DeepBlueCLI Logo

DeepBlueCLI

0
Free
Visit Website

DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs Eric Conrad, Backshore Communications, LLC Sample EVTX files are in the .\evtx directory Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the .\evtx directory (which contain command-line logs of malicious attacks, among other artifacts). EVTX files are not harmful. You may need to configure your antivirus to ignore the DeepBlueCLI directory. Table of Contents Usage Windows Event Logs processed Detected events Examples Output Logging setup See the DeepBlue.py Readme for information on DeepBlue.py See the DeepBlueHash Readme for information on DeepBlueHash (detective safelisting using Sysmon event logs) Usage: .\DeepBlue.ps1 <event log name> <evtx filename> See the Set-ExecutionPolicy Readme if you receive a 'running scripts is disabled on this system' error. Process local Windows security event log (PowerShell must be run as Administrator): .\DeepBlue.ps1 or: .DeepBlue.ps1 -log security Process local Windows system event log: .DeepBlue.ps1 -log system Proc

FEATURES

ALTERNATIVES

Tool for visualizing correspondences between YARA ruleset and samples

Automatic YARA rule generator based on Koodous reports with limited false positives.

A Pythonic framework for automated threat modeling shifting left.

A modular malware collection and processing framework with support for various threat intelligence feeds.

MISP is an open source threat intelligence platform that enhances threat information sharing and analysis.

A free threat intelligence feed and banlist feed of known malicious IP addresses for public use only.

Automatically curate open-source Yara rules and run scans with YAYA.

Tool for dataviz and statistical analysis of threat intelligence feeds, presented in cybersecurity conferences for measuring IQ of threat intelligence feeds.