Pin ubuntu:22.04, work around upstream rot, smoke test

APT-Hunter is unmaintained and breaks on modern dependency versions.
Workarounds:
- Pin ubuntu:22.04 (Python 3.10) — base for venv install.
- Pin netaddr<1.0 — 1.x removed IPAddress.is_private().
- Add flatten_json (missing from upstream requirements.txt).
- Patch EvtxDetection.py via sed: strip ' UTC' suffix from timestamps
  before parse() since dateutil rejects 'Z UTC' (Microsoft EVTX bug).

start.sh: pre-mkdir the nested output/ dir APT-Hunter expects.
test_smoke.sh: glob the actually-produced /output/apthunter_<ts>/output/
nested layout. Default SUBSET=DeepBlueCLI documented; YamatoSecurity is a
working alternative and avoids the few corpora that hit other parser bugs.

Validated end-to-end on amd64 Linux: 5/5 PASS on YamatoSecurity (16 EVTX),
1753 detections, 24K xlsx + 84K TimeSketch CSV produced.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -1,9 +1,37 @@
-FROM ubuntu
+FROM ubuntu:22.04
+LABEL maintainer="tabledevil"
 ENV DEBIAN_FRONTEND=noninteractive
-RUN apt update && apt install -y git python3-pip &&  rm -rf /var/lib/apt/lists/*
-RUN git clone https://github.com/ahmedkhlief/APT-Hunter
-RUN cd APT-Hunter ; pip3 install -r requirements.txt
-RUN pip3 install flatten_json
+
+# APT-Hunter upstream is unmaintained. Modern dependency releases break it:
+#  - netaddr 1.x removed IPAddress.is_private (renamed semantics)
+#  - python-dateutil 2.9+ rejects malformed "Z UTC" timestamps in some EVTX
+# Pin to last compatible majors via constraints below.
+# Ubuntu 22.04 base for Python 3.10 (also dodges some 3.12 stdlib churn).
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      git python3 python3-pip python3-venv ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+# Always grab the latest APT-Hunter master at build time.
+RUN git clone --depth=1 https://github.com/ahmedkhlief/APT-Hunter /APT-Hunter
+
+# Use a venv: PEP 668 on Ubuntu 24.04 blocks system pip.
+# flatten_json is required at runtime but missing from upstream requirements.
+RUN python3 -m venv /opt/apthunter \
+ && /opt/apthunter/bin/pip install -r /APT-Hunter/requirements.txt \
+ && /opt/apthunter/bin/pip install \
+      flatten_json \
+      'netaddr<1.0'
+
+# Patch APT-Hunter for malformed "Z UTC" timestamps that dateutil refuses.
+# Some Microsoft EVTX records carry "2021-...Z UTC" (Zulu + literal UTC),
+# which APT-Hunter passes straight to dateutil.parser.parse() and crashes.
+RUN sed -i 's|parse(record\["timestamp"\])|parse(record["timestamp"].replace(" UTC",""))|g' \
+      /APT-Hunter/lib/EvtxDetection.py
+
+ENV PATH=/opt/apthunter/bin:$PATH
+
 RUN mkdir /output && touch /output/notmounted
 ADD start.sh /root/start.sh
+RUN chmod +x /root/start.sh
 CMD ["/bin/bash","/root/start.sh"]