GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → opencybersecurityalliance → kestrel-lang

opencybersecurityalliance / kestrel-lang

Licence: Apache-2.0 license
Kestrel threat hunting language: building reusable, composable, and shareable huntflows across different data sources and threat intel.

Programming Languages

python
139335 projects - #7 most used programming language
shell
77523 projects

Labels

securitythreat-huntinghacktoberfest

Projects that are alternatives of or similar to kestrel-lang

SysmonResources
Consolidation of various resources related to Microsoft Sysmon & sample data/log
Stars: ✭ 64 (-61.21%)
Mutual labels:  threat-hunting
SSHapendoes
Capture passwords of login attempts on non-existent and disabled accounts.
Stars: ✭ 31 (-81.21%)
Mutual labels:  threat-hunting
SysmonConfigPusher
Pushes Sysmon Configs
Stars: ✭ 59 (-64.24%)
Mutual labels:  threat-hunting
csirtg-smrt-v1
the fastest way to consume threat intelligence.
Stars: ✭ 27 (-83.64%)
Mutual labels:  threat-hunting
malware-persistence
Collection of malware persistence and hunting information. Be a persistent persistence hunter!
Stars: ✭ 109 (-33.94%)
Mutual labels:  threat-hunting
censys-recon-ng
recon-ng modules for Censys
Stars: ✭ 29 (-82.42%)
Mutual labels:  threat-hunting
TA-Sysmon-deploy
Deploy and maintain Symon through the Splunk Deployment Sever
Stars: ✭ 31 (-81.21%)
Mutual labels:  threat-hunting
sqhunter
A simple threat hunting tool based on osquery, Salt Open and Cymon API
Stars: ✭ 64 (-61.21%)
Mutual labels:  threat-hunting
ELK-Hunting
Threat Hunting with ELK Workshop (InfoSecWorld 2017)
Stars: ✭ 58 (-64.85%)
Mutual labels:  threat-hunting
PowerGRR
PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.
Stars: ✭ 52 (-68.48%)
Mutual labels:  threat-hunting
ThreatIntelligence
Tracking APT IOCs
Stars: ✭ 23 (-86.06%)
Mutual labels:  threat-hunting
Malware-Sample-Sources
Malware Sample Sources
Stars: ✭ 214 (+29.7%)
Mutual labels:  threat-hunting
Azure-Sentinel-4-SecOps
Microsoft Sentinel SOC Operations
Stars: ✭ 140 (-15.15%)
Mutual labels:  threat-hunting
thremulation-station
Small-scale threat emulation and detection range built on Elastic and Atomic Redteam.
Stars: ✭ 28 (-83.03%)
Mutual labels:  threat-hunting
ETWNetMonv3
ETWNetMonv3 is simple C# code for Monitoring TCP Network Connection via ETW & ETWProcessMon/2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.
Stars: ✭ 32 (-80.61%)
Mutual labels:  threat-hunting
DomainCAT
Domain Connectivity Analysis Tools to analyze aggregate connectivity patterns across a set of domains during security investigations
Stars: ✭ 34 (-79.39%)
Mutual labels:  threat-hunting
SIGMA-detection-rules
Set of SIGMA rules (>250) mapped to MITRE Att@k tactic and techniques
Stars: ✭ 97 (-41.21%)
Mutual labels:  threat-hunting
hassh-utils
hassh-utils: Nmap NSE Script and Docker image for HASSH - the SSH client/server fingerprinting method (https://github.com/salesforce/hassh)
Stars: ✭ 41 (-75.15%)
Mutual labels:  threat-hunting
YaraHunts
Random hunting ordiented yara rules
Stars: ✭ 86 (-47.88%)
Mutual labels:  threat-hunting
MindMaps
#ThreatHunting #DFIR #Malware #Detection Mind Maps
Stars: ✭ 224 (+35.76%)
Mutual labels:  threat-hunting
View All Similar Projects ➔

Kestrel Threat Hunting Language

Python 3 Code Style: Black Code Coverage Latest Version PyPI Downloads Documentation Status

[News] Kestrel arsenal session coming to Black Hat USA 2022 (spin up your copy of BH22 demo to hunt)

Kestrel is a threat hunting language aiming to make cyber threat hunting fast by providing a layer of abstraction to build reusable, composable, and shareable hunt-flow.

Try Kestrel in a cloud sandbox without install (Blog: Try Kestrel in a Cloud Sandbox).

Software developers write Python or Swift than machine code to quickly turn business logic into applications. Threat hunters write Kestrel to quickly turn threat hypotheses into hunt-flow. We see threat hunting as an interactive procedure to create customized intrusion detection systems on the fly, and hunt-flow is to hunts as control-flow is to ordinary programs.

What does it mean by hunt fast?

  • Do not write the same TTP pattern in different data source queries.
  • Do not write one-time-use adapaters to connect hunt steps.
  • Do not waste your existing analytic scripts/programs in future hunts.
  • Do construct your hunt-flow from smaller reuseable hunt-flow.
  • Do share your huntbook with your future self and your colleagues.
  • Do get interactive feedback and revise hunt-flow on the fly.

Kestrel Hunting Demo

Kestrel in a Nutshell

Kestrel overview.

  • Kestrel language: a threat hunting language for a human to express what to hunt.
    • expressing the knowledge of what in patterns, analytics, and hunt flows.
    • composing reusable hunting flows from individual hunting steps.
    • reasoning with human-friendly entity-based data representation abstraction.
    • thinking across heterogeneous data and threat intelligence sources.
    • applying existing public and proprietary detection logic as analytic hunt steps.
    • reusing and sharing individual hunting steps, hunt-flow, and entire huntbooks.
  • Kestrel runtime: a machine interpreter that deals with how to hunt.
    • compiling the what against specific hunting platform instructions.
    • executing the compiled code locally and remotely.
    • assembling raw logs and records into entities for entity-based reasoning.
    • caching intermediate data and related records for fast response.
    • prefetching related logs and records for link construction between entities.
    • defining extensible interfaces for data sources and analytics execution.

Basic Concepts and Howto

Visit Kestrel documentation to learn Kestrel:

Kestrel Huntbooks And Analytics

Kestrel Hunting Blogs

  1. Building a Huntbook to Discover Persistent Threats from Scheduled Windows Tasks
  2. Practicing Backward And Forward Tracking Hunts on A Windows Host
  3. Building Your Own Kestrel Analytics and Sharing With the Community
  4. Setting Up The Open Hunting Stack in Hybrid Cloud With Kestrel and SysFlow
  5. Try Kestrel in a Cloud Sandbox

Talks And Demos

Visit Kestrel documentation on talks to learn more about the talks:

Connecting With The Community

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].