2.0.1 – Threat Intelligence Expansion Update ⚔️

🆕 2.0.1 (2025/04/30) – Threat Intelligence + MITRE v17.0 Update ⚔️📈

Overview:

This update adds deep threat group intelligence and upgrades the platform to the newly released MITRE ATT&CK v17.0, ensuring Hunt-AI continues to lead in real-world threat modeling and detection. With full mapping of techniques to threat actors, and extended capability to pivot between threats and defenses, this release empowers analysts to hunt like an adversary.

🔹 What's New

📂 APT Threat Group Integration
All techniques now include mappings to real-world adversary groups (APT41, Volt Typhoon, Lazarus Group, etc.).

Full support for aliases, known malware, campaign histories, and regional targeting.

/Modules/Apts/ framework added to serve dynamic threat group views.

New routing under /group and /apt/ enables fast lookup of all techniques used by a group.

🧠 Upgraded to MITRE ATT&CK v17.0
All techniques, IDs, sub-techniques, and group mappings aligned with the latest MITRE version.

Includes new tactics, sub-techniques, and updates to previously deprecated or modified IDs.

Ensures compatibility with MITRE's latest content and taxonomies.

🧭 Enhanced Hunting Workflow
Threat-centric tagging added to each technique's metadata.

Built-in queries enriched with threat group references.

2.0.0 – MITRE Mastery Edition

2.0.0 – MITRE Mastery Edition

✅ 2.0.0 (2025/04/21) 🎯

Overview:

This groundbreaking release marks the evolution of Hunt-AI into a fully comprehensive threat hunting powerhouse. It now includes all 656 MITRE ATT&CK techniques (v16.1) — complete with enhanced detection logic, actionable clearing steps, enriched Splunk/SQL queries, and expanded support for endpoint visibility. This release is built for elite defenders ready to find the enemy and finish the fight. 🛡️🔥

---

🔹 Major Enhancements

🧠 Full MITRE ATT&CK v16.1 Coverage

• Every single technique and sub-technique is now integrated.
• Includes detailed summaries, threat modeling, log sources, detection methods, remediation guidance, and MITRE mappings.
• Mapped to real-world APT examples and hunting playbooks.

💥 Advanced Threat Detection & Response Capabilities

• Expanded clearing steps to rapidly remediate threats across Windows, Linux, and macOS.
• Added multi-vector detection: command-line, behavior-based, entropy scoring, AMSI logs, registry artifacts, PowerShell logging, WMI tracking, and more.
• Built-in APT hunting blueprints for faster triage.

🛠️ SPL & SQL Power Tools

• Refined, high-performance SPL queries for all key techniques.
• Includes one-liner versions for fast pivoting.
• Enhanced auto-copy functionality for all queries (UI support included).
• Categorized by tactic and threat scope.

1.1.8 - SPL Copy feature

✅ 1.1.8 (2025/03/12) 🚀

Overview:

This update brings major improvements to threat hunting capabilities, including expanded MITRE ATT&CK technique coverage, enhanced detection logic, new auto-copy functionality for SPL queries, and refined SQL/SPL queries for scheduled task detection.

🔹 Changes & Enhancements

🖥️ User Experience & UI Improvements

• Auto-Copy Feature for SPL Queries
  • Queries now have a floating copy button in the top-right corner for quick copying.
  • 40% opacity by default, fully visible on hover.
  • Clicking copies the query and shows a ✅ "Copied!" confirmation.

🛠️ Detection & Hunting Enhancements

• Improved Detection Across 5+ Techniques

  • Expanded MITRE ATT&CK mappings to improve correlation and accuracy.
  • Enhanced detection logic for obfuscation, scheduled tasks, and command-line executions.
  • New and refined SQL/SPL queries improve speed and accuracy in identifying threats.
  • Memory forensics integration with Volatility & AMSI logging for deeper investigation.

• Strengthened Scheduled Task Detection (T1053)

  • More precise SQL & SPL queries for tracking task creation, modification, and execution.
  • One-liner SPL query added for quick analysis in Splunk & SIEM tools.

• Enhanced Obfuscation Detection (T1027)

  • Expanded hunt steps to track encoded scripts, packed binaries, and hidden payloads.
  • New entropy-based detections for packed malware.

🔥 General Improvements

• Improved clearing steps for multiple techniques to better guide remediation.
• More robust data sources & log sources to enhance visibility across Windows, Linux, and macOS.
• Refined watchlist & detection methods for more effective SIEM alerts & threat hunting.

🚀 This update makes Hunt-AI more powerful, faster, and easier to use for hunting adversarial techniques across enterprise environments. Let me know if anything should be adjusted! 🔍🔥

1.1.7 - Data Sources

✅ 1.1.7 (2025/03/08) 🚀

Overview:

This update enhances the log source filtering feature to improve user experience and threat-hunting efficiency. The new system remembers filter selections, dynamically hides techniques that don't match selected log sources, and improves usability by refining how "All" selection works.

Changes & Enhancements

• Persistent Log Source Filtering - User-selected log sources are now saved and persist across page reloads using localStorage.
• Dynamic Technique Display - Techniques now dynamically hide if they do not match the selected log sources.
• Expanded Log Source List - Added a comprehensive list of 41 ATT&CK log sources, including:
  • Active Directory, Application Log, Cloud Storage, File, Firewall, Kernel, Network Traffic, Windows Registry, WMI, and more.
• Improved Filtering Logic
  • Selecting "All" enables all log sources and unchecks others.
  • If any specific log source is selected, "All" is unchecked.
  • If all individual sources are selected, "All" is automatically rechecked and others are unchecked.
• Technique HTML Update - Each technique is now embedded with data-log-sources to support filtering.
• Base Template Update (base.html)
  • Moved log source filtering panel to the right side of the screen for better visibility.
  • Defaulted all log sources to be checked initially.

🚀 This update ensures a smoother, more precise experience when filtering and hunting across MITRE ATT&CK techniques.

Let me know if you need any tweaks before finalizing! 🎯

Docker Integration & Web App Title Update

✅ 1.1.6 (2025/02/24) 🚀

Overview:
This update streamlines our development workflow by integrating comprehensive Docker support and enhancing our application branding. New automation scripts have been added to build, run, and clean up Docker containers for both Unix-like and Windows environments. Additionally, the web application title has been updated to "Hunt-AI" for consistent branding across the platform.

• Docker Setup - Integrated Docker support for seamless containerization.
• run_docker.sh Script - Created a bash script to build the Docker image, run the container on port 31337, and automatically open Google Chrome.
• run_docker.ps1 Script - Added a PowerShell script for Windows users with equivalent functionality.
• delete_docker.sh Script - Implemented a cleanup script to remove all Docker containers, images, networks, and volumes.
• Web App Title Update - Updated the web app title to "Hunt-AI" for unified branding.

MITRE T-Code update

✅ 1.1.5 (2025/02/19) 🚀

• added the basics of the search feature
• add url_id to all tactics and get all tactics and techniques to link to their pages in the top left
• Windows Setup Guide - Improve installation steps for Windows users.
• Docker Integration - Sync investigations with team servers.
• Intel Additions - Added new intelligence updates 🔍
• Updated T1021 - Improvements and refinements 🛠️
• Installation Improvements - Changed installation process from Python to shell script ⚡
• Enhanced Log Tracking - Ensured source and destination fields are correctly handled in logs 📜
• Setup Optimization - Shortened and improved setup steps 🚀
• Multi-Platform Support - Added Windows and Linux setup instructions 💻

MITRE ATT&CK MAPPING

✅ 1.1.4 (2025/02/16) 🚀

• Checklist System - allow hunt execution steps to be checked and clearing steps
• T-code classification - Better organization by techniques & attacks.
• MITRE ATT&CK Mapping - Better
• visual representation of tactics & techniques.
• Massively expanded T-code coverage 📌
  • Added over 20 new T-code technique files 🛠️
  • Ensured each technique follows the updated template 📜
• Refined and optimized attack mappings 🔗
• Fixed missing technique displays 🖥️
• Improved tactic-lookup functionality 🔍
• Ensured correct association of techniques under tactics 🏗️
• Optimized technique loading and JSON structure ⚡
• Improved UI consistency for technique pages 🎨

✅ 1.1.3 (2025/02/14) 🎉

• Recreate the technique template section 🏗️
• Allow multiple Splunk sections 🔍
• Ensure themes display correctly 🎨
• Show selected tactics in the top left 📌
• Update & refine theme styles 🎭
• Ensure background spans the entire page 🌌
• Display techniques like tactics (checkbox system) ✅
• Group techniques under their selected tactics 📊
• Fix gradient viewport issue 🎨
• Optimize checkbox alignment in grids 🔲

✅ 1.1.2

• Add T-codes to enhance attack mapping 🔗

✅ 1.1.1 (2024/11/28)

• Update methodology page 📝

✅ 1.1.0 (2024/11/27)

• Convert CLI-based system to a web-based interface 🌐

✅ 1.0.5 (2024/11/26)

• Implement search functionality 🔎
• Add common_ui.py for reusable UI components 🏗️

✅ 1.0.4 (2024/11/25)

• Create analyst notebook 📖
  • Track IP addresses 🌍
  • Store domains 🔗
  • Add notes 📝
  • Log programs used 💻
• Add About section ℹ️
  • Include start.me links 🌎
  • Link to official website 🔗

✅ 1.0.3 (2024/11/24)

• Implement highlighting & marking features 🖍️
• Add emojis to improve UI ✨
• Simplify backend logic for efficiency ⚡

✅ 1.0.0 (2024/11/23)

• Initial Release 🎉