From 2d54e718fbd72a03aeab4b60038a79440ed8d4be Mon Sep 17 00:00:00 2001
From: Eric Conrad <git@zez.me>
Date: Thu, 7 Sep 2017 16:13:38 -0400
Subject: [PATCH] Update DeepWhite.md

---
 DeepWhite.md | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/DeepWhite.md b/DeepWhite.md
index b154043..93d3679 100644
--- a/DeepWhite.md
+++ b/DeepWhite.md
@@ -1 +1,19 @@
-DeepWhite version 0.1
+DeepWhite
+
+Detective whitelisting using Sysmon event logs
+
+Placeholder, more to come...
+
+Install hashdeep: https://github.com/jessek/hashdeep/releases
+
+Generate your own whitelist on Windows:
+
+hashdeep.exe -r / -c md5,sha1,sha56 > raw-hashes.csv
+Note that hashdeep, etc., has a dumb recursive design (from the manpage):
+
+Enables recursive mode. All subdirectories are traversed. Please note that recursive mode cannot be used to examine all files of a given file extension. For example, calling hashdeep -r *.txt will examine all files in directories that end in .txt.
+Move file to Unix/Linux, remove Windows carriage returns, grab EXEs and DLLs, make CSV.
+
+CSV format will be: md5,sha1,sha256,full path:
+
+cat raw-hashes.csv | tr -d '\r' | egrep "\.dll$|\.exe$" | cut -d, -f2- > win10-x64.csv