Cartehl/windows-threat-detection

Windows Event Log Threat Detection System

Upload a Windows Event Log (CSV or Excel) and the tool auto-detects the log type, normalizes it to a common schema, and runs a hybrid detection pipeline:

• —ML model — scores individual events (row-level anomalies)
• —Rule engine — detects sequential / temporal attacks (brute force, recon chains, security-service tampering, malicious service installs, AV-removal failures)
• —Explanation layer — plain-English threat summary, the evidence responsible, MITRE ATT&CK mapping, and recommended actions
• —Attack-outcome assessment — for brute force, determines whether the attack succeeded, failed, or is undetermined from the uploaded log

Supported inputs

Windows Event Logs exported as CSV/XLSX with expanded columns:

Real-world column-name variants (e.g. Timestamp/TimeCreated, User/TargetUserName, SourceIP/IpAddress) are handled via aliases.

Not supported (out of scope)

• —Raw Get-WinEvent exports where event fields are not expanded into columns
• —Non-Windows logs (email/M365, network flow, cloud audit)

Notes

• —The rule engine is the most reliable layer on real-world data.
• —The ML model is a prototype trained on a small simulated dataset and should be retrained on representative real data before production use.