{"id":51771826,"url":"https://github.com/zavetsec/zavetsec-evtxhunter","last_synced_at":"2026-07-20T02:02:14.249Z","repository":{"id":362056426,"uuid":"1257075827","full_name":"zavetsec/ZavetSec-EVTXHunter","owner":"zavetsec","description":"Advanced Windows Event Log Threat Hunter. Sigma-subset detection · correlation engine · entity risk scoring · self-contained HTML reports.","archived":false,"fork":false,"pushed_at":"2026-06-02T10:49:52.000Z","size":111,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-06-02T12:25:30.687Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zavetsec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-02T10:44:20.000Z","updated_at":"2026-06-02T10:49:56.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/zavetsec/ZavetSec-EVTXHunter","commit_stats":null,"previous_names":["zavetsec/zavetsec-evtxhunter"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/zavetsec/ZavetSec-EVTXHunter","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zavetsec%2FZavetSec-EVTXHunter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zavetsec%2FZavetSec-EVTXHunter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zavetsec%2FZavetSec-EVTXHunter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zavetsec%2FZavetSec-EVTXHunter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zavetsec","download_url":"https://codeload.github.com/zavetsec/ZavetSec-EVTXHunter/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zavetsec%2FZavetSec-EVTXHunter/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35670233,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-20T02:00:06.612Z","response_time":111,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-20T02:02:09.215Z","updated_at":"2026-07-20T02:02:14.239Z","avatar_url":"https://github.com/zavetsec.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n# ZavetSec-EVTXHunter\n\n### Advanced Windows Event Log Threat Hunter\n\n**Sigma-subset detection · correlation engine · entity risk scoring · self-contained HTML reports.**\n**Pure PowerShell. Zero dependencies. Air-gap ready.**\n\n\u003c!-- Version is driven by $script:VERSION in the script; keep this badge in sync. --\u003e\n[![Version](https://img.shields.io/badge/Version-1.3.0-ff6b00)](CHANGELOG.md)\n[![PowerShell](https://img.shields.io/badge/PowerShell-5.1%2B-5391FE)](#requirements)\n[![Platform](https://img.shields.io/badge/Platform-Windows-0078D6)](#requirements)\n[![Dependencies](https://img.shields.io/badge/Dependencies-none-00ff88)](#why-evtxhunter)\n[![MITRE ATT\u0026CK](https://img.shields.io/badge/Mapped_to-MITRE_ATT%26CK-c01818)](#detection-coverage)\n\n\u003c/div\u003e\n\n---\n\nPoint it at a folder of `.evtx` files — or run it live on the host. Minutes later you have one self-contained HTML report: findings ranked by severity, multi-event attack chains reconstructed, every user / IP / host / process scored by risk, all mapped to MITRE ATT\u0026CK. No agent, no server, no internet, no binaries to trust. It runs anywhere PowerShell 5.1 exists — which is every Windows box since Server 2012 R2.\n\nIt is built for the analyst working an incident under time pressure, on an isolated host, who needs answers from the logs *now* — not after standing up a pipeline.\n\nMost EVTX hunters answer one question: *which events matched a rule?* EVTXHunter is built to answer the questions that come next — *which user is most suspicious, which host accumulated the most risk, which events form a complete attack chain, and what should be investigated first.* The correlation engine, per-entity risk scoring, and hand-off-ready HTML report exist to turn a wall of matches into a triaged investigation. The point is not just detection — it is triage.\n\n\u003e **EVTXHunter trades breadth for zero-friction deployment plus the analysis the others leave to you** — correlation, scoring, and a report you can hand to someone without a SIEM.\n\n*Bring the analysis to the logs, not the logs to the platform.*\n\n---\n\n## Example report\n\nThe entire output is a single self-contained HTML file — no server, no internet, no external assets. The screenshots below show the report structure: the severity-ranked findings dashboard, the MITRE ATT\u0026CK mapping, entity risk scoring, and reconstructed correlation chains.\n\n\u003c!-- Replace these with real screenshots committed under docs/.\n     Suggested captures: full overview, MITRE matrix, top-risk entities, a correlation chain expanded. --\u003e\n\u003cdiv align=\"center\"\u003e\n\n\u003cimg width=\"1738\" height=\"868\" alt=\"evtxhunter\" src=\"https://github.com/user-attachments/assets/2b1dfa6d-5c5f-455a-ad27-c6ccf2284002\" /\u003e\n\n\u003c/div\u003e\n\n---\n\n## Why EVTXHunter\n\nThere are excellent EVTX hunters already — [Hayabusa](https://github.com/Yamato-Security/hayabusa) and [Chainsaw](https://github.com/WithSecureLabs/chainsaw) chief among them. EVTXHunter is not trying to replace a full Sigma engine. It fills a specific gap: **a single PowerShell file you can drop on any Windows host and run, with analysis built in.**\n\n| | EVTXHunter | Typical binary hunters |\n|---|---|---|\n| Dependencies | **None** — pure PowerShell 5.1 | Binary + Sigma rule repo |\n| Deploy to a locked-down host | Copy one `.ps1` | Stage executable, may trip allowlisting |\n| Multi-event attack chains | **Built-in correlation engine** | Usually single-event rules |\n| Risk scoring | **Per-entity (user / IP / host / process)** | Per-detection |\n| Temporal anomalies | **Off-hours / burst / dormant** | Rarely |\n| Output | **Interactive self-contained HTML** | CSV / JSONL, bring your own viewer |\n| Air-gap | **Yes** | Yes (once staged) |\n\nThe trade-off is honest: a binary engine with the full public Sigma corpus has far more raw rule coverage. EVTXHunter does not compete on rule count — it competes on getting you from raw logs to a triaged, scored, hand-off-ready report with nothing to install.\n\n---\n\n## Features\n\n- **10 correlation chains** — multi-event attack sequences reconstructed across time, e.g. *Brute Force -\u003e Successful Logon*, *Reconnaissance -\u003e Lateral Movement*, *Service Install -\u003e Log Clearing*, *Account Creation -\u003e Admin Group Addition*. This is the part single-event rules miss.\n- **Entity risk scoring** — every user, IP, host, and process accumulates a normalized risk score across all findings and anomalies, so the report tells you *who* and *what* to look at first, not just *what fired*.\n- **Temporal anomaly engine** — off-hours and weekend authentication, burst activity, and dormant-account wakeups (an account inactive for `-DormantDays` that suddenly authenticates), with machine/service accounts (SYSTEM, DWM-*, UMFD-*, machine `$`, well-known SIDs, AV service accounts) filtered out so the signal isn't drowned in noise.\n- **Interactive HTML report** — self-contained, opens in any browser with no internet. Severity-ranked findings, click any row for full event detail, MITRE ATT\u0026CK tactic matrix, top-risk entity board, reconstructed chains.\n- **Noise control that doesn't go blind** — Windows-managed driver installs (the `DriverStore\\FileRepository` class) are suppressed automatically, and a built-in vendor whitelist plus an external JSON whitelist (which *extends* the defaults, never replaces them) handle the rest. Plain `System32\\drivers\\*.sys` installs are deliberately *kept* as low-severity findings, because that path is the Bring-Your-Own-Vulnerable-Driver (BYOVD) attack surface — suppressing it would hide exactly what an attacker exploits.\n- **61 built-in detection rules** — a curated Sigma-subset covering the techniques that actually show up in Windows IR, written directly against event fields (no external rule files to ship or update).\n- **File or live** — analyze a directory of collected `.evtx`, or scan the live logs on the host you're triaging.\n\n---\n\n## Quick start\n\n```powershell\n# Analyze a directory of EVTX files (recursive)\n.\\Invoke-ZavetSecEVTXHunter.ps1 -Path C:\\Evidence\\evtx\n\n# Analyze a single file\n.\\Invoke-ZavetSecEVTXHunter.ps1 -Path C:\\Evidence\\Security.evtx\n\n# Scan the live host\n.\\Invoke-ZavetSecEVTXHunter.ps1 -LiveScan\n\n# Only surface High and Critical, output all formats\n.\\Invoke-ZavetSecEVTXHunter.ps1 -Path .\\evtx -MinSeverity High -OutputFormat All\n\n# Tune business hours (in the monitored site's UTC+5 zone) and apply your own whitelist\n.\\Invoke-ZavetSecEVTXHunter.ps1 -Path .\\evtx -WorkHoursStart 8 -WorkHoursEnd 19 -WorkHoursTimeZoneOffset 5 -Whitelist .\\zavetsec-whitelist.example.json\n```\n\nOutput is written to the output directory as `ZavetSec-EVTXHunter_\u003ctimestamp\u003e.html` (and `.json` / `.csv` when requested).\n\n---\n\n## Parameters\n\n| Parameter | Default | Description |\n|---|---|---|\n| `-Path \u003cpath\u003e` | *(required, File mode)* | Single `.evtx` file or directory of them (recursive). For a directory, only files from covered channels are parsed |\n| `-AllFiles` | off | In directory mode, parse every `.evtx` regardless of channel (overrides the covered-channel filter) |\n| `-LiveScan` | *(required, Live mode)* | Scan live Windows Event Logs on the local host |\n| `-LogNames \u003cstring[]\u003e` | 10 channels (Security, System, Application, PowerShell, Sysmon, TaskScheduler, WMI-Activity, Defender, TerminalServices LSM/RCM — all Operational) | Which live logs to scan (Live mode) |\n| `-OutputPath \u003cpath\u003e` | current directory | Where reports are written |\n| `-OutputFormat \u003cHTML\\|JSON\\|CSV\\|All\u003e` | `HTML` | Report format(s) to generate |\n| `-MinSeverity \u003cInfo\\|Low\\|Medium\\|High\\|Critical\u003e` | `Low` | Minimum severity to report |\n| `-DisableCorrelation` | off | Skip the correlation engine (faster on huge datasets) |\n| `-WorkHoursStart \u003c0-23\u003e` | `9` | Start of business hours for off-hours detection |\n| `-WorkHoursEnd \u003c1-23\u003e` | `18` | End of business hours for off-hours detection |\n| `-WorkHoursTimeZoneOffset \u003c-14..14\u003e` | `0` (UTC) | UTC offset of the *monitored* environment, so business hours are judged in the site's local time, not the analyst workstation's |\n| `-DormantDays \u003cint\u003e` | `30` | Days of inactivity after which an account's next logon is flagged as a dormant-account wakeup (`0` disables) |\n| `-MaxEvents \u003cint\u003e` | `1000000` | Cap on events parsed |\n| `-TimeRangeHours \u003cint\u003e` | `0` (all) | Only analyze events within the last N hours |\n| `-Whitelist \u003cpath\u003e` | none | JSON file of additional whitelist rules (extends built-in defaults) |\n\n---\n\n## Detection coverage\n\n61 rules and 10 correlation chains spanning **9 MITRE ATT\u0026CK tactics**:\n\n| Tactic | Focus |\n|---|---|\n| Credential Access | Brute force, credential dumping indicators, Kerberoasting, explicit-credential abuse |\n| Defense Evasion | Log clearing, audit policy tampering, obfuscated/encoded execution |\n| Persistence | Service install, scheduled tasks, run keys, account creation |\n| Lateral Movement | Remote logons, pass-the-hash indicators, remote service creation |\n| Execution | PowerShell/script abuse, suspicious process creation, LOLBins |\n| Privilege Escalation | Admin group changes, token/privilege abuse |\n| Discovery | Account and network reconnaissance |\n| Impact | Destructive actions |\n| Command and Control | Suspicious outbound indicators |\n\nDetection logic is tuned to suppress the highest-volume real-world false positives — Windows-managed driver installs, and machine/service accounts authenticating around the clock — without blunting the categories that matter. See [False-positive control](#false-positive-control) for how this is balanced against the BYOVD attack surface.\n\n\u003e When pointed at a directory, EVTXHunter only parses `.evtx` files belonging to channels the rules cover (the ~100 diagnostic/telemetry channels in `winevt\\Logs` are skipped so they don't waste time). Pass `-AllFiles` to parse everything regardless of channel.\n\n### Example detections\n\nA representative sample of the built-in rules (exact titles as they appear in the report):\n\n| Tactic | Detection |\n|---|---|\n| Credential Access | Kerberoasting (RC4 service-ticket requests), AS-REP Roasting, DCSync (Directory Replication access), Pass-the-Hash (network NTLM logon), Password Spray |\n| Defense Evasion | Security/System event log cleared, `wevtutil` log clearing, AMSI bypass, Defender tampering, Defender real-time protection disabled, scheduled task deleted |\n| Execution | PowerShell encoded command, download cradle, LOLBin execution, Office spawning a shell, Defender malware detection |\n| Persistence | New service installed, WMI event subscription (Sysmon + native WMI-Activity), scheduled task created/registered, run keys |\n| Privilege Escalation | User added to Administrators / Domain Admins, SID-History injection, token-privilege manipulation |\n| Credential Dumping | LSASS memory access, LSASS dump via `comsvcs.dll` MiniDump, SAM database access |\n| Lateral Movement | RDP brute force, RDP session/auth tracking (TerminalServices), remote thread injection, executable written to an admin share |\n| Impact | Inhibit system recovery (shadow-copy / backup deletion) |\n\nAnd multi-event **correlation chains** that single-event rules miss:\n\n- Brute Force Leading to Successful Logon\n- Reconnaissance Followed by Lateral Movement\n- Persistence via Service Followed by Log Clearing\n- Account Creation Followed by Admin Group Addition\n- DCSync Preparation: Recon then Replication Access\n- PowerShell Encoded Execution Followed by Persistence\n\n\n\n---\n\n## False-positive control\n\nLog hunting lives or dies on signal-to-noise. EVTXHunter handles it in two layers:\n\n**1. Automatic, generalizable suppression.** Service installs from the Windows-managed `DriverStore\\FileRepository` path (signed device drivers — GPU, audio, chipset, AV filter drivers) are suppressed by rule logic, on any host, without naming a single vendor. What is *not* suppressed: plain `System32\\drivers\\*.sys` installs, because that is where Bring-Your-Own-Vulnerable-Driver attacks stage their payloads — a loud low-severity finding there is correct.\n\n**2. Your environment's whitelist.** Host- or estate-specific noise (your AV's driver family, your management agent, named service accounts) belongs in an external JSON file that *extends* the built-in defaults rather than replacing them. A working example for a Kaspersky-protected host ships as [`zavetsec-whitelist.example.json`](zavetsec-whitelist.example.json):\n\n```json\n[\n  { \"RuleID\": \"ZVS-PE-001\", \"Fields\": { \"ImagePath\": \"*\\\\DRIVERS\\\\K4W-*\\\\*.sys\" } },\n  { \"RuleID\": \"ZVS-PE-001\", \"Fields\": { \"ServiceName\": \"Kaspersky*\" } }\n]\n```\n\n```powershell\n.\\Invoke-ZavetSecEVTXHunter.ps1 -Path .\\evtx -Whitelist .\\zavetsec-whitelist.example.json\n```\n\nFields are matched with wildcards (`-like`). A rule with no `RuleID` applies to all rules. Your entries are **added** to the built-in defaults, never replace them.\n\n\u003e The built-in default whitelist is intentionally minimal and not tuned to any one environment. Expect to add your own AV/EDR and management-agent entries on first run — that is the design, not a gap.\n\n---\n\n## Requirements\n\n| | |\n|---|---|\n| PowerShell | 5.1+ (built into Windows 8.1 / Server 2012 R2 and later) |\n| Privileges | Standard user for file analysis; Administrator for `-LiveScan` of the Security log |\n| Internet | Not required — fully air-gap capable |\n| Install | None — single script file |\n\n---\n\n## Verify before running\n\nIn regulated or high-sensitivity environments, download to an offline staging machine, verify the SHA256 against the published checksum, then deploy from an internal share.\n\n```powershell\nGet-FileHash .\\Invoke-ZavetSecEVTXHunter.ps1 -Algorithm SHA256\n```\n\n\u003e EVTXHunter is read-only against your evidence and generates observable telemetry when run (ScriptBlock logging, AMSI, process creation). It is an authorized-IR tool, not a covert one.\n\n---\n\n## Performance\n\n\u003c!-- TODO: fill in with real numbers from a benchmark run. Do NOT ship placeholder\n     figures - measure on a representative dataset and a stated test system, e.g.:\n\n     | Dataset       | Events  | Time    |\n     |---------------|---------|---------|\n     | Single host   | ~100k   | _ s     |\n     | Small estate  | ~500k   | _ s     |\n     | Large pull    | ~1M     | _ s     |\n\n     Test system: \u003cCPU\u003e / \u003cRAM\u003e / PowerShell \u003cversion\u003e\n\n     Until measured, this section is intentionally omitted rather than guessed. --\u003e\n\n_Benchmarks pending — will be published from a representative dataset on a stated test system._\n\n---\n\n## How it works\n\n```text\n   EVTX files  ──or──  live channels\n        │\n        ▼\n   ┌──────────┐   normalize fields, index by Event ID + account\n   │  Parser  │\n   └──────────┘\n        │\n        ▼\n   ┌────────────────────┐   61 Sigma-subset rules + whitelist\n   │  Detection engine  │\n   └────────────────────┘\n        │\n        ▼\n   ┌──────────────────────┐   10 multi-event attack chains\n   │  Correlation engine  │\n   └──────────────────────┘\n        │\n        ▼\n   ┌─────────────────┐   per-entity risk: users / IPs / hosts / procs\n   │  Risk scoring   │   + temporal anomalies (off-hours / burst / dormant)\n   └─────────────────┘\n        │\n        ▼\n   Self-contained HTML report  (+ optional JSON / CSV)\n```\n\n1. **Parse** — reads `.evtx` (file mode) or live channels (live mode), normalizing each event's fields into a queryable structure and indexing by Event ID and account.\n2. **Detect** — runs the 61-rule engine over the indexed events, applying the whitelist to suppress known-good noise.\n3. **Correlate** — the chain engine looks for multi-event attack sequences within time windows.\n4. **Score** — every finding feeds a per-entity risk score for users, IPs, hosts, and processes; temporal anomalies add weighted context.\n5. **Report** — emits a self-contained interactive HTML report (and optional JSON/CSV) ready to read or hand off. Event timestamps in the report are shown in **UTC** (the EVTX native time base), so findings line up across hosts in different time zones.\n\n---\n\n## Roadmap\n\n- [ ] Amcache / ShimCache enrichment\n- [ ] Sigma rule import (map external Sigma YAML onto the engine)\n- [x] Timeline view in the HTML report\n- [ ] Pluggable rule packs per environment profile\n\n---\n\n## License\n\nSee [LICENSE](LICENSE).\n\n---\n\n\u003cdiv align=\"center\"\u003e\n\n**Part of the ZavetSec DFIR toolkit** — zero dependencies, zero setup, immediate output.\n\nBuilt for incident responders, DFIR analysts, and threat hunters who need answers from Windows logs without deploying additional infrastructure.\n\n[github.com/zavetsec](https://github.com/zavetsec)\n\n*Discipline over marketing.*\n\n\u003c/div\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzavetsec%2Fzavetsec-evtxhunter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzavetsec%2Fzavetsec-evtxhunter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzavetsec%2Fzavetsec-evtxhunter/lists"}