|
1 | | -## 🔵 BlueTeam-Tools Suite |
2 | | -### DFIR · Forensic Readiness · Security Visibility |
| 1 | +# 🛡️ BlueTeam-Tools |
| 2 | +### DFIR · Event Logs · Incident Response · Forensic Readiness |
3 | 3 |
|
4 | | -[]() []() []() []() []() |
| 4 | +[](https://github.com/brazilianscriptguy/Windows-SysAdmin-ProSuite) |
| 5 | +[]() |
| 6 | +[]() |
| 7 | +[]() |
| 8 | +[]() |
| 9 | +[]() |
5 | 10 |
|
6 | | ---- |
7 | | - |
8 | | -## 🧭 Overview |
9 | | - |
10 | | -The **BlueTeam-Tools Suite** is a **forensic-grade PowerShell toolkit** designed for **Blue Team**, **DFIR**, and **Cybersecurity Operations** within Windows enterprise and public-sector environments. |
11 | | - |
12 | | -It provides **repeatable**, **auditable**, and **incident-ready** tooling to support: |
| 11 | +**BlueTeam-Tools** is the defensive security and forensic analysis pillar of the |
| 12 | +**Windows-SysAdmin-ProSuite**, providing enterprise-grade PowerShell tooling for: |
13 | 13 |
|
14 | | -- Live-response operations |
15 | | -- Event correlation and threat hunting |
16 | | -- Evidence collection and forensic readiness |
17 | | -- Security posture validation and audit support |
18 | | - |
19 | | -All tools follow the same engineering principles applied across **Windows-SysAdmin-ProSuite**: |
20 | | -**deterministic execution, structured logging, and governance alignment**. |
| 14 | +- 🔍 Threat detection and investigation |
| 15 | +- 🧾 Windows Event Log analysis |
| 16 | +- 🕵️ Incident response support |
| 17 | +- 📊 Audit-ready forensic reporting |
21 | 18 |
|
22 | 19 | --- |
23 | 20 |
|
24 | | -## 🧪 Core Capabilities |
25 | | - |
26 | | -[]() []() []() []() |
| 21 | +## 🎯 Operational Scope |
27 | 22 |
|
28 | | -- 🔍 **Forensic Automation** |
29 | | - Extraction of Windows Event Logs, registry artifacts, network sessions, user activity, and volatile system state. |
| 23 | +[]() |
| 24 | +[]() |
| 25 | +[]() |
| 26 | +[]() |
30 | 27 |
|
31 | | -- 🛡️ **Incident Response Support** |
32 | | - Live-response data capture, evidence preservation, and correlation during active or post-incident scenarios. |
| 28 | +Designed to support: |
33 | 29 |
|
34 | | -- 📊 **Security Visibility & Auditability** |
35 | | - Policy validation, configuration auditing, and exportable `.csv` / `.log` artifacts suitable for compliance and investigations. |
36 | | - |
37 | | ---- |
38 | | - |
39 | | -## 🧩 Script Categories & Architecture |
40 | | - |
41 | | -[]() []() |
42 | | - |
43 | | -| Component | Purpose | Documentation | |
44 | | -|-----------|---------|---------------| |
45 | | -| **EventLogMonitoring** | Security-focused analysis of Windows Event Logs, including authentication failures, privilege escalation, lateral movement indicators, and policy violations. | [](EventLogMonitoring/README.md) | |
46 | | -| **IncidentResponse** | Live-response and post-incident utilities for volatile artifacts, active sessions, system metadata, and threat indicators. | [](IncidentResponse/README.md) | |
| 30 | +- Security Operations Centers (SOC) |
| 31 | +- DFIR teams |
| 32 | +- Judicial and public-sector investigations |
| 33 | +- Enterprise security audits |
| 34 | +- Post-incident technical reporting |
47 | 35 |
|
48 | 36 | --- |
49 | 37 |
|
50 | | -## 🏛️ Scope & Target Audience |
| 38 | +## 🧠 Core Capabilities |
51 | 39 |
|
52 | | -[]() []() []() []() |
| 40 | +[]() |
| 41 | +[]() |
| 42 | +[]() |
| 43 | +[]() |
53 | 44 |
|
54 | | -Designed for professionals operating in: |
55 | | - |
56 | | -- Security Operations Centers (SOC) |
57 | | -- Digital Forensics & Incident Response (DFIR) |
58 | | -- Identity & Access Management investigations |
59 | | -- Compliance, audit, and governance workflows |
60 | | -- Public-sector and regulated environments |
| 45 | +- Parsing and querying Windows Event Logs (EVTX) |
| 46 | +- Detection of anomalous authentication behavior |
| 47 | +- Timeline reconstruction of user and system activity |
| 48 | +- Identification of lateral movement indicators |
| 49 | +- Correlation of logon, privilege, and service events |
61 | 50 |
|
62 | 51 | --- |
63 | 52 |
|
64 | | -## ⚙️ Requirements & Environment |
65 | | - |
66 | | -[]() []() |
67 | | - |
68 | | -- **PowerShell** |
69 | | -```powershell |
70 | | -$PSVersionTable.PSVersion |
| 53 | +## 🧩 Directory Structure |
| 54 | + |
| 55 | +```text |
| 56 | +BlueTeam-Tools/ |
| 57 | +│ |
| 58 | +├─ EventLogMonitoring/ |
| 59 | +│ ├─ Authentication analysis |
| 60 | +│ ├─ Privilege escalation detection |
| 61 | +│ └─ Logon/session correlation |
| 62 | +│ |
| 63 | +├─ IncidentResponse/ |
| 64 | +│ ├─ Rapid triage scripts |
| 65 | +│ ├─ Evidence-oriented collection |
| 66 | +│ └─ Post-incident review helpers |
| 67 | +│ |
| 68 | +└─ README.md |
71 | 69 | ``` |
72 | | - Minimum **5.1** (PowerShell 7+ recommended) |
73 | 70 |
|
74 | | -- **Administrative Privileges** |
75 | | - Required to access protected system artifacts. |
| 71 | +--- |
76 | 72 |
|
77 | | -- **RSAT (when applicable)** |
| 73 | +## 📤 Outputs & Evidence Handling |
78 | 74 |
|
79 | | -```powershell |
80 | | -Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online |
81 | | -``` |
| 75 | +[]() |
| 76 | +[]() |
| 77 | +[]() |
82 | 78 |
|
83 | | -- **Execution Policy (session-scoped)** |
| 79 | +Most tools generate: |
84 | 80 |
|
85 | | -```powershell |
86 | | -Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process |
87 | | -``` |
88 | | - |
89 | | -- **Optional Modules** |
90 | | - `ActiveDirectory`, `Defender`, `DHCPServer` |
| 81 | +- `.log` execution logs |
| 82 | +- `.csv` structured datasets |
| 83 | +- Timestamped artifacts |
| 84 | +- Reproducible outputs suitable for audits and investigations |
91 | 85 |
|
92 | 86 | --- |
93 | 87 |
|
94 | | -## 🚀 Getting Started |
95 | | - |
96 | | -```powershell |
97 | | -git clone https://github.com/brazilianscriptguy/Windows-SysAdmin-ProSuite.git |
98 | | -cd Windows-SysAdmin-ProSuite/BlueTeam-Tools |
99 | | -``` |
100 | | - |
101 | | -**Recommended workflow:** |
102 | | - |
103 | | -1. Select the appropriate category |
104 | | -2. Review the local `README.md` |
105 | | -3. Execute the script: |
106 | | - |
107 | | -```powershell |
108 | | -.\Script-Name.ps1 |
109 | | -``` |
| 88 | +## 🏛️ Governance & Forensic Principles |
110 | 89 |
|
111 | | -4. Review generated `.log` and `.csv` artifacts |
| 90 | +[]() |
| 91 | +[]() |
| 92 | +[]() |
112 | 93 |
|
113 | | -> ⚠️ Always validate execution context before running in production or investigative environments. |
| 94 | +- Non-destructive data handling |
| 95 | +- Minimal system interaction |
| 96 | +- Explicit logging of all actions |
| 97 | +- Deterministic execution paths |
114 | 98 |
|
115 | 99 | --- |
116 | 100 |
|
117 | | -## 🔗 Integration & Interoperability |
| 101 | +## ⚙️ Requirements |
118 | 102 |
|
119 | | -[](https://chatgpt.com/) [](https://chatgpt.com/) [](https://chatgpt.com/) |
120 | | - |
121 | | -BlueTeam tools are designed to integrate with: |
122 | | - |
123 | | -- Incident response playbooks |
124 | | -- GPO-based execution models |
125 | | -- Scheduled forensic snapshots |
126 | | -- SIEM ingestion pipelines |
127 | | -- Compliance and audit evidence chains |
| 103 | +[]() |
| 104 | +[]() |
| 105 | +[]() |
128 | 106 |
|
129 | 107 | --- |
130 | 108 |
|
131 | | -## 🤝 Support & Community |
| 109 | +## 📬 Contact & Support |
132 | 110 |
|
133 | | -[](mailto:[email protected]) [](https://patreon.com/brazilianscriptguy) [](https://buymeacoffee.com/brazilianscriptguy) [](https://ko-fi.com/brazilianscriptguy) [](https://gofundme.com/f/brazilianscriptguy) [](https://whatsapp.com/channel/0029VaEgqC50G0XZV1k4Mb1c) |
| 111 | +[](mailto:[email protected]) |
| 112 | +[](https://buymeacoffee.com/brazilianscriptguy) |
| 113 | +[](https://ko-fi.com/brazilianscriptguy) |
| 114 | +[](https://www.patreon.com/brazilianscriptguy) |
134 | 115 |
|
135 | 116 | --- |
136 | 117 |
|
137 | | -> 🛡️ _BlueTeam-Tools Suite is engineered for environments where **forensics, response, governance, and auditability converge**._ |
138 | | -
|
139 | | -© 2026 Luiz Hamilton Silva. All rights reserved. |
| 118 | +© 2026 Luiz Hamilton Silva — BlueTeam-Tools |
0 commit comments