# Kerberoasting detection — svc-iam uchun TGS so'rovi index=windows EventCode=4769 ServiceName="svc-iam" TicketEncryptionType="0x17" | eval risk="CRITICAL" | alert action=email to="soc@company.com" # Yoki login urinish index=windows EventCode=4624 OR EventCode=4625 TargetUserName="svc-iam" | eval risk="CRITICAL — HONEYPOT TRIGGERED"

# Har 15 daqiqada GPO o'zgarishini tekshirish $HoneypotGPO_GUID = "{YOUR-GPO-GUID-HERE}" $HoneypotAccount = "svc-iam" while ($true) { # Event 5136 — GPO Object Modified $events = Get-WinEvent -FilterHashtable @{ LogName = 'Security' Id = 5136 StartTime = (Get-Date).AddMinutes(-15) } -ErrorAction SilentlyContinue $triggered = $events | Where-Object { $_.Message -match $HoneypotGPO_GUID } if ($triggered) { Write-Warning "[!] HONEYPOT TRIGGERED — GPO o'zgartirildi!" # 1. Compromised akkauntni bloklash Disable-ADAccount -Identity $HoneypotAccount Write-Host "[+] $HoneypotAccount bloklandi" # 2. GPO ni barcha OUlardan uzib tashlash Get-GPLink -Guid $HoneypotGPO_GUID | ForEach-Object { Remove-GPLink -Guid $HoneypotGPO_GUID -Target $_.Target } Write-Host "[+] GPO barcha OUlardan uzildi" # 3. SOC ga xabar Send-MailMessage -To "soc@company.com" ` -Subject "[CRITICAL] Honeypot GPO triggered!" ` -Body "Akkaunt: $HoneypotAccount | Vaqt: $(Get-Date)" } Start-Sleep -Seconds 900 # 15 daqiqa }