ahmedkhlief/APT-Hunter

Health v2 · maintenance only

Adoption not part of the score

1417 stars · 246 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

APT-Hunter is a Python-based threat hunting tool that analyzes Windows event logs (EVTX) to detect APT activity using predefined detection rules and statistical analysis. It produces timeline reports in formats like CSV and Excel that can be analyzed with tools such as Timeline Explorer or Timesketch.

Use cases

• hunt for APT activity in windows event logs
• analyze evtx files for suspicious activity
• build a timeline of suspicious windows events for incident response
• perform compromise assessment on collected windows logs
• detect lateral movement and persistence in event logs
• triage windows event logs during forensic analysis

When to choose

• you need to quickly triage large volumes of Windows EVTX logs during incident response
• you want a purple-team tool with predefined detection rules and statistical anomaly detection
• you need timeline output compatible with Excel, Timeline Explorer, or Timesketch

When to avoid

• you need real-time endpoint detection and response rather than offline log analysis
• you are hunting on non-Windows platforms or log sources other than Windows event logs
• you need a SIEM with continuous monitoring and alerting

Facets

cli-tool · maturity active

security logging analytics developer-tools security developer-tools windows python windows cli cross-platform threat-hunting incident-response forensics windows-event-logs evtx purple-team apt-detection dfir

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ahmedkhlief/APT-Hunter")