DeepBlueCLI

Description

DeepBlueCLI is a PowerShell module developed by SANS for threat hunting via Windows Event Logs. It detects suspicious activity patterns including command-line obfuscation, privilege escalation attempts, Mimikatz usage, and unusual service installations by analyzing Security, System, and Sysmon logs.

Use Cases

• Threat hunting in Windows Event Logs
• Detecting Mimikatz and credential dumping activity
• Identifying command-line obfuscation and encoded PowerShell

Attack Phases

MITRE ATT&CK Techniques (3)