ThreatStalker enables filtering at the MITRE Technique (point), Tactics (line), and Detection (surface) levels, allowing you to tailor your forensic and threat hunting analysis to your specific need.

• Vendor-independent Sigma rules play a crucial role in threat hunting and SOC operations, as they are widely used by many organizations. However, as mentioned in MITRE's Summiting the Pyramid, many detection rules can be easily evaded by attackers.
• Moreover, increasing detection coverage often leads to a surge in false positives, overwhelming analysts with excessive alerts. Addressing this trade-off is therefore of utmost importance.
• This project leverages MITRE’s knowledge to enable flexible selection and application of Sigma rules across multiple levels: technique-level (point), tactics-level (line), adversary-level (surface), and LoLBin-level, reflecting the recent trend of Living off the Land attacks.
• By doing so, even attacks that may evade a single detection rule can be identified when analyzed as part of a broader attack chain. Additionally, filtering based on specific needs helps to suppress false positives, ensuring a more effective detection process.

Clone the repository:

git clone https://github.com/YusukeJustinNakajima/ThreatStalker.git
cd ThreatStalker

Installing Dependencies:

pip install -r requirements.txt

Download Hayabusa Binary from https://github.com/Yamato-Security/hayabusa

python3 ThreatStalker.py --attackID t1190 --product windows

python3 ThreatStalker.py --tactics execution --product windows

python3 ThreatStalker.py --threat_actor_name APT37 --product windows

python3 ThreatStalker.py --lolbin --product windows

python3 ThreatStalker.py --threat_actor_name APT37 --product windows --use-hayabusa -d hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/

All filtered rules are placed within "chainrules" directory, organized by tactics.

• Robustness testing functionality for Sigma rules
• Integration of the Technique Inference Engine (TIE)
• Integration with other hunting tools (e.g., Chainsaw, Zircolite)
• Integration of functionality for converting Sigma rules to SIEM rules