hunt_malware — Automated Blue Team Scanner

Version: 2.1.0
Requires: Python 3.8+, Administrator/Root privileges, psutil package

---

Overview

hunt_malware is a host-based threat hunting tool that scans a live Windows or Linux system for indicators of compromise (IOCs). It combines keyword/signature matching with behavioral and heuristic analysis to detect both known malware tools and fileless/living-off-the-land attacks that traditional signature scanners miss.

Detection Engines

Engine	Flag	What It Detects
Keyword Process Scan	--processes	Known malware tool names in running processes (Meterpreter, Mimikatz, Netcat, etc.)
Network Port Scan	--network	Suspicious listening/established ports + keyword matches on network-connected processes
Persistence Check	--persistence	Registry Run keys, Startup folder, Scheduled Tasks, Windows Services with suspicious entries
DNS / Hosts Check	--dns	Suspicious domains in DNS cache (.onion, pastebin, tor2web), malicious hosts file entries
Behavioral Analysis	--behavioral	Suspicious execution paths, Office-spawned shells, LOLBin abuse, obfuscated PowerShell, name/path mismatches

Behavioral Analysis Details

The behavioral engine is the most effective real-world detector. It identifies:

• Suspicious execution paths — Processes running from \Temp\, \AppData\Roaming\, \Public\, /tmp/, etc. Malware drops here because these directories are writable without UAC.
• Office → shell spawning — Word, Excel, PowerPoint, Outlook, or Acrobat spawning cmd.exe, powershell.exe, wscript.exe, etc. This is the #1 indicator of macro malware and phishing payloads.
• LOLBin abuse — 18 Living Off The Land Binaries (certutil, mshta, rundll32, regsvr32, msbuild, msdt, etc.) with argument-aware detection to reduce false positives.
• Suspicious PowerShell — 22 command-line patterns (-enc, -w hidden, -nop, IEX, FromBase64String, DownloadString, Reflection.Assembly, etc.) with multi-indicator severity scoring.
• Name/path mismatch — Process name differs from the executable filename, indicating possible process hollowing.

Installation

pip install -r requirements.txt

No other external dependencies are required.

Usage

# Run all scans (default)
python hunt_malware.py

# Run specific scans
python hunt_malware.py --processes
python hunt_malware.py --network
python hunt_malware.py --persistence
python hunt_malware.py --dns
python hunt_malware.py --behavioral

# Combine scans
python hunt_malware.py --processes --network --behavioral

# JSON output for SIEM/tooling integration
python hunt_malware.py --all --json > results.json

# Use a custom IOC wordlist (extends built-in keywords)
python hunt_malware.py --wordlist ioc_keywords.txt

Important: Must be run as Administrator (Windows) or root (Linux) to access all process information and persistence locations.

Exit Codes

Code	Meaning
0	No threats detected
1	Threats detected
2	Error (not running as admin)

Severity Levels

Level	Color	Meaning
HIGH	Red	Active exploit tool, office-spawned shell, multi-indicator PowerShell, or keyword+port correlation
MEDIUM	Yellow	Suspicious keyword match, LOLBin with suspicious args, process in suspicious path, single-indicator PowerShell
LOW	Cyan	Suspicious port without keyword match, single weak indicator

Custom Wordlist

The --wordlist flag loads additional IOC keywords from a text file. The file format is simple:

# Lines starting with # are comments
# Blank lines are ignored
# Each line is a keyword matched case-insensitively against process names and command lines

mimikatz
cobaltstrike
beacon
shell64

Keywords are matched the same way as built-in ones:

• Short keywords (≤4 characters) use word-boundary matching to avoid false positives
• Longer keywords use substring matching

A default wordlist (ioc_wordlist.txt) is included with common malware family names, attack tool identifiers, and suspicious command patterns.

Output

Console

Colored terminal output with severity-coded threat alerts:

[!] PROCESS THREAT DETECTED [HIGH]
    Keyword:     meterpreter
    Severity:    HIGH
    PID:         4832
    Name:        meterpreter.exe
    Path:        C:\Users\bob\AppData\Local\Temp\meterpreter.exe
    SHA256:      a1b2c3d4...
    Parent:      cmd.exe
    Started:     2026-05-17 18:04:59
    Command:     C:\Users\bob\AppData\Local\Temp\meterpreter.exe

Log File

All results are appended to hunt_malware_log.txt (located next to the script) with ANSI codes stripped for clean text.

JSON

With --json, a structured JSON object is printed to stdout containing all threats, severity counts, and scan metadata.

File Structure

hunt_malware/
├── hunt_malware.py        # Main scanner script
├── hunt_malware_log.txt   # Scan results log (gitignored)
├── ioc_wordlist.txt       # Custom IOC keyword list
├── requirements.txt       # Python dependencies
├── LICENSE                 # MIT License
└── README.md              # This file

Detection Configuration

All detection rules are configurable at the top of hunt_malware.py:

Variable	Purpose
SUSPICIOUS_KEYWORDS	Keyword list for process/command-line matching
SUSPICIOUS_PORTS	Ports associated with attack tools
KNOWN_SAFE_NAMES	Process names to skip (avoid false positives)
SUSPICIOUS_EXECUTION_PATHS	Directories where malware commonly drops payloads
OFFICE_PROCESS_NAMES	Productivity apps that should never spawn shells
SUSPICIOUS_CHILD_PROCESSES	Shells/interpreters suspicious when spawned by Office
LOLBINS	Living Off The Land Binaries with abuse descriptions
SUSPICIOUS_POWERSHELL_PATTERNS	Regex patterns for malicious PowerShell command lines

Limitations

• Point-in-time scan only — Does not continuously monitor. Run on a schedule or combine with EDR for real-time detection.
• Requires admin/root — Without elevated privileges, many process details and persistence locations are inaccessible.
• Not a replacement for AV/EDR — This is a hunting tool for analysts, not endpoint protection.
• False positives are possible — LOLBins like rundll32 and msiexec have legitimate uses. Always investigate before responding.
• Windows-focused — Behavioral analysis and persistence checks are most comprehensive on Windows. Linux support covers cron, systemd, and basic process/network checks.

License

This project is licensed under the MIT License with additional terms restricting use to educational and ethical hacking purposes only. Use responsibly and only on systems you own or have authorization to audit.