TRS4R3N-EventViewer

TRS4R3N Event Viewer – PowerShell-Based SOC Monitoring Prototype Overview

TRS4R3N Event Viewer is an advanced PowerShell-based SOC (Security Operations Center) prototype designed to continuously monitor a Windows system for suspicious activities and potential cyber attacks in real time.

The script runs in the background with administrator privileges and correlates event logs, system resource usage, and network behavior to detect anomalies that may indicate malicious activity.

This project is intended for:

• Blue Team members
• SOC analysts
• Cybersecurity students
• Windows security researchers

Purpose

• The main goal of this project is to simulate a lightweight SOC agent that:
• Monitors Security & Sysmon logs
• Detects CPU, RAM, Network, and Disk anomalies
• Correlates system behavior with potential attack patterns
• Provides early warning signals for threats such as:
• Brute-force attacks
• Privilege escalation
• Cryptojacking
• ARP spoofing
• DDoS-like behavior
• Persistence mechanisms

Core Architecture The script is modular and runs in the following execution order:

• ControlledEvent
• Get-CPUUsage
• Get-RAMUsage
• Get-NetworkAnomalies
• Get-DiskUsage

Each module focuses on a different attack surface and contributes to a holistic threat-detection model.

Event Monitoring (ControlledEvent)

• Automatically detects whether Sysmon is installed If Sysmon is available:
• Monitors process creation, network connections, registry changes, driver loads, remote thread creation, etc. If Sysmon is not available:
• Falls back to Windows Security Event Log
• Tracks critical event IDs such as:
• Failed logons
• Explicit credential usage
• Privilege escalation
• Account creation/deletion
• Audit policy changes
• Log clearing attempts

This allows the script to work with or without Sysmon, making it flexible across environments.

CPU Anomaly Detection

• Continuously monitors total CPU usage
• Triggers alerts when usage exceeds a defined threshold

Identifies:

• The top CPU-consuming process

• PID, Parent PID, and command line

• Memory usage of the process

• Detects process duplication, which may indicate:

• Malware replication

• Cryptomining activity

• Process injection

  

RAM Anomaly Detection

• Monitors system memory usage percentage
• Detects excessive RAM consumption
• Identifies the process consuming the most memory Tracks:
• Parent-child relationships
• Command-line arguments
• Multiple process instances
• Implements time-based memory growth analysis to detect:
• Suspicious memory spikes
• Potential in-memory malware

ASLR Control

• Checks if Address Space Layout Randomization (ASLR) is enabled
• Automatically enables ASLR if it is disabled
• Helps protect against:
• Memory corruption attacks
• Exploitation techniques relying on predictable memory addresses

Network Anomaly Detection

• Detects the active physical network adapter Measures:
• Real-time download and upload speeds
• Network utilization percentage
• Filters out virtual and loopback interfaces
• Detects network-based threats such as:
• ARP Spoofing (duplicate MACs for the same IP)
• DDoS-like behavior (excessive connections from single IPs)
• Cryptojacking indicators (high CPU usage correlated with network activity)

Disk Activity Monitoring

• Monitors disk activity percentage and queue length
• Detects disk saturation scenarios
• Identifies processes with abnormal disk write behavior
• Uses heuristic scoring based on:
• Write speed
• Sudden spikes
• Sustained disk usage
• Highlights the process responsible for the highest disk I/O
• This helps detect:
• Ransomware-like behavior
• Log flooding
• Unauthorized data exfiltration or tampering

Continuous Monitoring

• The script runs in an infinite loop
• Executes all monitoring modules every second
• Designed for real-time threat visibility
• Suitable for lab environments, testing, and SOC simulations

Disclaimer This project is a security monitoring and educational prototype. It is not a replacement for enterprise-grade EDR or SIEM solutions, but it demonstrates how PowerShell can be used as a powerful defensive tool in Windows environments.

🧑‍💻 Author : Serhan Kırca Cybersecurity Researcher | Blue Team Enthusiast | SOC-Oriented PowerShell Developer