fix(winrm): Exchange strict mode to suppress false 91/4624 alerts

On Exchange role: require user in WinRM Event 91 EventData; correlate 4624 only when LogonProcess is WinRM. Prevents Outlook/LT3 false positives. Version 2.0.23-SAC. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-05 11:07:21 +10:00
parent fe2e6d624f
commit 80b2337d61
6 changed files with 116 additions and 8 deletions
@@ -54,6 +54,7 @@ $GetInventory = $true
 # $EnableAdminShareMonitoring = 1         # Security 5140 C$/ADMIN$ (audit File Share)
 # $WinRmIgnoreLocalSource = 1             # ::1, 127.0.0.1, fe80 (шум Exchange/локальный WinRM)
 # $WinRmIgnoreMachineAccounts = 1         # учётки, оканчивающиеся на $
+# $WinRmExchangeStrictMode = 1            # Exchange: user в Event 91 обязателен; 4624 только LogonProcess WinRM
 # HealthMailbox* уже в ExcludedUserPatterns скрипта
 # Проверка: powershell -File Login_Monitor.ps1 -CheckSac