mihari: framework for continuous OSINT based threat hunting

mihari

A query aggregator for OSINT based threat hunting.

Mihari can aggregate multiple searches across multiple services in a single rule & persist findings in a database.

How it works

• Mihari makes a query against Shodan, Censys, VirusTotal, SecurityTrails, etc., and extracts artifacts (IP addresses, domains, URLs, or hashes).
• Mihari checks whether the database (SQLite3, PostgreSQL, or MySQL) contains the artifacts or not.
  • If it doesn’t contain the artifacts:
    • Mihari saves artifacts in the database.
    • Mihari creates an alert on TheHive.
    • Mihari sends a notification to Slack.
    • Mihari creates an event on MISP.

Mihari supports the following services by default.

• BinaryEdge
• Censys
• CIRCL passive DNS / passive SSL
• crt.sh
• DN Pedia
• dnstwister
• Onyphe
• OTX
• PassiveTotal
• Pulsedive
• SecurityTrails
• Shodan
• Spyse
• urlscan.io
• VirusTotal
• ZoomEye

Example

Install & Use

Copyright (c) 2019 Manabu Niseki