETW $SecAudit 4769 4 $KwSec @("user@dom.local","DOM.LOCAL","HTTP/srv","0x4081","0x12","0x12","2","127.0.0.1","8443","Negotiate","-")
Send-ETW $SecAudit 4771 4 $KwSec @("user@dom.local","DOM.LOCAL","S-1-5","0x12","127.0.0.1","8443","0x18","NTLM")

# --- APPLICATION & POWERSHELL ---
Send-ETW $AppError 1000 2 0x4000000000000000 @("test_app.exe","1.0.0.0","60000000","fault_module.dll","1.0.0.0","50000000","0xc0000005","0x00001234","0x1a4")
Send-ETW $PowerShell 4104 4 0x4000000000000000 @("1","1","{D68B39B7-2342-4A23-9999-1234567890AB}","Write-Output 'SIEM TEST'","Test.ps1","C:\")

# --- SYSMON ---
Send-ETW $Sysmon 1 4 0x4000000000000000 @("0x1a88","C:\cmd.exe","cmd.exe /c","C:\explorer.exe","explorer.exe","0x4","C:\cmd.exe","C:\explorer.exe","SYSTEM","High","Microsoft","Valid","SHA256=123","Get-Process")
Send-ETW $Sysmon 3 4 0x4000000000000000 @("0x1a88","SYSTEM","TCP","true","false","127.0.0.1","443","localhost","127.0.0.1","80","http.exe")

# --- SYSTEM ---
Send-ETW $ServiceCtrl 7040 4 0x4000000000000000 @("XMLService","disabled","demand start","svchost.exe","Administrator")
Send-ETW $ServiceCtrl 7045 4 0x4000000000000000 @("XMLService","XMLGen","svchost.exe","1","2","LocalSystem")
Send-ETW $ServiceCtrl 7036 4 0x4000000000000000 @("XMLService","running")
Send-ETW $PnpManager 20001 4 0x4000000000000000 @("PCI\VEN_8086","PCI\VEN_8086&DEV_15B8","PCI\VEN_HWD","Intel Net","SWD\MMDEV","PCI\COMP","Started")
Send-ETW $PnpManager 20003 4 0x4000000000000000 @("PCI\VEN_8086","e1dexpress.sys","Intel")

# --- BITS & DEFENDER ---
Send-ETW $BitsClient 4 4 0x4000000000000000 @("{88889999-aaaa-bbbb-cccc-dddddddddddd}","PatchJob","SYSTEM","1","1048576","http://microsoft.com")
Send-ETW $BitsClient 5 4 0x4000000000000000 @("{88889999-aaaa-bbbb-cccc-dddddddddddd}","PatchJob","SYSTEM","0x0","0","Disconnected")
Send-ETW $Defender 1006 4 0x4000000000000000 @("MalwareScan","Antivirus","True","1","{GUID}","Rule01","Block","0x0")
Send-ETW $Defender 4698 4 0x4000000000000000 @("ASR_Rule","Blocked","ExploitGuard","C:\attack.exe","0x123")
Send-ETW $Defender 1116 3 0x4000000000000000 @("2147205020","EICAR_Test_File","Real-Time Protection","Quarantine","0x0")
Send-ETW $Defender 1117 4 0x4000000000000000 @("2147205020","EICAR_Test_File","Quarantine","Success","0x0")

Write-Host "Generation completed. Waiting 2s..." -ForegroundColor Cyan
Start-Sleep -Seconds 2

# =========================================================================
# STEP 2: EXTRACTION
# =========================================================================
Write-Host "`n=== STEP 2: EXTRACTING AND FORMATTING XML ===" -ForegroundColor Cyan

$SecurityIDs = @(4688, 4625, 4624, 4720, 4722, 4663, 4656, 4738, 4657, 5156, 5157, 5136, 4662, 4868, 4869, 4871, 5142, 5143, 4768, 4769, 4771, 4728, 4698)
foreach ($id in $SecurityIDs) { Append-LogXML "Security" $id }

Append-LogXML "Application" 1000
Append-LogXML "Microsoft-Windows-PowerShell/Operational" 4104

$SysmonIDs = @(1, 3)
foreach ($id in $SysmonIDs) { Append-LogXML "Microsoft-Windows-Sysmon/Operational" $id }

$SystemIDs = @(7040, 7045, 7036, 20001, 20003)
foreach ($id in $SystemIDs) { Append-LogXML "System" $id }

$BitsIDs = @(4, 5)
foreach ($id in $BitsIDs) { Append-LogXML "Microsoft-Windows-Bits-Client/Operational" $id }

$DefIDs = @(1006, 1116, 1117)
foreach ($id in $DefIDs) { Append-LogXML "Microsoft-Windows-Windows Defender/Operational" $id }

$Null = $XMLBuffer.AppendLine("</SIEM_Test_Export_Root>")
[System.IO.File]::WriteAllText($OutputFile, $XMLBuffer.ToString(), [System.Text.Encoding]::UTF8)

Write-Host "`n[DONE] Script completed successfully!" -ForegroundColor Green
Write-Host "Output file: $OutputFile" -ForegroundColor Cyan
Больше возможностей при регистрации:
