. Challenge DescriptionUse the following free Microsoft software to detect and remove this threat: Windows Defender for Windows 10 and Windows 8. {"payload":{"allShortcutsEnabled":false,"fileTree":{"IntroClassFiles/Tools/IntroClass/deepbluecli":{"items":[{"name":"attachments","path":"IntroClassFiles/Tools. ConvertTo-Json - login failures not output correctly. It does take a bit more time to query the running event log service, but no less effective. It does take a bit more time to query the running event log service, but no less effective. Tag: DeepBlueCLI. Saved searches Use saved searches to filter your results more quickly DeepBlueCLI. Complete Free Website Security Check. Sysmon setup . We have used some of these posts to build our list of alternatives and similar projects. Here are my slides from my SANS Webcast Introducing DeepBlueCLI v3. Intro To Security ; Applocker ; Bluespawn ; DeepBlueCLI ; Nessus ; Nmap . ps1 <event log name> <evtx filename> See the Set-ExecutionPolicy Readme if you receive a ‘running scripts is disabled on this system’ error. What is the name of the suspicious service created? A. DeepBlueCLI is available here. Open the powershell in admin mode. py. DeepBlueCLI by Eric Conrad is a powershell module that can be used for Threat Hunting and Incident Response via Windows Event Logs. 本記事では2/23 (日)～2/28 (金)サンフランシスコで開催された、RSA Conferenceの参加レポートとなります。. This is an under 30 min solution video that helps in finding the answers to the investigation challenge created by Blue Team Labs Online (BTLO) [. DeepBlueCLI outputs in PowerShell objects, allowing a variety of output methods and types, including JSON, HTML, CSV, etc. {"payload":{"allShortcutsEnabled":false,"fileTree":{"IntroClassFiles/Tools/IntroClass/deepbluecli":{"items":[{"name":"attachments","path":"IntroClassFiles/Tools. It reads either a 'Log' or a 'File'. Además, DeepBlueCLI nos muestra un mensaje cercano para que entendamos rápidamente qué es sospechoso y, también, un resultado indicándonos el detalle sobre quién lo puede utilizar o quién, generalmente, utiliza este tipo comando. #13 opened Aug 4, 2019 by tsale. Introducing DeepBlueCLI v3. Download it from SANS Institute, a leading provider of. {"payload":{"allShortcutsEnabled":false,"fileTree":{"READMEs":{"items":[{"name":"README-DeepBlue. evtx","path":"evtx/Powershell-Invoke. Kr〇〇kの話もありません。. I copied the relevant system and security log to current dir and ran deepbluecli against it. DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs 2020-11-04 05:30:00 Author: 阅读量:223 收藏Threat hunting using DeepBlueCLI — a PowerShell Module via Windows Event Logs Check out my blog for setting up your virtual machine for this assignment: Click here I am going to use a free open source threat hunting tool called DeepBlueCLI by Eric Conrad that demonstrates some amazing detection capabilities. Yeah yeah I know, you will tell me to run a rootkit or use msfvenom to bypass the firewall but. A responder must gather evidence, artifacts, and data about the compromised. DeepBlueCLI. evtxpsattack-security. {"payload":{"allShortcutsEnabled":false,"fileTree":{"IntroClassFiles/Tools/IntroClass/deepbluecli":{"items":[{"name":"attachments","path":"IntroClassFiles/Tools. DeepBlueCLI, in concert with Sysmon, enables fast discovery of specific events detected in Windows Security, System, Application, PowerShell, and Sysmon logs. pipekyvckn. By default this is port 4444. Yes, this is in. No contributions on December 11th. Over 99% of students that use their free retake pass the exam. April 2023 with Erik Choron. 💡 Analyse the SRUM database and provide insights about it. DeepBlueCLI is a PowerShell script created by Eric Conrad that examines Windows event log information. 10. The magic of this utility is in the maps that are included with EvtxECmd, or that can be custom created. 基于Django构建的Windows环境下. Chainsaw or Hayabusa? Thoughts? In my experience, those using either tool are focused on a tool, rather than their investigative goals; what are they trying to solve, or prove/disprove? Also, I haven't seen anyone that I have seen use either tool write their own detections/filters, based on what they're seeing. c. You will apply all of the skills you’ve learned in class, using the same techniques used by Threat Hunting via DeepBlueCLI v3. The script assumes a personal API key, and waits 15 seconds between submissions. DeepBlueCLI, ported to Python. ps1 -log system # if the script is not running, then we need to bypass the execution policy Set-ExecutionPolicy Bypass -Scope CurrentUser First thing we need to do is open the security. evtx directory (which contain command-line logs of malicious attacks, among other artifacts). py Public Mark Baggett's (@MarkBaggett - GSE #15, SANS. . Prepare the Linux server. . Posted by Eric Conrad at 10:16 AM. Automation. Table of Contents . You may need to configure your antivirus to ignore the DeepBlueCLI directory. I forked the original version from the commit made in Christmas. PS C:\\> Get-ChildItem c:\\windows\\system32 -Include '*. In this video, I'll teach you how to use the Windows Task Scheduler to automate running DeepBlueCLI to look for evidence of adversaries on your network. I have a windows 11. Setup the DRBL environment. ps1 . And I do mean fast, DeepBlueCLI is quick against saved or archived EVTX files. CSI Linux. SOF-ELK - A pre-packaged VM with Elastic Stack to import data for DFIR analysis by Phil Hagen; so-import-evtx - Import evtx files into Security Onion. Saved searches Use saved searches to filter your results more quicklyRustyBlue - Rust port of DeepBlueCLI by Yamato Security. JSON file that is used in Spiderfoot and Recon-ng modules. as one of the C2 (Command&Control) defenses available. In the security descriptor definition language (SDDL), security descriptor string use SID strings for the following components of a security descriptor:. Top 10 companies in United States by revenue. What is the name of the suspicious service created? Investigate the Security. It is not a portable system and does not use CyLR. DeepBlueCLI ; A PowerShell Module for Threat Hunting via Windows Event Log. evtx log exports from the compromised system – you should analyze these, NOT the Windows logs generated by the lab machine (when using DeepBlueCLI ensure you’re providing the path to these files, stored inside DesktopInvestigation. DeepBlueCLI. DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs. #19 opened Dec 16, 2020 by GlennGuillot. . I'm running tests on a 12-Core AMD Ryzen. evtxmetasploit-psexec-powershell-target-security. Walmart. exe or the Elastic Stack. EVTX files are not harmful. evtx | FL Event Tracing for Windows (ETW). py. exe or the Elastic Stack. Optional: To log only specific modules, specify them here. . evtx であることが判明。 DeepBlueCLIはイベントIDを指定して取得を行っているため対象となるログが取得範囲外になっていたためエラーとなっていなかった模様。Contribute to r3p3r/sans-blue-team-DeepBlueCLI development by creating an account on GitHub. . JSON file that is used in Spiderfoot and Recon-ng modules. Since DeepBlueCLI is a PowerShell module, it creates objects as the output. In this video I have explained Threat hunting concept and performed a demonstration with help of opensource tools like DNSTwist, CyberChef, DeepBlueCLI and T. Automate any workflow. You signed out in another tab or window. Lfi-Space : Lfi Scan Tool. . 基于Django构建的Windows环境下. Install the required packages on server. You may need to configure your antivirus to ignore the DeepBlueCLI directory. Table of Contents. #5 opened Nov 28, 2017 by ssi0202. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs Eric Conrad, Backshore Communications, LLC deepblue at ba. Defaults to current working directory. On average 70% of students pass on their first attempt. evtx log exports from the compromised system are presented, with DeepBlueCLI as a special threat hunting tool. Oriana. The tool parses logged Command shell and. DerbyCon 2017: Introducing DeepBlueCLI v2 now available in PowerShell and Python ; Paul's Security Weekly #519; How to become a SANS instructor; DerbyCon 2016: Introducing DeepBlueCLI a PowerShell module for hunt teaming via Windows event logs; Security Onion Con 2016: C2 Phone Home; Long tail analysis {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":"READMEs","path":"READMEs","contentType":"directory"},{"name":"evtx","path":"evtx. Usage . These are the videos from Derbycon 7 (2017):Black Hills Information Security | @BHInfoSecurity You Are Compromised? What Now? John StrandThe List Price is the suggested retail price of a new product as provided by a manufacturer, supplier, or seller. In the “Options” pane, click the button to show Module Name. プログラム は C言語 で書かれ、 オペレーティングシステム は AIX が使われていた。. Contribute to mwhatter/DeepBlueCLI-1 development by creating an account on GitHub. evtxsmb-password-guessing. . Event Log Explorer is a PowerShell tool that is used to detect suspicious Windows event log entries. Oriana. DeepWhite-collector. You may need to configure your antivirus to ignore the DeepBlueCLI directory. DeepBlueCLI works with Sysmon to. It does take a bit more time to query the running event log service, but no less effective. . 10. Since DeepBlueCLI is a PowerShell module, it creates objects as the output. Explore malware evolution and learn about DeepBlueCLI v2 in Python and PowerShell with Adrian Crenshaw. {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":"READMEs","path":"READMEs","contentType":"directory"},{"name":"evtx","path":"evtx. deepblue at backshore dot net. #13 opened Aug 4, 2019 by tsale. RedHunt的目标是通过整合攻击者的武库和防御者的工具包来主动识别环境中的威胁，来提供威胁仿真（Threat Emulation）和威胁狩猎所有需求的一站式服务. A tag already exists with the provided branch name. Eric is the Chief Technology Officer (CTO) of Backshore Communications, a company focusing on hunt teaming, intrusion detection, incident. allow for json type input. You may need to configure your antivirus to ignore the DeepBlueCLI directory. Contribute to Stayhett/Go_DeepBlueCLI development by creating an account on GitHub. evtx","path":"evtx/many-events-application. 2. And I do mean fast, DeepBlueCLI is quick against saved or archived EVTX files. {"payload":{"allShortcutsEnabled":false,"fileTree":{"READMEs":{"items":[{"name":"README-DeepBlue. III. DeepBlueCLI can automatically determine events that are typically triggered during a majority of successful breaches, including use of malicious command lines including PowerShell. ps1 -log. DeepBlueCLI / DeepBlueHash-checker. Posted by Eric Conrad at 10:16 AM No comments: Sunday, June 11, 2023. Forensic Toolkit --OR-- FTK. DeepBlue. RedHunt-OS. Querying the active event log service takes slightly longer but is just as efficient. It is not a portable system and does not use CyLR. deepblue at backshore dot net. . Hello Guys. 0/5. Check here for more details. You have been provided with the Security. PS C:ToolsDeepBlueCLI-master > . I forked the original version from the commit made in Christmas… The exam features a select subset of the tools covered in the course, similar to real incident response engagements. DeepBlueCLI is. \DeepBlue. As you can see, they attempted 4625 failed authentication attempts. It identifies the fastest series of steps from any AD account or machine to a desired target, such as membership in the Domain Admins group. The only difference is the first parameter. . I thought maybe that i'm not logged in to my github, but then it was the same issue. Hello Eric, So we were practicing in SANS504 with your DeepBlueCLI script and when Chris cleared all the logs then ran the script again we didn't see the event ID "1102" - The Audit Log Was Cleared". py. Will be porting more functionality from DeepBlueCLI after DerbyCon 7. Next, the Metasploit native target (security) check: . {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":"READMEs","path":"READMEs","contentType":"directory"},{"name":"evtx","path":"evtx. evtx parses Event ID. A Password Spray attack is when the attacker tries a few very common. has a evtx folder with sample files. Eric Conrad,. Learn how to use it with PowerShell, ELK and output formats. Reload to refresh your session. /// 🔗 DeepBlue CLI🔗 Antisyphon Training Pay-What-You-Can Coursescontributions in the last year. {"payload":{"allShortcutsEnabled":false,"fileTree":{"READMEs":{"items":[{"name":"README-DeepBlue. You signed out in another tab or window. Defense Spotlight: DeepBlueCLI SECTION 6: Capture-the-Flag Event Our Capture-the-Flag event is a full day of hands-on activity that has you working as a consultant for ISS Playlist, a fictitious company that has recently been compromised. The exam features a select subset of the tools covered in the course, similar to real incident response engagements. Eric Conrad : WhatsMyName ; OSINT/recon tool for user name enumeration. 2. </p> <h2 tabindex=\"-1\" id=\"user-content-table-of-contents\" dir=\"auto\"><a class=\"heading-link\" href=\"#table-of-contents\">Table of Contents<svg class=\"octicon octicon-link\" viewBox=\"0 0 16 16\" version=\"1. Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . First, we confirm that the service is hidden: PS C:\tools\DeepBlueCLI> Get-Service | Select-Object Name | Select-String -Pattern 'SWCUEngine' PS C:\tools\DeepBlueCLI>. evtx log. More than 100 million people use GitHub to discover, fork, and contribute to over 420 million projects. py. Runspaces. . py. Contribute to r3p3r/sans-blue-team-DeepBlueCLI development by creating an account on GitHub. 000000+000. Posted by Eric Conrad at 10:16 AM No comments: Sunday, June 11, 2023. Upon clicking next you will see the following page. Every incident ends with a lessons learned meeting, and most executive summaries include this bullet point: "Leverage the tools you already paid for". Sysmon is required:. Cannot retrieve contributors at this time. . Computer Aided INvestigative Environment --OR-- CAINE. Reload to refresh your session. You should also run a full scan. Blue Team Level 1 is a practical cybersecurity certification focusing on defensive practices, security. DeepBlueCLI reviews and mentions. DeepBlueCLI-lite / READMEs / README-DeepWhite. This allows Portspoof to. Intro To Security ; Applocker ; Bluespawn ; DeepBlueCLI ; Nessus ; Nmap . It was created by Eric Conrad and it is available on GitHub. UsageDeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs Eric Conrad, Backshore Communications, LLC deepblue at backshore dot net Twitter: @eric_conrad. DeepBlueCLI, in concert with Sysmon, enables fast discovery of specific events detected in Windows Security, System, Application, PowerShell, and Sysmon. DeepBlueCLI is a PowerShell Module for Threat Hunting via Windows Event Logs. Yes, this is intentional. C: oolsDeepBlueCLI-master>powershell. 1. py. By analyzing event logging data, DeepBlueCLI can recognize unusual activity or traits. 专门用于攻防对抗仿真（Adversary Emulation）和威胁狩猎的虚拟机。. as one of the C2 (Command&Control) defenses available. Defense Spotlight: DeepBlueCLI SECTION 6: Capture-the-Flag Event Our Capture-the-Flag event is a full day of hands-on activity that has you working as a consultant for ISS Playlist, a fictitious company that has recently been compromised. Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . {"payload":{"allShortcutsEnabled":false,"fileTree":{"IntroClassFiles/Tools/IntroClass/deepbluecli/attachments":{"items":[{"name":"Clipboard_2020-06-12-10-36-44. allow for json type input. It does take a bit more time to query the running event log service, but no less effective. Sysmon is required:. To do this we need to open PowerShell within the DeepBlueCLI folder. Given Scenario, A Windows. DeepBlueCLI ; Domain Log Review ; Velociraptor ; Firewall Log Review ; Elk In The Cloud ; Elastic Agent ; Sysmon in ELK ; Lima Charlie ; Lima Charlie & Atomic Red ; AC Hunter CE ; Hunting DCSync, Sharepoint and Kerberoasting . As Windows updates, application installs, setting changes, and. PS C:\tools\DeepBlueCLI-master>. DeepBlueCLI bir Powershell modülüdür, bu nedenle ilk olarak bu modülü başlatmamız gerekiyor. Except for books, Amazon will display a List Price if the product was purchased by customers on Amazon or offered by other retailers at or above the List Price in at least the past 90 days. Contribute to s207307/DeepBlueCLI-lite development by creating an account on GitHub. Amazon. Recommended Experience. Eric Conrad, a SANS Faculty Fellow and course author of three popular SANS courses. DeepBlueCLI ya nos proporciona la información detallada sobre lo “sospechoso” de este evento. A number of events are triggered in Windows environments during virtually every successful breach, these include: service creation events and errors, user creation events, extremely long command lines, compressed and base64 encoded. #13 opened Aug 4, 2019 by tsale. In the Module Names window, enter * to record all modules. A tag already exists with the provided branch name. DeepBlueCLI is a PowerShell Module for Threat Hunting via Windows Event Logs. Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . com social media site. Micah Hoffman{"payload":{"allShortcutsEnabled":false,"fileTree":{"IntroClassFiles/Tools/IntroClass/deepbluecli":{"items":[{"name":"attachments","path":"IntroClassFiles/Tools. The Ultimate Guide to the CSSLP covers everything you need to know about the secure software development professional’s certification. To get the PowerShell commandline (and not just script block) on Windows 7 through Windows 8. {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":"READMEs","path":"READMEs","contentType":"directory"},{"name":"evtx","path":"evtx. Packages. Btlo. The only difference is the first parameter. Event Log Explorer. py. As far as I checked, this issue happens with RS2 or late. evtx directory (which contain command-line logs of malicious attacks, among other artifacts). allow for json type input. Targets; Defense Spotlight: DeepBlueCLI SECTION 6: Capture-the-Flag Event Over the years, the security industry has become smarter and more effective in stopping attackers. / DeepBlue. {"payload":{"allShortcutsEnabled":false,"fileTree":{"READMEs":{"items":[{"name":"README-DeepBlue. In the “Windows PowerShell” GPO settings, set “Turn on Module Logging” to enabled. It supports command line parsing for Security event log 4688, PowerShell log 4014, and Sysmon log 1. evtx","path":"evtx/Powershell-Invoke. The available options are: -od Defines the directory that the zip archive will be created in. System Monitor ( Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. \DeepBlue. And I do mean fast, DeepBlueCLI is quick against saved or archived EVTX files. There are 12 alerts indicating Password Spray Attacks. Yes, this is public. md","path":"READMEs/README-DeepBlue. EnCase. No contributions on December 18th. Hayabusaは事前に作成したルールに則ってWindowsイベントログを調査し、インシデントや何かしらのイベントが発生していないか高速に検知することができるツールです。DeepBlueCLIの攻撃検知ルールを追加する。 DeepBlueCLIの攻撃検知ルールを確認する WELAへと攻撃検知ルールの移植を行う DeepBlueCLIのイベントログを用いて同様の結果が得られるようにする。Su uso es muy sencillo, en primer lugar extraeríais los logs de eventos de Windows, y a continuación, se los pasaríais como un parámetro: . Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Investigate the Security. DownloadString('. What is the name of the suspicious service created? Whenever a event happens that causes the state of the system to change , Like if a service is created or a task was scheduled it falls under System logs category in windows. Now, we are going to use DeepBlueCLI to see if there are any odd logon patterns in the domain logs. Now, let's open a command Prompt: •DeepBlueCLI contains an evtx directory chock-full of logs showing malicious activity •Some over-aggressive antivirus (I'm looking at you, Windows Defender Antivirus) will quarantine the logs •Then I receive angry accusing emails from random infosec professionals who are apparently frightened by scary… logs These are the videos from Derbycon 2016:{"payload":{"allShortcutsEnabled":false,"fileTree":{"READMEs":{"items":[{"name":"README-DeepBlue. to s207307/DeepBlueCLI-lite development by creating an account on GitHub. Introducing Athena AI our new generative AI layer for the Varonis Data Security Platform. DeepBlueCLI is available here. {"payload":{"allShortcutsEnabled":false,"fileTree":{"evtx":{"items":[{"name":"Powershell-Invoke-Obfuscation-encoding-menu. EVTX files are not harmful. this would make it alot easier to run the script as a pre-parser on data coming in from winlogbeat /logstasah before being sent to elasticsearch db"a PowerShell Module for Threat Hunting via Windows Event Logs" and Techniques for Digital Forensics and Incident Response - Blue-Team-Toolkit/deepbluecli. CyLR. The exam features a select subset of the tools covered in the course, similar to real incident response engagements. DeepBlueCLI: a PowerShell Module for Hunt Teaming via Windows Event Logs. Now, let's open a command Prompt: Note If your antivirus freaks out after downloading DeepBlueCLI: it's likely reacting to the included EVTX files in the . evtx log. WebClient). 0 5 0 0 Updated Jan 19, 2023. DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs. a. {"payload":{"allShortcutsEnabled":false,"fileTree":{"":{"items":[{"name":"READMEs","path":"READMEs","contentType":"directory"},{"name":"evtx","path":"evtx. DeepBlue. exe /c echo kyvckn > . Every incident ends with a lessons learned meeting, and most executive summaries include this bullet point: "Leverage the tools you already paid for"Are you. evtx. 0 329 7 7 Updated Oct 14, 2023. He has over 28 years of information security experience , has created numerous tools and co-authored the CISSP Study Guide. Table of Contents . DeepBlueCLI is an open-source framework that automatically parses Windows event logs and detects threats such as. DeepBlueCLI, in concert with Sysmon, enables fast discovery of specific events detected in Windows Security, System, Application, PowerShell, and Sysmon. . evtx file and review its contents. md","path":"READMEs/README-DeepBlue. From the above link you can download the tool. RedHunt-OS. DeepBlueCLI is a command line tool which correlates the events and draws conclusions. DeepBlueCLI ; Domain Log Review ; Velociraptor ; Firewall Log Review ; Elk In The Cloud ; Elastic Agent ; Sysmon in ELK ; Lima Charlie ; Lima Charlie & Atomic Red ; AC Hunter CE ; Hunting DCSync, Sharepoint and Kerberoasting . Lab 1. dll module. The original repo of DeepBlueCLI by Eric Conrad, et al. An important thing to note is you need to use ToUniversalTime() when using [System. Why? No EXE for antivirus or HIPS to squash, nothing saved to the filesystem, sites that use application whitelisting allow PowerShell, and little to no default logging. Event Viewer automatically tries to resolve SIDs and show the account name. The CyLR tool collects forensic artifacts from hosts with NTFS file systems quickly, securely and minimizes impact to the host. Our open source model ensures our products are always free to use and highly documented, while our international user base and 20 year track record demonstrates our ability to keep up with the. Using DeepBlueCLI investigate the recovered System. Management. DeepBlueCLI is a PowerShell library typically used in Utilities, Command Line Interface applications. png. But you can see the event correctly with wevtutil and Event Viewer. Contribute to CrackDome/deepbluecli development by creating an account on GitHub. The working solution for this question is that we can DeepBlue. evtx file using : Out-GridView option used to get DeepBlueCLI output as GridView type. On average 70% of students pass on their first attempt. md","path":"READMEs/README-DeepBlue. EVTX files are not harmful. Now we will analyze event logs and will use a framework called deepbluecli which will enrich evtx logs. md","contentType":"file. Answer : cmd. I found libevtx 'just worked', and had the added benefit of both Python and compiled options. We can observe the original one 2022–08–21 13:02:23, but the attacker tampered with the timestamp to 2021–12–25 15:34:32. You may need to configure your antivirus to ignore the DeepBlueCLI directory. {"payload":{"allShortcutsEnabled":false,"fileTree":{"IntroClassFiles/Tools/IntroClass/Wireshark":{"items":[{"name":"attachments","path":"IntroClassFiles/Tools. This will work in two modes. Download and extract the DeepBlueCLI tool . Here's a video of my 2016 DerbyCon talk DeepBlueCLI. Posted by Eric Conrad at 10:16 AM No comments: Sunday, June 11, 2023. 3. Learn how CSSLP and ISC2 can help you navigate your training path, create your plan and distinguish you as a globally respected secure. A tag already exists with the provided branch name. #19 opened Dec 16, 2020 by GlennGuillot. For single core performance, it is both the fastest and the only cross-platform parser than supports both xml and JSON outputs. You may need to configure your antivirus to ignore the DeepBlueCLI directory. Code definitions. py evtx/password-spray. He has over 28 years of information security experience , has created numerous tools and co-authored the CISSP Study Guide.