Even with Event Log Explorer, it's pretty powerful.
We could search through things pretty quickly.
Well, what if we don't know what to look for.
If we're a new analyst, if you're a junior analyst,
you may not know what to look for,
and so there are some tools there that will help you out.
So I'm going to run one of those tools.
Let me close this out, close all this out.
And the tool I'm going to run is a PowerShell tool,
and again,
I'm running this as an administrator only because I want to make sure that my
tool can see everything on the system and it's not restricted.
You need admin rights to be able to see the security logs.
So there's a tool here called DeepBlueCLI,
and DeepBlue is a tool that is going to go in and it's going to scan
your event logs in looking for anything anomalous.
So we've already seen on the system what happened,
what the attacker did, we have the encoded PowerShell and all that,
but we had to search for it.
So what I'm going to do is I'm going to run DeepBlue and hit Enter,
and you can see that it went through,
and not only did it find all of the stuff that we found,
it actually tells us where it found it, when it occurred,
and then it has why it flagged this.
So in the case right here,
we can see that it determined this was a suspicious command line
because it found 500 plus consecutive Base64 characters,
so a really long Base64 string,
it sees the Base64 Encoded function being listed there,
and then it also sees a download through the PowerShell.
So it flagged it all for us.
As an analyst, I may not think to look for all of this,
or I may not even have the capability to look for all of this.
And maybe some obscure endpoint.
You're not looking,
you're not mainly searching through every log of every endpoint all the time.
Exactly.
And tools like DeepBlue will help you do that.
You can automate it.
You could, if you're doing forensics,
you can pull out the Windows event logs and tell DeepBlue to look for it,
and it's a really great way to very quickly go in and triage a
system to determine if it's been compromised or not.
Yeah, so we've kind of gone from let's look for a specific ID,
and we know Microsoft doing PowerShell is weird,
but again, when we talked about getting lost in the noise,
PowerShell is used for admin stuff all the time.
So simply searching for a PowerShell string can really lead you
astray depending on how active your admin guys are.
On the system,
I had cleared the logs before I ran it just so we
could have something clean to look at.
But if this was an organization's system that the
administrators were using PowerShell,
there would be probably literally thousands of logs that
we would have had to gone through.
And a tool like this very quickly will pull out the bad stuff for us.
Yeah, so this just learned some of those bad things,
here being the Base64 or even seeing entropy in
strings that indicates it's encoded.
So that really helps narrow you down, and then you can generate alerts from that.
And it's even kind of written like an alert, like Base64 encoded function.
That's the name of my alert.
Yeah exactly.