tabledevil
7ad1cc8465
APT-Hunter is unmaintained and breaks on modern dependency versions. Workarounds: - Pin ubuntu:22.04 (Python 3.10) — base for venv install. - Pin netaddr<1.0 — 1.x removed IPAddress.is_private(). - Add flatten_json (missing from upstream requirements.txt). - Patch EvtxDetection.py via sed: strip ' UTC' suffix from timestamps before parse() since dateutil rejects 'Z UTC' (Microsoft EVTX bug). start.sh: pre-mkdir the nested output/ dir APT-Hunter expects. test_smoke.sh: glob the actually-produced /output/apthunter_<ts>/output/ nested layout. Default SUBSET=DeepBlueCLI documented; YamatoSecurity is a working alternative and avoids the few corpora that hit other parser bugs. Validated end-to-end on amd64 Linux: 5/5 PASS on YamatoSecurity (16 EVTX), 1753 detections, 24K xlsx + 84K TimeSketch CSV produced. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
38 lines
1.5 KiB
Docker
38 lines
1.5 KiB
Docker
FROM ubuntu:22.04
|
|
LABEL maintainer="tabledevil"
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# APT-Hunter upstream is unmaintained. Modern dependency releases break it:
|
|
# - netaddr 1.x removed IPAddress.is_private (renamed semantics)
|
|
# - python-dateutil 2.9+ rejects malformed "Z UTC" timestamps in some EVTX
|
|
# Pin to last compatible majors via constraints below.
|
|
# Ubuntu 22.04 base for Python 3.10 (also dodges some 3.12 stdlib churn).
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
git python3 python3-pip python3-venv ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Always grab the latest APT-Hunter master at build time.
|
|
RUN git clone --depth=1 https://github.com/ahmedkhlief/APT-Hunter /APT-Hunter
|
|
|
|
# Use a venv: PEP 668 on Ubuntu 24.04 blocks system pip.
|
|
# flatten_json is required at runtime but missing from upstream requirements.
|
|
RUN python3 -m venv /opt/apthunter \
|
|
&& /opt/apthunter/bin/pip install -r /APT-Hunter/requirements.txt \
|
|
&& /opt/apthunter/bin/pip install \
|
|
flatten_json \
|
|
'netaddr<1.0'
|
|
|
|
# Patch APT-Hunter for malformed "Z UTC" timestamps that dateutil refuses.
|
|
# Some Microsoft EVTX records carry "2021-...Z UTC" (Zulu + literal UTC),
|
|
# which APT-Hunter passes straight to dateutil.parser.parse() and crashes.
|
|
RUN sed -i 's|parse(record\["timestamp"\])|parse(record["timestamp"].replace(" UTC",""))|g' \
|
|
/APT-Hunter/lib/EvtxDetection.py
|
|
|
|
ENV PATH=/opt/apthunter/bin:$PATH
|
|
|
|
RUN mkdir /output && touch /output/notmounted
|
|
ADD start.sh /root/start.sh
|
|
RUN chmod +x /root/start.sh
|
|
CMD ["/bin/bash","/root/start.sh"]
|