Tool for threat hunting and IR.

Processhunter is written in Python, and tested on Windows, Linux and OSX.

This tool was created to provide threat hunters / incident responders, with context, when looking for suspicious running processes.

• Hunt with Yara rule(s)
• Hunt by process name
• Hunt by IPv4 address
• Dump all running processes

The output is in JSON, and processes mached will contain additional information, like process ancenstors, net connections,files hashes and process children.

usage: process_hunter.py [-h] [-p PID] [-r YARARULE] [-i IPADDRES] [-s PROCNAME] [-f]

optional arguments:
  -h, --help            show this help message and exit
	-p PID, --pid PID     Process id
	-r YARARULE, --rule YARARULE Yara rule
	-i IPADDRES, --ip IPADDRES Ipv4 address
	-s PROCNAME, --proc PROCNAME Process name
	-f, --full            Dump running processes

git clone https://github.com/jemik/processhunter.git
cd processhunter
sudo -H pip install -r requirements.txt
sudo ./process_hunter.py -h

This tool comes without ANY warranty!
USE AT YOUR OWN RISK.