# 獲取系統(tǒng)詳細(xì)配置(合規(guī)性檢查基礎(chǔ))
$systemInfo = Get-ComputerInfo | Select-Object OsName, OsVersion, BiosFirmwareType

# 檢查補(bǔ)丁安裝情況
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object HotFixID,InstalledOn -First 10

# 驗(yàn)證安全服務(wù)狀態(tài)(防病毒/防火墻)
Get-Service WinDefend, Mpssvc | Select-Object Name,Status,StartType

# 實(shí)時(shí)檢測(cè)可疑進(jìn)程(對(duì)比基線)
Get-Process | Where-Object {$_.CPU -gt 90 -or $_.WorkingSet -gt 500MB} | 
    Select-Object Name,CPU,VM,WS,Path

# 分析異常網(wǎng)絡(luò)連接
Get-NetTCPConnection -State Established | 
    Where-Object {$_.RemoteAddress -notmatch '^(192\.168|10\.)'} |
    Select-Object LocalAddress,RemoteAddress,OwningProcess

# 安全事件日志快速檢索
$filterHash = @{
    LogName = 'Security'
    ID = 4624,4625   # 成功/失敗登錄
    StartTime = (Get-Date).AddDays(-1)
}

Get-WinEvent -FilterHashtable $filterHash | 
    Group-Object -Property Id -NoElement |
    Sort-Object -Property Count -Descending

# 發(fā)現(xiàn)惡意進(jìn)程后自動(dòng)處置
$suspicious = Get-Process -Name "*miner*" -ErrorAction SilentlyContinue
if ($suspicious) {
    Stop-Process -InputObject $suspicious -Force
    Write-EventLog -LogName "Security" -Source "SecScript" -EntryType Warning -EventId 999 -Message "終止可疑挖礦進(jìn)程: $($suspicious.Name)" 
}

# 部署安全更新到多臺(tái)服務(wù)器
$computers = 'SRV01','SRV02','SRV03'
$cred = Get-Credential
$scriptBlock = {
    Install-PackageProvider -Name NuGet -Force
    Install-Module PSWindowsUpdate -Force
    Add-WUServiceManager -ServiceID 7971f918-a847-4430-9279-4a52d1efe18d -Confirm:$false
}

Invoke-Command -ComputerName $computers -Credential $cred -ScriptBlock $scriptBlock -AsJob

# 安全存儲(chǔ)密碼憑據(jù)
$securePass = ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force
Export-Clixml -InputObject $securePass -Path "C:\secure\cred.xml"

# 使用時(shí)安全讀取
$importPass = Import-Clixml -Path "C:\secure\cred.xml"
$credential = New-Object System.Management.Automation.PSCredential("admin", $importPass)

# 創(chuàng)建每小時(shí)檢查的定時(shí)任務(wù)
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\monitor\check_port.ps1"
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
Register-ScheduledTask -TaskName "端口監(jiān)控" -Action $action -Trigger $trigger -User "SYSTEM"

# 推薦設(shè)置為RemoteSigned平衡安全與便利
Set-ExecutionPolicy RemoteSigned -Force

# 檢查腳本簽名狀態(tài)
Get-AuthenticodeSignature -FilePath .\sec_script.ps1 | 
    Where-Object { $_.Status -ne "Valid" }

# 記錄所有操作日志(審計(jì)要求)
Start-Transcript -Path "$env:USERPROFILE\Documents\PSLogs\$(Get-Date -Format yyyyMMdd).log" -Append