DeepBlueCLI : A PowerShell Module For Threat Hunting Via Windows Event Logs

DeepBlueCLI is a PowerShell Module for Threat Hunting via Windows Event Logs.

Usage

.\DeepBlue.ps1 <event log name> <evtx filename>

See the Set-ExecutionPolicy Readme if you receive a ‘running scripts is disabled on this system’ error.

  • Process local Windows security event log (PowerShell must be run as Administrator):

.\DeepBlue.ps1

or:

.\DeepBlue.ps1 -log security

  • Process local Windows system event log:

.\DeepBlue.ps1 -log system

  • Process evtx file:

.\DeepBlue.ps1 .\evtx\new-user-security.evtx

Windows Event Logs Processed

  • Windows Security
  • Windows System
  • Windows Application
  • Windows PowerShell
  • Sysmon

Command Line Logs Processed

See Logging setup section below for how to configure these logs

  • Windows Security event ID 4688
  • Windows PowerShell event IDs 4103 and 4104
  • Sysmon event ID 1

Detected Events

  • Suspicious account behavior
    • User creation
    • User added to local/global/universal groups
    • Password guessing (multiple logon failures, one account)
    • Password spraying via failed logon (multiple logon failures, multiple accounts)
    • Password spraying via explicit credentials
    • Bloodhound (admin privileges assigned to the same account with multiple Security IDs)
  • Command line/Sysmon/PowerShell auditing
    • Long command lines
    • Regex searches
    • Obfuscated commands
    • PowerShell launched via WMIC or PsExec
    • PowerShell Net.WebClient Downloadstring
    • Compressed/Base64 encoded commands (with automatic decompression/decoding)
    • Unsigned EXEs or DLLs
  • Service auditing
    • Suspicious service creation
    • Service creation errors
    • Stopping/starting the Windows Event Log service (potential event log manipulation)
  • Mimikatz
    • lsadump::sam
  • EMET & Applocker Blocks

…and more

Examples

EventCommand
Event log manipulation.\DeepBlue.ps1 .\evtx\disablestop-eventlog.evtx
Metasploit native target (security).\DeepBlue.ps1 .\evtx\metasploit-psexec-native-target-security.evtx
Metasploit native target (system).\DeepBlue.ps1 .\evtx\metasploit-psexec-native-target-system.evtx
Metasploit PowerShell target (security).\DeepBlue.ps1 .\evtx\metasploit-psexec-powershell-target-security.evtx
Metasploit PowerShell target (system).\DeepBlue.ps1 .\evtx\metasploit-psexec-powershell-target-system.evtx
Mimikatz lsadump::sam.\DeepBlue.ps1 .\evtx\mimikatz-privesc-hashdump.evtx
New user creation.\DeepBlue.ps1 .\evtx\new-user-security.evtx
Obfuscation (encoding).\DeepBlue.ps1 .\evtx\Powershell-Invoke-Obfuscation-encoding-menu.evtx
Obfuscation (string).\DeepBlue.ps1 .\evtx\Powershell-Invoke-Obfuscation-string-menu.evtx
Password guessing.\DeepBlue.ps1 .\evtx\smb-password-guessing-security.evtx
Password spraying.\DeepBlue.ps1 .\evtx\password-spray.evtx
PowerSploit (security).\DeepBlue.ps1 .\evtx\powersploit-security.evtx
PowerSploit (system).\DeepBlue.ps1 .\evtx\powersploit-system.evtx
PSAttack.\DeepBlue.ps1 .\evtx\psattack-security.evtx
User added to administrator group.\DeepBlue.ps1 .\evtx\new-user-security.evtx

Output

DeepBlueCLI outputs in PowerShell objects, allowing a variety of output methods and types, including JSON, HTML, CSV, etc.

For example:

Output TypeSyntax
CSV.\DeepBlue.ps1 .\evtx\psattack-security.evtx | ConvertTo-Csv
Format list (default).\DeepBlue.ps1 .\evtx\psattack-security.evtx | Format-List
Format table.\DeepBlue.ps1 .\evtx\psattack-security.evtx | Format-Table
GridView.\DeepBlue.ps1 .\evtx\psattack-security.evtx | Out-GridView
HTML.\DeepBlue.ps1 .\evtx\psattack-security.evtx | ConvertTo-Html
JSON.\DeepBlue.ps1 .\evtx\psattack-security.evtx | ConvertTo-Json
XML.\DeepBlue.ps1 .\evtx\psattack-security.evtx | ConvertTo-Xml

Logging Setup

  • Security event 4688 (Command line auditing):

Enable Windows command-line auditing: https://support.microsoft.com/en-us/kb/3004375

  • Security event 4625 (Failed logons):

Requires auditing logon failures: https://technet.microsoft.com/en-us/library/cc976395.aspx

  • PowerShell auditing (PowerShell 5.0):

DeepBlueCLI uses module logging (PowerShell event 4103) and script block logging (4104). It does not use transcription.

See: https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html

To get the PowerShell commandline (and not just script block) on Windows 7 through Windows 8.1, add the following to \Windows\System32\WindowsPowerShell\v1.0\profile.ps1

$LogCommandHealthEvent = $true
$LogCommandLifecycleEvent = $true

See the following for more information:

Thank you: @heinzarelli and @HackerHurricane

Sysmon

R K

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

1 week ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

1 week ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

1 week ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

1 week ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

1 week ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

2 weeks ago