hunt_ioc
Search Windows forensic artifacts for a hash, filename, IP, or domain to locate its presence and identify if it is known malware.
Instructions
Hunt for IOC (hash, filename, IP, domain) across all forensic artifacts. Searches Prefetch, Amcache, SRUM, MFT, USN Journal, Browser History, EVTX logs, and optionally YARA rules. Answers: Where does this IOC appear? Was this file/hash/domain seen on the system? Is it known malware?
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ioc | Yes | The indicator to search for: MD5/SHA1/SHA256 hash, filename, IP address, or domain | |
| ioc_type | No | Type of IOC (auto-detected if not specified) | auto |
| mft_path | No | Override auto-detected $MFT path | |
| usn_path | No | Override auto-detected USN Journal path | |
| evtx_path | No | Override auto-detected EVTX directory path | |
| srum_path | No | Override auto-detected SRUDB.dat path | |
| yara_scan | No | If True, scan the file with YARA rules when IOC is a filename and file is found. Provides threat intelligence (is it known malware?). | |
| amcache_path | No | Override auto-detected Amcache.hve path | |
| artifacts_dir | Yes | Base directory containing forensic artifacts. Tool will auto-detect common paths. | |
| prefetch_path | No | Override auto-detected Prefetch directory path | |
| time_range_end | No | ISO format datetime - filter events before this time | |
| time_range_start | No | ISO format datetime - filter events after this time |