Cyberdefense/DeepBlueCLI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #29 from sans-blue-team/Conrad-test

Browse Source 
s/DeepWhite/DeepBlueHash
This commit is contained in:
Eric Conrad
2022-01-05 13:51:00 -05:00
committed by GitHub
parent eebd75d029 0f6a93b2f0
commit 115b4f30b2
4 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -22,7 +22,7 @@ Sample EVTX files are in the .\evtx directory
- [Output](#output)
- [Logging setup](#logging-setup)
- See the [DeepBlue.py Readme](READMEs/README-DeepBlue.py.md) for information on DeepBlue.py
- See the [DeepWhite Readme](READMEs/README-DeepWhite.md) for information on DeepWhite (detective safelisting using Sysmon event logs)
- See the [DeepBlueHash Readme](READMEs/README-DeepBlueHash.md) for information on DeepBlueHash (detective safelisting using Sysmon event logs)
## Usage:
@ -157,7 +157,7 @@ Thank you: [@heinzarelli](https://twitter.com/heinzarelli) and [@HackerHurricane
Install Sysmon from Sysinternals: https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
DeepBlue and DeepWhite currently use Sysmon events, 1, 6 and 7.
DeepBlue and DeepBlueHash currently use Sysmon events, 1, 6 and 7.
Log SHA256 hashes. Others are fine; DeepWhite will use SHA256.