check_wmi_os_security

Project Notes

Script monitoring not only Windows security components by WMI. Tested on Windows Server 2019/2022 64-bit. Tested on Python version: 3.6.8.

- Windows Firewall status monitoring
- Define your own WQL query and your own namespace. It is possible to monitor any WMI item there :) (Monitoring Windows Service, Windows Share, Windows - Process, Disk partitions, etc.)
- Windows EventLog monitoring example ( very small SIEM smiley ):
Monitoring user operations such as user creation, deletion, password change, locking, etc.
Monitoring dump memory (read RDP passwords cleartext/hash from memory)
Account login failed multiple times
Powershell security 'Set-ExecutionPolicy Bypass'
Windows Defender Antivirus (disable engine, found virus, etc.)
Symantec Antivirus (disable engine, found virus, etc.)
Scheduled task was created
etc.
- Windows Network monitoring
- Monitoring Windows Users (for example lockusers)
- Windows Uptime monitoring
- Windows Timezone monitoring
- Windows Domain/Workgroup monitoring
- Windows S/N monitoring, HW information (ideal for physical servers)
- OS information etc.