mihari v4.7.2 releases: framework for continuous OSINT based threat hunting

mihari

Mihari is a helper to run queries & manage results continuously. Mihari can be used for C2, landing pages, and phishing hunting.

How it works

• Mihari makes a query against Shodan, Censys, VirusTotal, SecurityTrails, etc., and extracts artifacts (IP addresses, domains, URLs, or hashes).
• Mihari checks whether the database (SQLite3, PostgreSQL, or MySQL) contains the artifacts or not.
  • If it doesn’t contain the artifacts:
    • Mihari saves artifacts in the database.
    • Mihari creates an alert on TheHive.
    • Mihari sends a notification to Slack.
    • Mihari creates an event on MISP.

Mihari supports the following services by default.

• BinaryEdge
• Censys
• CIRCL passive DNS / passive SSL
• crt.sh
• DN Pedia
• dnstwister
• Onyphe
• OTX
• PassiveTotal
• Pulsedive
• SecurityTrails
• Shodan
• Spyse
• urlscan.io
• VirusTotal
• ZoomEye

Example

Changelog v4.7.2

• Add YAMLSyntaxError class to handle YAML syntax related error (#498)
• Remove Mixins::Rule (#496)
• Group search filters in Structs::Filters (#496)
• Fix NoMethodError while enriching ports (#493)
• Fix IPInfo enrichment issue (#492)

Install & Use

Copyright (c) 2019 Manabu Niseki