{"id":13362221,"url":"https://github.com/GossiTheDog/ThreatHunting","last_synced_at":"2025-03-12T15:30:52.772Z","repository":{"id":51649598,"uuid":"113497306","full_name":"GossiTheDog/ThreatHunting","owner":"GossiTheDog","description":"Tools for hunting for threats.","archived":false,"fork":false,"pushed_at":"2024-10-18T18:06:23.000Z","size":177,"stargazers_count":568,"open_issues_count":0,"forks_count":55,"subscribers_count":50,"default_branch":"master","last_synced_at":"2024-11-18T11:37:02.126Z","etag":null,"topics":["nexthink","threat-hunting"],"latest_commit_sha":null,"homepage":null,"language":"YARA","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GossiTheDog.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-12-07T20:51:40.000Z","updated_at":"2024-11-13T03:02:54.000Z","dependencies_parsed_at":"2024-01-07T06:23:04.201Z","dependency_job_id":"9cc8dd27-ca65-4097-ab0c-dc7b5d2412f8","html_url":"https://github.com/GossiTheDog/ThreatHunting","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GossiTheDog%2FThreatHunting","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GossiTheDog%2FThreatHunting/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GossiTheDog%2FThreatHunting/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GossiTheDog%2FThreatHunting/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GossiTheDog","download_url":"https://codeload.github.com/GossiTheDog/ThreatHunting/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243242694,"owners_count":20259804,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["nexthink","threat-hunting"],"created_at":"2024-07-29T23:00:33.627Z","updated_at":"2025-03-12T15:30:52.413Z","avatar_url":"https://github.com/GossiTheDog.png","language":"YARA","funding_links":[],"categories":["Reverse Engineering"],"sub_categories":["Yara"],"readme":"# ThreatHunting\nI am publishing GPL v3 tools for hunting for threats in your organisations.\n\n# Nexthink modules\nThreat hunting - Potential malware downloads v1.0.xml \n\nThis is a report which shows all calls to internet domains from common malware document techniques.  Most endpoint malware - such as macros, Office exploits etc - use the same set of methods to download their payloads.\n\nThe methods currently monitored include:\n\n  - rundll32\n  - mshta\n  - PowerShell\n  - wscript/cscript\n  - wmic\n  - sct remote calls\n  - InfDefaultInstall (Inf remote calls)\n  - certutil\n  \nThe report will show domains.  You can change the report to show users, executables instead if you want, or investigate each domain \n\nIn terms of false positives, you will very likely want to add a rule to filter out traffic destined for your internal IP ranges, or whitelist domains inside your environment.  For example, when adding a Printer it will call rundll32, and hit the printer for web traffic - which triggers in the report - just whitelist it.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FGossiTheDog%2FThreatHunting","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FGossiTheDog%2FThreatHunting","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FGossiTheDog%2FThreatHunting/lists"}