Add JSON and HTML writers for reporting Hunter findings

internal/pkg/hunt/detect/common/functions.go

@@ -22,17 +22,10 @@ func AnalyzeExecutablePath(command string) (bool, string) {
 		}
 	}
 
-	// Check for suspicious installation paths
-	suspiciousPaths := []string{
-		"\\temp\\", "\\tmp\\", "\\appdata\\local\\temp\\",
-		"\\users\\public\\", "\\programdata\\",
-		"\\windows\\temp\\", "\\%temp%\\",
-	}
-
 	execPathLower := strings.ToLower(execPath)
 
 	// Check for suspicious installation paths
-	suspiciousPaths = []string{
+	suspiciousPaths := []string{
 		"\\temp\\", "\\tmp\\", "\\appdata\\local\\temp\\",
 		"\\users\\public\\", "\\programdata\\",
 		"\\windows\\temp\\", "\\%temp%\\",
@@ -50,7 +43,6 @@ func AnalyzeExecutablePath(command string) (bool, string) {
 				"\\oracle\\",
 				"\\citrix\\",
 				"\\vmware\\",
-				// Add more trusted publishers as needed
 			}
 
 			isTrusted := false

internal/pkg/hunt/detect/connections/outbound.go

@@ -45,7 +45,7 @@ func compareConnections(connections []NetworkConnection) []NetworkConnection {
 
 		for _, dns := range common.CommonDNS {
 			if matchesDNSPattern(remote, dns) {
-				fmt.Printf("   [?] Found %s\n", conn.RemoteHost)
+				fmt.Printf("      [?] Found %s\n", conn.RemoteHost)
 				suspiciousConnections = append(suspiciousConnections, conn)
 				break
 			}