FROM ubuntu:22.04
LABEL maintainer="tabledevil"
ENV DEBIAN_FRONTEND=noninteractive

# APT-Hunter upstream is unmaintained. Modern dependency releases break it:
#  - netaddr 1.x removed IPAddress.is_private (renamed semantics)
#  - python-dateutil 2.9+ rejects malformed "Z UTC" timestamps in some EVTX
# Pin to last compatible majors via constraints below.
# Ubuntu 22.04 base for Python 3.10 (also dodges some 3.12 stdlib churn).
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      git python3 python3-pip python3-venv ca-certificates \
 && rm -rf /var/lib/apt/lists/*

# Always grab the latest APT-Hunter master at build time.
RUN git clone --depth=1 https://github.com/ahmedkhlief/APT-Hunter /APT-Hunter

# Use a venv: PEP 668 on Ubuntu 24.04 blocks system pip.
# flatten_json is required at runtime but missing from upstream requirements.
RUN python3 -m venv /opt/apthunter \
 && /opt/apthunter/bin/pip install -r /APT-Hunter/requirements.txt \
 && /opt/apthunter/bin/pip install \
      flatten_json \
      'netaddr<1.0'

# Patch APT-Hunter for malformed "Z UTC" timestamps that dateutil refuses.
# Some Microsoft EVTX records carry "2021-...Z UTC" (Zulu + literal UTC),
# which APT-Hunter passes straight to dateutil.parser.parse() and crashes.
RUN sed -i 's|parse(record\["timestamp"\])|parse(record["timestamp"].replace(" UTC",""))|g' \
      /APT-Hunter/lib/EvtxDetection.py

ENV PATH=/opt/apthunter/bin:$PATH

RUN mkdir /output && touch /output/notmounted
ADD start.sh /root/start.sh
RUN chmod +x /root/start.sh
CMD ["/bin/bash","/root/start.sh"]