PowerShell module for Windows event log threat hunting
DeepBlueCLI is a PowerShell module developed by SANS for threat hunting via Windows Event Logs. It detects suspicious activity patterns including command-line obfuscation, privilege escalation attempts, Mimikatz usage, and unusual service installations by analyzing Security, System, and Sysmon logs.