Skip to content

Back to the catalog

target/strelka
github.comrepo

target/strelka

Strelka is Target's open-source, container-based real-time file scanning system for threat hunting, threat detection, and incident response, built in Go and Python. It runs 50+ scanners (YARA, PE parsing, encrypted ZIP cracking, entropy analysis, etc.) to extract metadata and content from files at enterprise scale, which can feed a SIEM for alerting on suspicious artifacts like an Emotet-laden encrypted ZIP payload.

TL;DR Target's open-source container-based file scanner that extracts metadata and runs 50+ scanners (incl. YARA) for threat hunting and DFIR pipelines.
Open original ↗
Document

What it is

Strelka (Target) is a modular file-scanning platform with over 50 scanners covering common file types (exe, docx, js, zip). It includes a web UI for ad-hoc analysis and a CLI tool, strelka-oneshot, for scripted/one-off scans.

How it works

Files submitted to Strelka are recursively scanned and re-fed through the pipeline when a scanner extracts an embedded file, so a nested artifact (e.g., an EXE inside a password-protected ZIP) gets analyzed at every layer. In the documented walkthrough, a sample ZIP is scanned by ScanEncryptedZip, which cracks the password via a built-in dictionary, extracts the contents, and resubmits the extracted file to the pipeline. The extracted EXE is then parsed by ScanPe (metadata extraction) and ScanYara (rule matching), with results emitted as structured JSON tagged with MITRE-style fields like Tactic_DefensiveEvasion and Technique_AntiDebugging.

flowchart LR
    A[Encrypted ZIP submitted] --> B[ScanEncryptedZip: dictionary crack]
    B --> C[Extracted file resubmitted to pipeline]
    C --> D[ScanPe: metadata]
    C --> E[ScanYara: rule matches + tags]
    D --> F[JSON output to SIEM]
    E --> F

Preconditions / Affected

Requires Docker/Docker Compose (and optionally Go, to build strelka-oneshot); documented and tested on Ubuntu 23.04. YARA rules must be supplied separately (the walkthrough clones Yara-Rules/rules.git) — Strelka ships no rules by default. The web UI is only available if the full container build is used (not the no-build compose file), and defaults to strelka/strelka credentials on localhost:9980.

What to do

Quick setup (Ubuntu):

sudo apt install -y wget git docker docker-compose golang jq
sudo usermod -aG docker $USER && newgrp docker
git clone https://github.com/target/strelka.git && cd strelka
rm configs/python/backend/yara/rules.yara
git clone https://github.com/Yara-Rules/rules.git configs/python/backend/yara/rules/
echo 'include "./rules/index.yar"' > configs/python/backend/yara/rules.yara
docker compose -f build/docker-compose.yaml build
docker compose -f build/docker-compose.yaml up -d
go build github.com/target/strelka/src/go/cmd/strelka-oneshot

Run a scan and pipe to jq:

./strelka-oneshot -f samples/<file>.zip -l - | jq

For SIEM alerting on the kind of evasive-malware pattern shown in the example, the page gives a concrete detection query:

scan.yara.tags:("Technique_AntiDebugging" && "SubTechnique_SEH")

For production use, precompile YARA rules and point Strelka's compiled config option at the compiled file to cut load time/resource usage with large rule sets.

Caveats

Strelka itself is not a detection engine — it only surfaces metadata/YARA matches; detection logic (like the SIEM query above) must be built on top of it. ZIP password cracking is dictionary-based, so it will not recover passwords outside the built-in wordlist.

Technologies named here

Techniques named here

  • Encrypted ZIP password cracking
  • Anti-Debugging via SEH
  • Nested/recursive file extraction and rescanning

Threat actors named here

Related in Blue Team & Detection