APT-Hunter is a specialised open-source tool designed to detect Advanced Persistent Threats (APTs) by hunting through Windows event logs. APTs are sophisticated, long-term intrusions that often evade traditional security tools for months — APT-Hunter is built specifically to find their traces.

Every finding is automatically mapped to the MITRE ATT&CK framework, giving you immediate context on what tactic the attacker is using (lateral movement, persistence, credential access, etc.) and what to do next. It is entirely free and an excellent starting point for organisations with Windows-heavy environments.

# Install dependencies
pip install -r requirements.txt

# Run against exported Windows event logs (.evtx)
python APT-Hunter.py -p /path/to/logs/ -o output_report

# Output: CSV + HTML report mapped to MITRE ATT&CK

MISP is the world’s most widely deployed open-source threat intelligence platform. Its core mission is simple but powerful: allow security teams across organisations and nations to share Indicators of Compromise (IOCs) — file hashes, IP addresses, domains, URLs, email subjects — in a structured and automated way.

When your SOC encounters a new malware sample, MISP lets you immediately check whether another organisation has already seen it and documented its behaviour. It supports automated ingestion from dozens of feeds (VirusTotal, AlienVault OTX, CIRCL, etc.) and exports in STIX, OpenIOC, CSV, and many other formats.

MISP event dashboard — centralising IOCs shared across the community

Zeek (formerly Bro) is a high-performance network security monitoring platform that passively analyses network traffic in real time. Unlike traditional NIDS (Network Intrusion Detection Systems) that rely on signatures, Zeek generates rich, structured log files for every connection, DNS query, HTTP request, SSL handshake, and file transfer — creating a detailed audit trail of everything that crosses your network.

Its powerful scripting language allows security teams to write custom detection logic — far more flexible than fixed rules. Zeek excels at detecting data exfiltration, DNS tunnelling, beaconing behaviour, and lateral movement.

Zeek generates structured logs for every protocol event — far richer than raw packet captures

# Read conn.log and find hosts making regular outbound calls
cat conn.log | zeek-cut id.orig_h id.resp_h duration \
  | sort | uniq -c | sort -rn | head -20

# Suspicious pattern: same destination, regular intervals = C2 beaconing

YARA is often described as “the pattern-matching Swiss army knife for malware researchers.” It allows analysts to create custom rules that describe malware families based on textual or binary patterns — strings, byte sequences, regular expressions, and logical conditions.

Once you have a YARA rule for a specific malware family, you can scan any file, process, or memory dump across your entire infrastructure to detect every instance of it. YARA is used in VirusTotal, many EDRs, SIEMs, and sandbox platforms under the hood.

A YARA rule — define what to look for, then scan millions of files instantly

rule Mimikatz_Generic {
    meta:
        description = "Detects Mimikatz credential dumper"
        author      = "FreeCourse"
        severity    = "critical"

    strings:
        $s1 = "mimikatz" nocase
        $s2 = "sekurlsa::logonpasswords" nocase
        $s3 = "lsadump::sam" nocase

    condition:
        2 of ($s*)
}

# Scan all files in a directory recursively
yara -r mimikatz_rule.yar /path/to/scan/

# Scan a running process by PID
yara mimikatz_rule.yar 1234

OSSEC is a robust open-source Host-based Intrusion Detection System (HIDS) that monitors the security of individual endpoints from the inside. It continuously watches system logs, file integrity, processes, and the Windows registry, alerting on any suspicious change.

Its key capabilities include file integrity monitoring (FIM) — detecting when critical system files are modified, replaced, or deleted — rootkit detection, and real-time log analysis across Linux, Windows, and macOS. OSSEC integrates with external threat intelligence feeds and cloud environments, making it suitable as a lightweight endpoint agent alongside heavier commercial EDR solutions.

Developed by Meta (Facebook), Osquery is one of the most elegant threat hunting tools ever built. It exposes the entire operating system — running processes, open network connections, loaded kernel modules, installed software, user accounts, scheduled tasks — as SQL tables you can query in real time.

If you can write SQL, you can hunt threats. Osquery is cross-platform (Linux, macOS, Windows) and can be deployed at scale across thousands of endpoints, making it a must-have for enterprise threat hunting.

-- Find all processes making network connections
SELECT p.name, p.pid, p.path, c.remote_address, c.remote_port
FROM processes p
JOIN process_open_sockets c ON p.pid = c.pid
WHERE c.remote_address NOT IN ('', '0.0.0.0', '127.0.0.1');

-- Find processes running from suspicious locations
SELECT name, path, pid, cmdline
FROM processes
WHERE path LIKE '%/tmp/%'
   OR path LIKE '%AppData%';

-- Hunt for persistence via scheduled tasks (Windows)
SELECT name, action, path, enabled
FROM scheduled_tasks
WHERE enabled = 1
  AND path NOT LIKE '%Microsoft%';

TheHive is an open-source Security Incident Response Platform (SIRP) designed for collaborative incident investigation. When a threat is detected — whether by YARA, Zeek, OSSEC, or any other tool — TheHive is where your team manages the entire response lifecycle.

It integrates natively with MISP for IOC enrichment, with Cortex for automated observable analysis (file hash lookups, IP reputation, domain analysis), and supports custom playbooks and templates for consistent incident handling.

TheHive case management view — tasks, observables, and team collaboration in one place