Estimated Reading Time: 5 minutes

APT-Hunter first released at the beginning of 2021 and since the release, many use cases and features were added along with bug fixes . APT-Hunter V2.0 now includes more than 200 use cases , log hunting , new frequency analysis , very easy to use and analyze multiple devices logs at same time .

Github Repo : https://github.com/ahmedkhlief/APT-Hunter

APT-Hunter Release : includes new pre-compiled executable for windows

APT-Hunter New Features

• Apt-Hunter now support more than 200 use cases.
• Introducing Log hunting feature which can take string or regex and search all the logs and provide you a parsed report for all findings.
• New Process Execution frequency analysis : this will help you identify suspicious and rare processes run in the environment .
• New Login Events report : the new CSV Login events report include parsed (Date, User , Source IP , Logon Process , Workstation Name , Logon Type , Device Name , Original Log ) column fields so you can easily filter , investigate suspicious logins and if you analyze multiple machines you can have time line analysis for the logins .
• Specify the timezone you want : before APT-Hunter was using UTC timezone for all reports but now you can specify the timezone or use ( local ) to auto detect your timezone.
• No need to specify the type of logs : APT-Hunter will analyze folders for logs and detect the type of logs then analyze it .
• Analyze Multiple devices logs and get unified timeline : You can provide a directory with all machine logs you want to analyze and APT-Hunter will provide a single report for all machines which will easy the timeline analysis .
• Terminal Service Events now include columns for ( user , source IP ) to make it easier to filter and check for suspicious activity .
• Many bug fixes since last release .

APT-Hunter new use cases

• Suspicious Command or process found in the log
• User Added using Net Command
• Process running in suspicious location
• Process running in Unusual location
• Suspicious Process Found
• Suspicious Powershell commands Process Found
• Suspected privielge Escalation attempt using NAMED PIPE
• non-interactive powershell being executed by another application in the background
• User Created through management interface
• User Created through management interface
• Dcsync Attack detected
• dcshadow Attack detected
• network share object was added
• network share object was added
• Windows is shutting down
• User added to local group
• User added to local group
• User added to global group
• User added to global group
• User added to Universal group
• User added to Universal group
• User Removed from Global Group
• User Removed from Global Group
• User Removed from Universal Group
• User Removed from Universal Group
• User Removed from Local Group
• User Removed from Local Group
• User Removed Group
• User Removed Group
• User Account Removed
• User Account Removed
• High number of Pass the hash attempt Detected . detection will be paused for this user to not flood the detection list
• Pass the hash attempt Detected
• Pass the hash attempt Detected
• Audit log cleared
• Suspicious Attempt to enumerate groups
• Suspicious Attempt to enumerate groups
• System audit policy was changed
• schedule task created
• schedule task deleted
• schedule task updated
• schedule task enabled
• schedule task disabled
• System Logs Cleared
• Service Installed with executable in TEMP Folder
• Service installed in the system
• psexec service detected installed in the system
• Service start type changed
• Service State Changed
• Zerologon Exploitation Using Well-known Tools
• non-system accounts getting a handle to and accessing lsass
• non-system accounts getting a handle to and accessing lsass
• Password Spray Detected
• Suspicious Command or process found in the log
• Windows Defender took action against Malware
• Windows Defender failed to take action against Malware
• Windows Defender Found Malware
• Windows Defender deleted history of malwares
• Windows Defender detected suspicious behavior Malware
• Windows Defender real-time protection disabled
• Windows Defender real-time protection configuration changed
• Windows Defender antimalware platform configuration changed
• Windows Defender scanning for malware is disabled
• Windows Defender scanning for viruses is disabled
• Suspicious Command or process found in the log
• schedule task registered
• schedule task updated
• schedule task deleted
• Service installed in the system
• psexec service detected installed in the system
• Service start type changed
• Service State Changed
• Zerologon Exploitation Using Well-known Tools
• Suspicious Command or process found in the log
• Powershell Module logging – Malicious Commands Detected
• powershell script block – Found Suspicious PowerShell commands
• PowerShell ISE Operation – Found Suspicious PowerShell commands
• Powershell Executing Pipeline – Suspicious Powershell Commands detected
• Powershell Executing Pipeline – User Powershell Commands
• Suspicious Command or process found in the log
• Powershell Executing Pipeline – Suspicious Powershell Commands detected
• Suspicious PowerShell commands Detected
• Suspicious PowerShell commands Detected
• User connected RDP from Local host – Possible Socks Proxy being used
• User Connecting RDP from Public IP
• User Loggedon to machine
• connection is initiated using WinRM from this machine – Powershell remoting
• connection is initiated using WinRM to this machine – Powershell remoting
• [ T1086 ] Powershell with Suspicious Argument
• [ T1543 ] Sc.exe manipulating windows services
• [ T1059 ] wscript or cscript runing script
• [ T1218.005 ] Mshta found running in the system
• Psexec Detected in the system
• [T1053] Scheduled Task manipulation
• Prohibited Process connecting to internet
• Command run remotely Using WMI
• Detect IIS/Exchange Exploitation
• [T1082] System Information Discovery
• [T1117] Bypassing Application Whitelisting with Regsvr32
• [T1055] Process Injection
• [T0000] Console History
• [ T0000 ] Remotely Query Login Sessions – Network
• [ T0000 ] Remotely Query Login Sessions – Process
• T0000 Suspicious process name detected
• T1002 Data Compressed
• T1003 Credential Dumping ImageLoad
• [T1003] Credential Dumping – Process
• [T1003] Credential Dumping – Process Access
• [T1003] Credential Dumping – Registry
• [T1003] Credential Dumping – Registry Save
• [T1004] Winlogon Helper DLL
• [T1004] Winlogon Helper DLL
• [ T1007 ] System Service Discovery
• [T1223] Compiled HTML File
• [T1218] Signed Binary Proxy Execution – Process
• [T1218] Signed Binary Proxy Execution – Process
• [T1218] Signed Binary Proxy Execution – Network
• [T1216] Signed Script Proxy Execution
• [T1214] Credentials in Registry
• [T1209] Boot or Logon Autostart Execution: Time Providers
• [T1202] Indirect Command Execution
• [T1201] Password Policy Discovery

• [T1197] BITS Jobs – Process
• [T1197] BITS Jobs – Network
• [T1196] Control Panel Items – Registry
• [T1196] Control Panel Items – Process
• [T1191] Signed Binary Proxy Execution: CMSTP
• [T1183] Image File Execution Options Injection
• [T1182] AppCert DLLs Registry Modification
• [T1180] Screensaver Hijack
• [T1179] Hooking detected
• [T1170] Detecting Mshta
• [T1170] Detecting Mshta
• [T1158] Hidden Files and Directories – VSS
• [T1158] Hidden Files and Directories
• [T1146] Clear Command History
• [T1140] Deobfuscate/Decode Files or Information
• [T1138] Application Shimming – Registry
• [T1138] Application Shimming – process
• [T1136] Create Account
• [T1135] Network Share Discovery – Process
• [T1131] Authentication Package
• [T1130] Install Root Certificate
• [T1128] Netsh Helper DLL – Process
• [T1128] Netsh Helper DLL – Registry
• [T1127] Trusted Developer Utilities
• [T1126] Network Share Connection Removal
• [T1124] System Time Discovery
• [T1115] Audio Capture
• [T1122] Component Object Model Hijacking
• [T1121] Regsvcs/Regasm
• [T1118] InstallUtil
• [T1117] Regsvr32
• [T1117] Bypassing Application Whitelisting with Regsvr32,rundll32,certutil or scrobj
• [T1115] Clipboard Data Collection
• [T1107] Indicator Removal on Host
• [T1103] AppInit DLLs Usage
• [T1096] Hide Artifacts: NTFS File Attributes
• [T1088] Bypass User Account Control – Registry
• [T1088] Bypass User Account Control – Process
• [T1087] Account Discovery
• [T1086] PowerShell Downloads – Process
• [T1086] PowerShell Process found
• [T1085] Rundll32 Execution detected
• [T1082] System Information Discovery
• [T1081] Credentials in Files
• [T1077] Windows Admin Shares – Process – Created
• [T1077] Windows Admin Shares – Process
• [T1077] Windows Admin Shares – Network
• [T1076] Remote Desktop Protocol – Process
• [T1076] Remote Desktop Protocol – Registry
• [T1074] Data Staged – Process
• [T1070] Indicator removal on host
• [T1069] Permission Groups Discovery – Process
• [T1063] Security Software Discovery
• [T1060] Registry Run Keys or Start Folder
• [T1059] Command-Line Interface
• [1057] Running Process Discovery
• [T1054] Indicator Blocking – Sysmon registry edited from other source
• [T1054] Indicator Blocking – Driver unloaded
• [T1053] Scheduled Task – Process
• [T1050] New Service – Process
• [T1049] System Network Connections Discovery
• [T1047] Windows Management Instrumentation – Process
• [T1047] Windows Management Instrumentation – Network
• [T1047] Windows Management Instrumentation – Instances of an Active Script Event Consumer – Process
• [T1047] Windows Management Instrumentation – Instances of an Active Script Event Consumer – FileAccess
• [T1040] Network Sniffing Detected
• [T1037] Boot or Logon Initialization Scripts
• [T1036] Masquerading – Extension
• [T1031] Modify Existing Service
• [T1028] Windows Remote Management
• [T1027] Obfuscated Files or Information
• [T1018] Remote System Discovery – Process
• [T1018] Remote System Discovery – Network
• [T1015] Accessibility Features – Registry
• [T1015] Accessibility features
• [T1013] Local Port Monitor
• [T1012] Query Registry – Process
• [T1012] Query Registry – Network
• [T1012] Processes opening handles and accessing Lsass with potential dlls in memory
• [T1003] Processes opening handles and accessing Lsass with potential dlls in memory
• [T1112] process updating fDenyTSConnections or UserAuthentication registry key values
• [T1059] processes loading PowerShell DLL system.management.automation
• [T1059] PSHost* pipes found in PowerShell execution
• [T1112] process updating UseLogonCredential registry key value
• [T1055] Process Injection – Process

I would like to thank zAbuQasem for his contribution in Ninja New UI