DeepBlueCLI

.\DeepBlue.ps1 -log Security

Analyzes Windows logs (Security, PowerShell, Sysmon) looking for attack indicators with heuristic rules, without internet connection.

Run it when you have an EVTX or the live log and want a first automatic hunting pass: DeepBlueCLI applies heuristic rules (anomalous logons, obfuscated PowerShell, account creation, mimikatz in 4688, log clearing events) and flags suspicious events with their MITRE technique. It's the ideal tool for the analyst who receives a bunch of logs and doesn't know where to start — the equivalent of Loki but for Windows events. It works offline, weighs nothing, and can be pointed at any log (Security, System, PowerShell, Sysmon, AppLocker).

Don't use it as a verdict: heuristic rules generate false positives (legitimate admin activity that looks like an attack) and false negatives (attacks that don't match the patterns). It's triage, not analysis. On logs from very active hosts, the output can be long — filter by severity. And watch out for performance on huge EVTX files: full analysis of a weeks-long log takes time; narrow it down with -n (number of events) or use an already filtered EVTX. It doesn't detect what isn't in the logs: if the host's auditing didn't capture the event, DeepBlueCLI won't invent it.