{"repo":"tobor88/PowerShell-Blue-Team","free":true,"listed":false,"github":"https://github.com/tobor88/PowerShell-Blue-Team","clone":"git clone https://github.com/tobor88/PowerShell-Blue-Team.git","description":"Collection of PowerShell functinos and scripts a Blue Teamer might use","language":"PowerShell","stars":88,"topics":["powershell","powershell-blue-team","blueteam","blue-team","blue-teams","cve-search","cve","defense","dns-over-https","doh"],"license":"MIT","category":"cli-tools","readme_excerpt":"PowerShell-Blue-Team Collection of PowerShell functions and scripts a Blue Teamer might use - ### Watch-PortScan.ps1 This cmdlet is used to discover attemtped port scans on a device. It runs on an infinite loop. This cmdlet can be used to send an email alert containing the log information, it can automatically added a source IP addresses accused of port scanning to the Windows Firewall on a block list. The default uninitiated connection limit that sets off the alert is 5. This means that when 5 ports are successfully connected to on a device in under two minutes an alert or blacklist IP action is triggered. You can of course have nothing occur as well. This cmdlet obtains IP Addresses from the firewall log. It then uses those IP's to the Windows Filtering Connection event logs. This script does everything needed to configure permissions and logging on the local device. The firewall log location is the CIS Benchmark recommended and will require a restart after the firewall log files are created and permissions are set. You can also exclude IP addresses to prevent legitimate port scanners from vulnerability scanning servers from being blocked by this funciton. There are servers such as File Servers and VoIP servers that will have connections from a lot of different IP addresses. In these cases you will want to use the -IgnorePort parameter to define ports such as 445 preventing this port from being added to the connection count for an IP. I am still working on a way to filter t","default_branch":null,"files":null,"tree":[],"storefront":"/r/tobor88","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/tobor88/PowerShell-Blue-Team/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}