{"id":19528851,"url":"https://github.com/netspi/powerhunt","last_synced_at":"2025-04-10T05:09:39.970Z","repository":{"id":56710870,"uuid":"471059705","full_name":"NetSPI/PowerHunt","owner":"NetSPI","description":"PowerHunt is a modular threat hunting framework written in PowerShell that leverages PowerShell Remoting for data collection on scale.","archived":false,"fork":false,"pushed_at":"2024-12-12T18:10:09.000Z","size":423,"stargazers_count":68,"open_issues_count":3,"forks_count":13,"subscribers_count":8,"default_branch":"main","last_synced_at":"2025-04-10T05:09:35.818Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/NetSPI.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-03-17T16:31:31.000Z","updated_at":"2025-04-08T18:48:16.000Z","dependencies_parsed_at":"2024-11-11T01:21:11.734Z","dependency_job_id":"861c4d54-b7a1-492f-8f8f-bd126618dd81","html_url":"https://github.com/NetSPI/PowerHunt","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2FPowerHunt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2FPowerHunt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2FPowerHunt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2FPowerHunt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/NetSPI","download_url":"https://codeload.github.com/NetSPI/PowerHunt/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248161273,"owners_count":21057555,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T01:20:18.393Z","updated_at":"2025-04-10T05:09:39.916Z","avatar_url":"https://github.com/NetSPI.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# PowerHunt\n\u003ca href=\"https://github.com/NetSPI/PowerHunt/wiki\"\u003e\u003cstrong\u003ePowerHunt\u003c/strong\u003e\u003c/a\u003e is a modular threat hunting framework written in PowerShell that leverages PowerShell Remoting for data collection at scale. \u003cbr\u003e\u003cbr\u003e \nIt is designed to \u003cstrong\u003eidentify signs of compromise\u003c/strong\u003e based on artifacts left behind by common MITRE ATT\u0026CK techniques, and the collected data can be used to identify anomalies and outliers specific to the target environment.  \u003cem\u003eIt was not designed to identify known bad files, domains, or IPs associated with specific APTs/malware, but I'm sure it could be extended to do that.\u003c/em\u003e \n\nIt supports functionality to:\n* \u003cstrong\u003eAuthenticate\u003c/strong\u003e using the current user context, a credential, or clear text user/password.\n* \u003cstrong\u003eDiscover\u003c/strong\u003e accessible systems associated with an Active Directory domain automatically.\n* \u003cstrong\u003eTarget\u003c/strong\u003e a single computer, list of computers, or discovered Active Directory computers (default).\n* \u003cstrong\u003eCollect\u003c/strong\u003e data source information from target systems using PowerShell Remoting and easy to build collection modules.\n* \u003cstrong\u003eAnalyze\u003c/strong\u003e collected data using easy to build analysis modules based on behavior.\n* \u003cstrong\u003eReport\u003c/strong\u003e summary data and initial insights that can help analysts get started on simple threat hunting exercises that focus on common persistence and related techniques.\n\nThis is not a novel approach to threat hunting, but I thought the project was worth sharing, because in certain environments the automation can be a time saver. \u003cbr\u003e\u003cbr\u003e\nUser and developer guides can be found on the wiki  \u003ca href=\"https://github.com/NetSPI/PowerHunt/wiki\"\u003ehere\u003c/a\u003e.\u003cBr\u003e\n\n\u003cstrong\u003eAuthor\u003c/strong\u003e\u003cBr\u003e\nScott Sutherland (@_nullbind) \u003cBr\u003e\n\n\u003cstrong\u003eLicense\u003c/strong\u003e\u003cBr\u003e\nBSD 3-Clause\n\nPrimary Todo\n--\n**Pending Fixes / Higher Priorities**\n* Create an HTML summary report (summary for discovery(sample), collection, analysis; main page for each with dig in html files)\n* Fix groups and user collection on 2008 ps3 vs ps5 - function used are not backwards compatable\n* Fix cast error in field for wmi bindings modules\n* Update $AnalysisModuleDesc in each analysis module to include correct description.\n* Review events for potential additions https://github.com/ANSSI-FR/guide-journalisation-microsoft/blob/main/Standard_WEC_query.xml\n  \n**Pending Features / Modules** \n\nRemote Collection Methods\n* WMI\n* SMB/RPC - Create Service\n* SMB/RPC - Create Scheduled Task\n* SMB/RCP - Remote registry\n\nArtifact Collection\n* Add RDP session collection\n* Add PS remoting session collection\n* Add netsess session collection\n* Add Pcap ingestion \n* Add Drivers installed\n* Add ransomware artifcats (files/reg keys/recovery removal)\n\nAnalysis / Core\n* Add contextual LOLBAS process checks\n* Update LOLBAS list for persistence checks\n* Add https://www.loldrivers.io/ checks\n* Add parent / child rules for processes\n* Add network connection rules for processes\n* Add thresholds to all anomaly modules - make configurable.\n* Sigma rules ingestion.\n* Add hidden task hunter \n  \nReport.\n* Excludede DC option.\n* Create square chart, with color desity associated with instances per subnets/system\n* Heat map chart.\n* Timeline chart.\n  \n\n\n  \n\n\n\n\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetspi%2Fpowerhunt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnetspi%2Fpowerhunt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetspi%2Fpowerhunt/lists"}