hunt_ioc
Search for indicators of compromise across forensic artifacts including Prefetch, Amcache, SRUM, MFT, USN Journal, Browser History, and EVTX logs. Optionally scan files with YARA rules to identify known malware.
Instructions
Hunt for IOC (hash, filename, IP, domain) across all forensic artifacts. Searches Prefetch, Amcache, SRUM, MFT, USN Journal, Browser History, EVTX logs, and optionally YARA rules. Answers: Where does this IOC appear? Was this file/hash/domain seen on the system? Is it known malware?
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ioc | Yes | The indicator to search for: MD5/SHA1/SHA256 hash, filename, IP address, or domain | |
| ioc_type | No | Type of IOC (auto-detected if not specified) | auto |
| mft_path | No | Override auto-detected $MFT path | |
| usn_path | No | Override auto-detected USN Journal path | |
| evtx_path | No | Override auto-detected EVTX directory path | |
| srum_path | No | Override auto-detected SRUDB.dat path | |
| yara_scan | No | If True, scan the file with YARA rules when IOC is a filename and file is found. Provides threat intelligence (is it known malware?). | |
| amcache_path | No | Override auto-detected Amcache.hve path | |
| artifacts_dir | Yes | Base directory containing forensic artifacts. Tool will auto-detect common paths. | |
| prefetch_path | No | Override auto-detected Prefetch directory path | |
| time_range_end | No | ISO format datetime - filter events before this time | |
| time_range_start | No | ISO format datetime - filter events after this time |