ThreatHound

ThreatHound is an advanced cybersecurity tool designed to facilitate efficient threat detection and analysis, windows events logs. it offers a user-friendly interface for managing and analyzing security data. Key features include log analysis, Sigma rule integration, and real-time threat detection.

Key Features:

• Automation for Threat hunting, Compromise Assessment, and Incident Response for the Windows Event Logs
• Downloading and updating the Sigma rules daily from the source
• More then 50 detection rules included
• support for more then 2300 detection rules for Sigma
• Support for new sigma rules dynamically and adding it to the detection rulest
• Easily add any detection rules you prefer
• you can add new event log source type in mapping.py easily
• Sigma Rule Management: Seamlessly manage and process Sigma rules.

  V2 Features:

  • Faster!!.
  • Saving of all the outputs in cvs format with full details.
  • searching functionality.
  • Log Analysis: Analyze logs using custom mappings and filters.
  • User Interface: Intuitive GUI for easy interaction and visualization.
  • Command Interface: you can use command only.
  • Data Visualization: Graphical representation of data for better insights.
  • Real-Time Analysis: Process and analyze data in real-time.
  • Customization: Easily customizable to suit different cybersecurity needs.
  • Compatibility: Cross-platform compatibility with support for different data formats.

Specialized Features for DFIR Professionals:

• Forensic Data Analysis: Equipped with capabilities to analyze forensic artifacts, aiding in digital investigations.
• Incident Response Toolkit: Provides essential tools for rapid response to security incidents, helping DFIR teams to quickly assess and react to threats.
• Timeline Analysis: Supports constructing and analyzing timelines of events, crucial for understanding the sequence of activities during an incident.
• Artifact Correlation: Facilitates correlation of various digital artifacts, aiding in the identification of malicious activities and breach points.
• Log Consolidation and Analysis: Aggregates and analyzes logs from various sources, providing a comprehensive view of security-related events.
• Integrations with Forensic Tools: Offers integration capabilities with popular forensic tools, enhancing its utility in a DFIR context.

Ideal Use Cases:

• Security Monitoring: For organizations looking to bolster their security monitoring capabilities, ThreatHound provides real-time analysis and alerts.

• Incident Investigation: In the event of a security incident, the tool's deep analysis features enable rapid understanding and response.

• Compliance and Reporting: With its comprehensive data handling, ThreatHound assists in maintaining compliance standards and generates detailed reports for auditing purposes.

• Educational and Training Purposes: Its user-friendly interface and comprehensive feature set make ThreatHound an excellent tool for educational environments focusing on cybersecurity training.

I’ve built the following:

• A dedicated backend to support Sigma rules for python
• A dedicated backend for parsing evtx for python
• A dedicated backend for match between csv and the Sigma rules
• A dedicated backend to match between evtx and the Sigma rules

To-do:

• Support for Sigma rules dedicated for DNS query
• Modifying the speed of algorithm dedicated for the detection and making it faster
• Adding csv output that supports SIEMS
• More features

installiton:

$ git clone https://github.com/MazX0p/ThreatHound.git
$ cd ThreatHound
$ pip3 install - r requirements.txt
$ pyhton3 ThreatHound.py

• Note: glob doesn't support get path of the directory if it has spaces on folder names, please ensure the path of the tool is without spaces (folders names)

Demo:

Screenshots:

GUI:

COMMAND LINE: