sandisomaz/Windows-Security-Audit-Framework
GitHub: sandisomaz/Windows-Security-Audit-Framework
基于 PowerShell 的零依赖 Windows 安全审计与威胁狩猎框架，通过本地托管 Web Dashboard 将系统状态实时映射至 CIS、NIST 等合规基线并输出多格式审计报告。
Stars: 0 | Forks: 0
# Windows 安全审计框架
### 面向 Windows 环境的企业级安全审计、取证与威胁
## 执行摘要
**Windows 安全审计框架** 是一个全面的、基于 PowerShell 的安全审计与威胁引擎，配备了现代化的响应式 Web Dashboard。
旨在将实时 Windows 系统状态映射到 CIS Benchmarks、NIST 和 POPIA (Protection of Personal Information Act) 要求，它无需依赖庞大的第三方企业级 agent，即可执行深度的取证分析和系统完整性检查。
## 技术架构：零依赖 API
该框架的一项重要架构成就是，它可以在 **零外部服务器依赖**（无需 IIS、Apache 或 Node.js）的情况下运行。它直接从活动的 PowerShell 会话中托管其后端 API。
```
┌────────────────────────────────────────────────────────────────────────┐
│ WEB FRONTEND (HTML/JS) │
│ Built with Tailwind CSS — Responsive Dark/Light Mode adapt │
└──────────────────────────────────▲─────────────────────────────────────┘
│ HTTP / API polling (localhost:8080)
▼
┌────────────────────────────────────────────────────────────────────────┐
│ BACKEND API (PowerShell) │
│ Hosts a local REST API directly via .NET's [HttpListener] class │
│ Streams live audit findings to the frontend via WebSocket-like sync │
└──────────────────────────────────▲─────────────────────────────────────┘
│ Internal Jobs
▼
┌────────────────────────────────────────────────────────────────────────┐
│ SECURITY AUDIT ENGINE │
│ Asynchronous job-polling scanning WMI, CIM, Registry, and Memory │
└────────────────────────────────────────────────────────────────────────┘
Core Diagnostic Capabilities
- Deep Process Triage: Detects process injection, unsigned binaries running in
memory, and fileless malware by scanning heuristic checks against CIM/WMI
namespaces.
- Persistence Hunting: Scans WMI subscriptions, Registry Autoruns, and Windows
Scheduled Tasks for unauthorized backdoors.
- Forensic Analysis: Audits browser extensions, local HOSTS file integrity,
and recent system execution timelines.
- Crypto Miner Detection: Identifies abnormal CPU usage patterns and known
mining signatures.
- System Hardening Audit: Inspects User Account Control (UAC), Secure Boot,
TPM status, and Windows Defender active configurations against enterprise
baselines.
Scan Profiles & Execution Modes
The framework supports multiple tiered scanning modes depending on the incident
response requirement:
| Mode | Duration | Description |
| -------------- | --------- | ------------------------------------------------------------------------------- |
| **⚡ Quick** | 2-3 min | Essential checks: Memory integrity, Disk Health, Critical System Files. |
| **📋 Standard** | 5-7 min | Core checks + full Persistence Hunting (Autoruns, WMI). |
| **🔍 Deep** | 10-15 min | Comprehensive audit: Network, Firewall, Defender, and OS Hardening. |
| **🔬 Forensic** | 20+ min | Full investigation: Timeline analysis, verbose system logs, and threat hunting. |
🛠️ Technology Stack & Requirements
- Backend Engine: Windows PowerShell 5.1+ (Leveraging .NET Framework)
- Frontend UI: HTML5, modern JavaScript, Tailwind CSS
- Reporting: Auto-generates beautifully formatted HTML, JSON (for machine
readability/automation), and CSV reports.
- OS Support: Windows 10 & Windows 11 environments.
Architected and maintained by Sandiso Mazibuko.
```
标签：AI合规, IPv6, PowerShell, Web仪表盘, 子域名变形, 数字取证, 数据可视化, 知识库安全, 自动化脚本