Cyberdefense/DeepBlueCLI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reorganized the READMEs

Browse Source
This commit is contained in:
Eric Conrad
2019-05-04 12:41:14 -03:00
committed by GitHub
parent 84e726b99e
commit 840826359b
1 changed files with 4 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
README.md
View File

@ -19,24 +19,15 @@ Sample evtx files are in the .\evtx directory
- [Examples](#examples) - [Examples](#examples)
- [Output](#output) - [Output](#output)
- [Logging setup](#logging-setup) - [Logging setup](#logging-setup)
- See the [DeepBlue.py Readme](README-DeepBlue.py.md) for information on DeepBlue.py - See the [DeepBlue.py Readme](READMEs/README-DeepBlue.py.md) for information on DeepBlue.py
- See the [DeepWhite Readme](README-DeepWhite.md) for information on DeepWhite (detective whitelisting using Sysmon event logs) - See the [DeepWhite Readme](READMEs/README-DeepWhite.md) for information on DeepWhite (detective whitelisting using Sysmon event logs)
## Usage: ## Usage:
`.\DeepBlue.ps1 <event log name> <evtx filename>` `.\DeepBlue.ps1 <event log name> <evtx filename>`
If you see this error: `.\DeepBlue.ps1 : File .\DeepBlue.ps1 cannot be loaded because running scripts is See the [Set-ExecutionPolicy Readme](READMEs/Set-ExecutionPolicy.md) if you receive a 'running scripts is
disabled on this system. For more information, see about_Execution_Policies at disabled on this system' error.
http://go.microsoft.com/fwlink/?LinkID=135170.`
You must run Set-ExecutionPolicy as Administrator, here is an example (this will warn every time you run a ps1 script): `Set-ExecutionPolicy RemoteSigned`
This command will bypass Set-Execution entirely: `Set-ExecutionPolicy Bypass`
See `get-help Set-ExecutionPolicy` for more options.
Please note that "Set-ExecutionPolicy is not a security control" (quoting [@Ben0xA](https://twitter.com/ben0xa))
### Process local Windows security event log (PowerShell must be run as Administrator): ### Process local Windows security event log (PowerShell must be run as Administrator):