Adversary Infrastructure Tracking with Mihari
Manabu Niseki presents Mihari, an open-source framework that queries multiple threat intelligence search engines to continuously track adversary C2 infrastructure.
Summary
Manabu Niseki introduces "Mihari," an open-source framework designed for threat intelligence analysts to track and alert on malicious adversary infrastructure across multiple threat intelligence search engines.
[04:45] Niseki discusses the practical challenges of threat hunting, pointing out that continuously querying multiple individual search platforms manually is tedious and time-consuming. He explains how passive infrastructure tracking allows defenders to identify adversary Command and Control (C2) servers, phishing websites, and staging hosts before attacks are launched against internal assets.
[09:58] The presentation demonstrates how Mihari queries a wide variety of search engines—including Shodan, Censys, VirusTotal, SecurityTrails, BinaryEdge, and URLScan—using unified YAML rule definitions. Niseki shows how Mihari normalizes search results, deduplicates indicators of compromise (IOCs) across multiple feeds, and delivers automated alerts via webhooks, Slack, or Discord. He highlights practical use cases [15:29], such as monitoring bulletproof hosting providers and tracking active phishing domains targeting specific brands.
(AI summary — Gemini Flash)
Related talks
Village Presentations·52 min
Grecs
Security analyst Grecs shows how to build an agile, cost-effective threat intelligence repository using Evernote and curated open-source indicators.
Recon Village·29 min
Ladislav Baco
Ladislav Baco demonstrates how independent threat researchers can discover nation-state APT campaigns through proactive telemetry hunting and pivoting.
Red Team Village·46 min
Apurv Gautam
Apurv Gautam demonstrates building automated crawlers and threat intelligence collectors to monitor Tor darknet markets and paste sites for leaked corporate data.