PSRecon

grr

GRR Rapid Response: remote live forensics for incident response

Hunting ELK (HELK)

The Hunting ELK

DeepBlueCLI

DeepBlueCLI is a PowerShell module designed for security professionals to perform threat hunting and forensic analysis using Windows Event Logs. It processes logs from Security, System, Application, PowerShell, and Sysmon sources to detect a wide range of suspicious activities and attack patterns. ## Key Features - **Suspicious Account Detection** — Identifies user creation, group additions, password guessing, password spraying, and Bloodhound-style privilege anomalies. - **Command-Line Analysis** — Detects long command lines, obfuscated commands, PowerShell launched via WMIC/PsExec, and compressed/Base64-encoded commands with automatic decoding. - **Service Auditing** — Flags suspicious service creation, service errors, and attempts to stop/start the Windows Event Log service. - **Attack Tool Detection** — Recognizes Mimikatz `lsadump::sam` commands and EMET/AppLocker blocks. - **Flexible Output** — Exports results in multiple formats including JSON, CSV, HTML, XML, and PowerShell objects for further analysis. ## Philosophy DeepBlueCLI prioritizes practical, actionable detection of real-world attack techniques, leveraging built-in Windows logging capabilities to provide defenders with a powerful, scriptable hunting tool.

MozDef

DEPRECATED - MozDef: Mozilla Enterprise Defense Platform