hunt_ioc
Search for indicators of compromise across Windows forensic artifacts, including Prefetch, event logs, and registry. Identifies where the IOC appears and checks for known malware via optional YARA scanning.
Instructions
Hunt for IOC (hash, filename, IP, domain) across all forensic artifacts. Searches Prefetch, Amcache, SRUM, MFT, USN Journal, Browser History, EVTX logs, and optionally YARA rules. Answers: Where does this IOC appear? Was this file/hash/domain seen on the system? Is it known malware?
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ioc | Yes | The indicator to search for: MD5/SHA1/SHA256 hash, filename, IP address, or domain | |
| artifacts_dir | Yes | Base directory containing forensic artifacts. Tool will auto-detect common paths. | |
| ioc_type | No | Type of IOC (auto-detected if not specified) | auto |
| time_range_start | No | ISO format datetime - filter events after this time | |
| time_range_end | No | ISO format datetime - filter events before this time | |
| yara_scan | No | If True, scan the file with YARA rules when IOC is a filename and file is found. Provides threat intelligence (is it known malware?). | |
| prefetch_path | No | Override auto-detected Prefetch directory path | |
| amcache_path | No | Override auto-detected Amcache.hve path | |
| srum_path | No | Override auto-detected SRUDB.dat path | |
| mft_path | No | Override auto-detected $MFT path | |
| usn_path | No | Override auto-detected USN Journal path | |
| evtx_path | No | Override auto-detected EVTX directory path |