Commits

Branch selector

 master

User selector

All users

Datepicker

All time

Commit History

Commits on Oct 28, 2021

• Added AV caveat

  eric-conrad

  authored
  2ae82a2

• Merge pull request sans-blue-team#26 from sans-blue-team/Conrad-test

  Show description for 8b15218
  eric-conrad

  authored
  8b15218

• Inclusive language update

  eric-conrad

  committed
  15999a1

• Inclusive language update

  eric-conrad

  committed
  62d25d9

• Inclusive language update

  eric-conrad

  committed
  46bb325

Commits on Sep 16, 2021

• Update DeepBlue.ps1

  Show description for 0c7338d
  netscylla

  authored
  0c7338d

• Added code to support flagging suspicious wmi filter events, also added sample log file

  netscylla

  committed
  ddb9e3e

Commits on Jul 1, 2021

• Changing whitelist to ignorelist

  eric-conrad

  authored
  45c21e3

Commits on May 6, 2021

• Merge pull request sans-blue-team#22 from zmbf0r3ns1cs/master

  Show description for 396bbc4
  joswr1ght

  authored
  396bbc4

Commits on May 5, 2021

• Update System EID 104 output for DeepBlue.ps1

  Show description for 122d078
  zerber0s

  authored
  122d078

Commits on Oct 13, 2020

• Correct typo in DeepBlue.ps1 hidden service detect

  joswr1ght

  committed
  c2a3840

Commits on Sep 14, 2020

• Update to catch services.exe DAC permission change to hide services

  joswr1ght

  committed
  3fae5db

Commits on Sep 10, 2020

• Report on cleared Security and System event logs, close sans-blue-team#18

  joswr1ght

  committed
  bc63790

Commits on Aug 18, 2020

• Fix Event ID reporting in analysis @scriptedstatement; whitespace cleanup

  joswr1ght

  committed
  486dd1f

• Add .gitignore

  joswr1ght

  committed
  d004e13

• Add simple test case to run all repo EVTX files with DeepBlue.ps1

  joswr1ght

  committed
  29daee4

Commits on Jan 20, 2020

• Fixed typo in Examples section

  eric-conrad

  authored
  8cbb39a

Commits on Dec 24, 2019

• Changed multiple failed login alert from 25 to 5 to more accurately reflect password spray attack evidence

  joswr1ght

  committed
  7294cc4

Commits on Jul 24, 2019

• Merge pull request sans-blue-team#12 from itpropaul/patch-1

  Show description for 5c0c972
  eric-conrad

  authored
  5c0c972

• typo: fixed "event 4013" to be "event 4103"

  itpropaul

  authored
  ea289ac

Commits on May 8, 2019

• Updated the events table

  eric-conrad

  authored
  5e796ca

• Removed token::elevate from readme

  eric-conrad

  authored
  9834750

Commits on May 6, 2019

• Disable Mimikatz token::elevate detection; I thought I was on to a cool detect, but sadly it's just Windows operating normally with excessive privileges.

  joswr1ght

  committed
  d500632

• Disable Metasploit psexec detect due to false-positive conflict with MS Exchange; revise alert for _Multiple admin logons for one account_ to show attempt count instead of unique event IDs

  joswr1ght

  committed
  612cde1

Commits on May 4, 2019

• Added section link

  eric-conrad

  authored
  1708e03

• Minor edits

  eric-conrad

  authored
  4eeb1c0

• Reorganized the READMEs

  eric-conrad

  authored
  8408263

• Rename Set-ExecutionPolicy.md to READMEs/Set-ExecutionPolicy.md

  eric-conrad

  authored
  84e726b

• Delete readme-deepblue.py

  eric-conrad

  authored
  8d7cb11

• Rename README-DeepWhite.md to READMEs/README-DeepWhite.md

  eric-conrad

  authored
  3640dc1

• Rename README-DeepBlue.py.md to READMEs/README-DeepBlue.py.md

  eric-conrad

  authored
  af4f55c

• Create test.md

  eric-conrad

  authored
  3996c44

• Create Set-ExecutionPolicy.md

  eric-conrad

  authored
  5e31082

• Updated links

  eric-conrad

  authored
  7166a8f

• Updated link

  eric-conrad

  authored
  4572c78

Pagination

PreviousNext