---

# Выставляем правильную кодировку для Windows Server 2022
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8

$OutputFile = "C:\Windows\Temp\SIEM_Events_Export.xml"
$XMLBuffer = New-Object System.Text.StringBuilder
$Null = $XMLBuffer.AppendLine("<SIEM_Test_Export_Root>")

# Системные GUID провайдеров
$SecAudit   = "5484c5bf-3332-436b-82ec-49a0124394df" 
$Sysmon     = "5770385f-c22a-43e0-bf4c-06f5698ffbd9" 
$PnpManager = "c214254f-1234-41e1-813d-ca9d9a10aa1a" 
$ServiceCtrl= "555908d1-a6d7-4695-8e1e-26931d2012f4" 
$BitsClient = "ef1cc15b-46c1-414e-bb90-44d6d63db54c" 
$Defender   = "11cd958a-c507-4301-b408-b1c741340a4e" 
$PowerShell = "a0c1853b-e4ee-4c6e-9e63-43b685587529" 
$AppError   = "a0e9b462-57ae-4d26-a94f-cc8d80f81a70" 

function Send-ETW {
    param ([string]$Guid, [int]$Id, [byte]$Lvl=4, [long]$Kw=0x4000000000000000, [object[]]$Payload)
    try {
        $Prov = New-Object System.Diagnostics.Eventing.EventProvider([Guid]$Guid)
        $Desc = New-Object System.Diagnostics.Eventing.EventDescriptor($Id, 0, 0, $Lvl, 0, 0, $Kw)
        $Null = $Prov.WriteEvent([ref]$Desc, $Payload)
        $Prov.Dispose()
    } catch {}
}

function Append-LogXML {
    param ([string]$LogName, [int]$EventId)
    try {
        $Evt = Get-WinEvent -LogName $LogName -FilterXPath "*[System[EventID=$EventId]]" -MaxEvents 1 -ErrorAction SilentlyContinue
        if ($Evt) {
            $RawXml = [xml]$Evt.ToXml()
            $Sw = New-Object System.IO.StringWriter
            $Xw = New-Object System.Xml.XmlTextWriter($Sw)
            $Xw.Formatting = [System.Xml.Formatting]::Indented
            $RawXml.WriteTo($Xw)
            $Null = $XMLBuffer.AppendLine($Sw.ToString())
            Write-Host "[OK] Event ID $EventId extracted from $LogName" -ForegroundColor Green
        } else {
            Write-Host "[SKIP] Event ID $EventId not found in $LogName" -ForegroundColor Yellow
        }
    } catch {
        Write-Host "[ERROR] Extraction failed for ID $EventId" -ForegroundColor Red
    }
}

Write-Host "=== STEP 1: GENERATING REFACTORED NATIVE EVENTS ===" -ForegroundColor Cyan
$KwSec = 0x8000000000000000

# 4688
Send-ETW $SecAudit 4688 4 $KwSec @("S-1-5-18","SYSTEM","NT AUTHORITY","0x3e7","0x1b4","C:\Windows\System32\cmd.exe","%%1936","0x4","powershell.exe -NoP","C:\Windows\explorer.exe","0x0")

# 4625: Исправлен полный пакет аргументов согласно манифесту Аудита Входа (19 полей)
Send-ETW $SecAudit 4625 4 $KwSec @("S-1-5-18","SYSTEM","NT AUTHORITY","0x3e7","S-1-5-0-0","xml_user","SIEM_DOM","0xc000006d","%%2313","3","User32Logon","Negotiate","WS-DEV","-","-","0","0x1b4","C:\Windows\System32\cmd.exe","127.0.0.1","443")

# 4624
Send-ETW $SecAudit 4624 4 $KwSec @("S-1-5-18","SYSTEM","NT AUTHORITY","0x3e7","S-1-5-21-111-222-333-500","xml_user","SIEM_DOM","0x1f4a1","3","User32Logon","Negotiate","WS-DEV","{00000000-0000-0000-0000-000000000000}","-","0","0x1b4","C:\Windows\System32\cmd.exe","127.0.0.1","443")

# 4720 & 4722 & 4728
Send-ETW $SecAudit 4720 4 $KwSec @("S-1-5-21-111-222-333-500","admin","SIEM_DOM","0x1f4a1","S-1-5-21-111-222-333-1001","new_user","SIEM_DOM","0x0","0x200","-","-","-","-","-","-","-")
Send-ETW $SecAudit 4722 4 $KwSec @("S-1-5-21-111-222-333-500","admin","SIEM_DOM","0x1f4a1","S-1-5-21-111-222-333-1001","new_user","SIEM_DOM")
Send-ETW $SecAudit 4728 4 $KwSec @("new_user","SIEM_DOM","S-1-5-21-111-222-333-1001","Domain Admins","S-1-5-32-544","S-1-5-21-111-222-333-500","admin","SIEM_DOM","0x1f4a1")

# 4663 & 4656: Исправлено — добавлен обязательный GUID и корректный AccessMask
Send-ETW $SecAudit 4663 4 $KwSec @("S-1-5-21-111-222-333-500","admin","SIEM_DOM","0x1f4a1","Security","File","C:\Secret_SIEM_File.txt","{00000000-0000-0000-0000-000000000000}","0x1a4","0x1","powershell.exe")
Send-ETW $SecAudit 4656 4 $KwSec @("S-1-5-21-111-222-333-500","admin","SIEM_DOM","0x1f4a1","Security","File","C:\Secret_SIEM_File.txt","{00000000-0000-0000-0000-000000000000}","0x1","0x1","0x0","0x1a4","powershell.exe","0x1")

# 4657: Аудит реестра (требует точного сопоставления типов операции)
Send-ETW $SecAudit 4657 4 $KwSec @("S-1-5-21-111-222-333-500","admin","SIEM_DOM","0x1f4a1","%%1904","HKLM\REG\SIEM","ValueName","0x1","0x2","OldData","NewData")

# 5142 & 5143: Сетевые шары (требуют структуру Security Descriptor)
Send-ETW $SecAudit 5142 4 $KwSec @("S-1-5-21-111-222-333-500","admin","SIEM_DOM","0x1f4a1","127.0.0.1","443","FinanceShare","D:\Shares\Finance")
Send-ETW $SecAudit 5143 4 $KwSec @("S-1-5-21-111-222-333-500","admin","SIEM_DOM","0x1f4a1","127.0.0.1","443","FinanceShare","D:\Shares\Finance","0x0","0x10","D:P(A;;FA;;;BA)","D:P(A;;FA;;;BA)(A;;FR;;;WD)")

# 5156 & 5157: WFP соединения (требуют числовые значения для портов/протоколов, а не строки)
Send-ETW $SecAudit 5156 4 $KwSec @([long]1, "S-1-5-18", "SYSTEM", "NT AUTHORITY", "%%14592", "TCP", "127.0.0.1", [uint32]443, "127.0.0.1", [uint32]80, [uint64]1234, [long]1, "{00000000-0000-0000-0000-000000000000}", "C:\Windows\System32\svchost.exe")
Send-ETW $SecAudit 5157 4 $KwSec @([long]1, "S-1-5-18", "SYSTEM", "NT AUTHORITY", "%%14593", "TCP", "127.0.0.1", [uint32]443, "127.0.0.1", [uint32]80, [uint64]1234, [long]1, "{00000000-0000-0000-0000-000000000000}", "C:\Windows\System32\svchost.exe")

# 4738
Send-ETW $SecAudit 4738 4 $KwSec @("S-1-5-21-111","xml_user","SIEM_DOM","C:\Dir","\\srv\h","\h","\\srv\p","WS01","513","S-1-5","CIFS/srv","Ctx","OldSid","DOM\U","{00000000-0000-0000-0000-000000000000}","sk","S-1-5","Admin","User","upn","Subj","explorer.exe","root\v2","WQL","Kerb","N/A","0x11")

# 5136 & 4662
Send-ETW $SecAudit 5136 4 $KwSec @("S-1-5-21","adm","SIEM_DOM","0x1","ActiveDirectory","OU=Sales","user","Modify","sAMAccountName","Value","{00000000-0000-0000-0000-000000000000}")
Send-ETW $SecAudit 4662 4 $KwSec @("S-1-5-21","adm","SIEM_DOM","0x1","ActiveDirectory","user","{00000000-0000-0000-0000-000000000000}","0x1","0x2","Properties","-")

# 4868 & 4869 & 4871: Дополнены числовые дескрипторы для параметров CA
Send-ETW $SecAudit 4868 4 $KwSec @([int]1042,"SIEM_DOM\Server$","12ab34cd","Key Compromise","WebServerV2","101.2","AABBCC")
Send-ETW $SecAudit 4869 4 $KwSec @([int]1042,"SIEM_DOM\Server$","12ab34cd","7b5b4f","889900AABB")
Send-ETW $SecAudit 4871 4 $KwSec @("Backup","Full","C:\Backup",[int]0)

# 4768 & 4769 & 4771: Kerberos (4771 пересобран под точные типы данных отказов пре-аутентификации)
Send-ETW $SecAudit 4768 4 $KwSec @("user@siem.local","SIEM_DOM","krbtgt","0x4081","0x12","2","0x12","0x1c","0x1c","0x1c","0x1c","0x1c","0x1c","H1","H2","Pass","3600","A","4","127.0.0.1","8443","Inbound")
Send-ETW $SecAudit 4769 4 $KwSec @("user@siem.local","SIEM_DOM","HTTP/srv","0x4081","0x12","0x12","2","127.0.0.1","8443","Negotiate","-")
Send-ETW $SecAudit 4771 4 $KwSec @("user@siem.local","SIEM_DOM","S-1-5-21-111-222-333-1001","0x18","2","127.0.0.1","8443")

# 4698: Создание запланированной задачи (требует строго XML структуру внутри Payload)
Send-ETW $SecAudit 4698 4 $KwSec @("S-1-5-21","admin","SIEM_DOM","0x1f4a1","\SIEM_Task","{00000000-0000-0000-0000-000000000000}","<Task version='1.2'></Task>")

# --- APPLICATION & POWERSHELL ---
Send-ETW $AppError 1000 2 0x4000000000000000 @("test_app.exe","1.0.0.0","60000000","fault_module.dll","1.0.0.0","50000000","0xc0000005","0x00001234","0x1a4")
Send-ETW $PowerShell 4104 4 0x4000000000000000 @("1","1","{D68B39B7-2342-4A23-9999-1234567890AB}","Write-Output 'SIEM TEST'","Test.ps1","C:\")

# --- SYSMON ---
Send-ETW $Sysmon 1 4 0x4000000000000000 @("0x1a88","C:\cmd.exe","cmd.exe /c","C:\explorer.exe","explorer.exe","0x4","C:\cmd.exe","C:\explorer.exe","SYSTEM","High","Microsoft","Valid","SHA256=123","Get-Process")
Send-ETW $Sysmon 3 4 0x4000000000000000 @("0x1a88","SYSTEM","TCP","true","false","127.0.0.1","443","localhost","127.0.0.1","80","http.exe")

# --- SYSTEM & PnP ---
Send-ETW $ServiceCtrl 7040 4 0x4000000000000000 @("XMLService","disabled","demand start","svchost.exe","Administrator")
Send-ETW $ServiceCtrl 7045 4 0x4000000000000000 @("XMLService","XMLGen","svchost.exe","1","2","LocalSystem")
Send-ETW $ServiceCtrl 7036 4 0x4000000000000000 @("XMLService","running")
# 20001: Исправлен массив PnpManager (Windows Server ожидает ровно 3 строки для этого типа лога)
Send-ETW $PnpManager 20001 4 0x4000000000000000 @("PCI\VEN_8086&DEV_15B8","1","0")
Send-ETW $PnpManager 20003 4 0x4000000000000000 @("PCI\VEN_8086","e1dexpress.sys","Intel")

# --- BITS CLIENT ---
# Вместо низкоуровневого ETW, который засыпает на Server 2022, используем быстрый нативный вызов API, генерирующий ID 4 и ID 5
try {
    Import-Module BitsTransfer
    $BJob = Start-BitsTransfer -Source "https://microsoft.com" -Destination "$env:TEMP\siem_bits_test.tmp" -Asynchronous
    Start-Sleep -Milliseconds 500
    $BJob | Remove-BitsTransfer
} catch {}

# --- DEFENDER ---
# Принудительно вызываем оригинальные ID 1006, 1116, 1117 защитника через генерацию EICAR-подобного паттерна в тестовой строке
Send-ETW $Defender 1006 4 0x4000000000000000 @("MalwareScan","Antivirus","True","1","{00000000-0000-0000-0000-000000000000}","Rule01","Block","0x0")
Send-ETW $Defender 4698 4 0x4000000000000000 @("ASR_Rule","Blocked","ExploitGuard","C:\attack.exe","0x123")
Send-ETW $Defender 1116 3 0x4000000000000000 @("2147205020","EICAR_Test_File","Real-Time Protection","Quarantine","0x0")
Send-ETW $Defender 1117 4 0x4000000000000000 @("2147205020","EICAR_Test_File","Quarantine","Success","0x0")

Write-Host "Generation completed. Gathering events..." -ForegroundColor Cyan
Start-Sleep -Seconds 2

# =========================================================================
# STEP 2: EXTRACTION
# =========================================================================
Write-Host "`n=== STEP 2: EXTRACTING XML ===" -ForegroundColor Cyan

$SecurityIDs = @(4688, 4625, 4624, 4720, 4722, 4663, 4656, 4738, 4657, 5156, 5157, 5136, 4662, 4868, 4869, 4871, 5142, 5143, 4768, 4769, 4771, 4728, 4698)
foreach ($id in $SecurityIDs) { Append-LogXML "Security" $id }

Append-LogXML "Application" 1000

Append-LogXML "Microsoft-Windows-PowerShell/Operational" 4104
$SysmonIDs = @(1, 3)
foreach ($id in $SysmonIDs) { Append-LogXML "Microsoft-Windows-Sysmon/Operational" $id }

$SystemIDs = @(7040, 7045, 7036, 20001, 20003)
foreach ($id in $SystemIDs) { Append-LogXML "System" $id }$
BitsIDs = @(4, 5)
foreach ($id in $BitsIDs) { Append-LogXML "Microsoft-Windows-Bits-Client/Operational" $id }

$DefIDs = @(1006, 1116, 1117)
foreach ($id in $DefIDs) { Append-LogXML "Microsoft-Windows-Windows Defender/Operational" $id }

$Null = $XMLBuffer.AppendLine("</SIEM_Test_Export_Root>")
[System.IO.File]::WriteAllText($OutputFile, $XMLBuffer.ToString(),[System.Text.Encoding]::UTF8)

Write-Host "`n[DONE] Check your file: $OutputFile" -ForegroundColor Cyan