Skip to content

Latest commit

 

History

History
241 lines (179 loc) · 12.1 KB

README.rst

File metadata and controls

241 lines (179 loc) · 12.1 KB
Raw

Kestrel Threat Hunting Language

Documentation Status Latest Version PyPI Downloads Code Coverage Code Style: Black


Hunt with Native Query/Script (left) or Kestrel (right)?

*An end-to-end cyber threat hunt usually requires execution across multiple datasources/environments plus enrichment/ML/visualization steps anywhere in the huntflow.

Kestrel2 Example

What is Kestrel?

Kestrel is a threat hunting language aiming to make cyber threat hunting fast by providing a layer of abstraction to build reusable, composable, and shareable hunt-flow. Starting with:

  1. Black Hat USA 2024 Kestrel hunting lab
  2. Black Hat USA 2022 Kestrel hunting lab
  3. Black Hat USA 2022 session recording

News

Kestrel in a Nutshell

Software developers write Python or Swift than machine code to quickly turn business logic into applications. Threat hunters write Kestrel to quickly turn threat hypotheses into hunt-flow. We see threat hunting as an interactive procedure to create customized intrusion detection systems on the fly, and hunt-flow is to hunts as control-flow is to ordinary programs.

Kestrel overview.

  • Kestrel language: a threat hunting language for a human to express what to hunt.
    • expressing the knowledge of what in patterns, analytics, and hunt flows.
    • composing reusable hunting flows from individual hunting steps.
    • reasoning with human-friendly entity-based data representation abstraction.
    • thinking across heterogeneous data and threat intelligence sources.
    • applying existing public and proprietary detection logic as analytic hunt steps.
    • reusing and sharing individual hunting steps, hunt-flow, and entire huntbooks.
  • Kestrel runtime: a machine interpreter that deals with how to hunt.
    • compiling the what against specific hunting platform instructions.
    • executing the compiled code locally and remotely.
    • assembling raw logs and records into entities for entity-based reasoning.
    • caching intermediate data and related records for fast response.
    • prefetching related logs and records for link construction between entities.
    • defining extensible interfaces for data sources and analytics execution.

Basic Concepts and Howto

Visit Kestrel documentation to learn Kestrel:

Kestrel 2

Kestrel 2 debuts at Black Hat USA 2024. While maintaining the language syntax from Kestrel 1, we entirely redesign Kestrel 2 runtime to achieve better performance and more flexible syntax regarding entity, attribute, and relation representations.

Key features of Kestrel 2:

  • Just-in-time compilation instead of interpretation
  • Lazy evaluation and the new EXPLAIN command
  • Data Lakehouse optimization with deeply nested query
  • OCSF and OpenTelemetry entity/attribute support besides STIX

Kestrel 2 is currently in beta, learn more at Kestrel runtime installation.

Kestrel Huntbooks And Analytics

Kestrel Hunting Blogs

  1. Building a Huntbook to Discover Persistent Threats from Scheduled Windows Tasks
  2. Practicing Backward And Forward Tracking Hunts on A Windows Host
  3. Building Your Own Kestrel Analytics and Sharing With the Community
  4. Setting Up The Open Hunting Stack in Hybrid Cloud With Kestrel and SysFlow
  5. Try Kestrel in a Cloud Sandbox
  6. Fun with securitydatasets.com and the Kestrel PowerShell Deobfuscator
  7. Kestrel Data Retrieval Explained

Talks And Demos

Talk summary (visit Kestrel documentation on talks to learn details):

Connecting With The Community