Windows Unauthorized Admin Login Script

<#
This resource is provided as a convenience for Level users. We cannot 
guarantee it will work in all environments. Please test before deploying 
to your production environment. We welcome contributions to our community 
library

# Level Library
# https://level.io/library/script-windows-unauthorized-admin-login
#>

# Define allowed admin users
$AllowedAdmins = "{{cf_authorized_admins}}"
$AllowedAdminsArray = $AllowedAdmins -split ", "

# Define known system accounts to ignore
$SystemAccounts = @("DWM-1", "DWM-2", "DWM-3", "UMFD-0", "UMFD-1", "UMFD-2", "UMFD-3", "SYSTEM")

# Get the current time and subtract one hour to filter events
$StartTime = (Get-Date).AddHours(-1)

# Get recent successful logins (Event ID 4624) within the last hour and filter for interactive/RDP logins
$Logins = Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    ID = 4624
    StartTime = $StartTime
} | Where-Object {
    # Extract logon type
    $LogonType = $_.Properties[8].Value
    # Only check interactive (2) and remote desktop (10) logins
    ($LogonType -eq 2 -or $LogonType -eq 10)
} | ForEach-Object {
    $_.Properties[5].Value  # Extract the account name
} | Where-Object { $_ -notin $SystemAccounts } | Select-Object -Unique

# Debug: Show detected logins
Write-Host "Detected Admin Logins in Last Hour: $($Logins -join ', ')"

# Check if any unauthorized admin has logged in
$UnauthorizedAdmins = $Logins | Where-Object { $_ -notin $AllowedAdminsArray }

if ($UnauthorizedAdmins) {
    Write-Host "ALERT: Unauthorized admin login detected: $($UnauthorizedAdmins -join ', ')"
    exit 1
}

Write-Host "All admin logins in the last hour are authorized."
exit 0