1.1.8 - SPL Copy feature

✅ 1.1.8 (2025/03/12) 🚀

Overview:

This update brings major improvements to threat hunting capabilities, including expanded MITRE ATT&CK technique coverage, enhanced detection logic, new auto-copy functionality for SPL queries, and refined SQL/SPL queries for scheduled task detection.

🔹 Changes & Enhancements

🖥️ User Experience & UI Improvements

• Auto-Copy Feature for SPL Queries
  • Queries now have a floating copy button in the top-right corner for quick copying.
  • 40% opacity by default, fully visible on hover.
  • Clicking copies the query and shows a ✅ "Copied!" confirmation.

🛠️ Detection & Hunting Enhancements

• Improved Detection Across 5+ Techniques

  • Expanded MITRE ATT&CK mappings to improve correlation and accuracy.
  • Enhanced detection logic for obfuscation, scheduled tasks, and command-line executions.
  • New and refined SQL/SPL queries improve speed and accuracy in identifying threats.
  • Memory forensics integration with Volatility & AMSI logging for deeper investigation.

• Strengthened Scheduled Task Detection (T1053)

  • More precise SQL & SPL queries for tracking task creation, modification, and execution.
  • One-liner SPL query added for quick analysis in Splunk & SIEM tools.

• Enhanced Obfuscation Detection (T1027)

  • Expanded hunt steps to track encoded scripts, packed binaries, and hidden payloads.
  • New entropy-based detections for packed malware.

🔥 General Improvements

• Improved clearing steps for multiple techniques to better guide remediation.
• More robust data sources & log sources to enhance visibility across Windows, Linux, and macOS.
• Refined watchlist & detection methods for more effective SIEM alerts & threat hunting.

🚀 This update makes Hunt-AI more powerful, faster, and easier to use for hunting adversarial techniques across enterprise environments. Let me know if anything should be adjusted! 🔍🔥