Strelka on Ubuntu 24.04 LTS

Overview

Strelka is a container based file scanning system built by Target's security team for threat hunting, threat detection and incident response. Files are submitted to a Go frontend over gRPC, distributed through a coordinator to Python backend workers, and scanned by a library of specialised scanners. Its distinguishing behaviour is recursive decomposition: when a scanner extracts children from a container format, an archive, an installer, an email attachment, an embedded object in a document, each child is resubmitted and scanned in its own right, so a threat buried several layers inside a file is surfaced rather than hidden by its wrapper. Every scan returns structured JSON rather than a verdict, one event per file at every depth, carrying hashes, file type, entropy, metadata and YARA matches. That output is designed to be shipped into a SIEM or data lake and queried, so analysts can hunt across a corpus of files instead of triaging one at a time.

This image runs the full single node topology, a frontend, a coordinator, a manager, a scanning backend, an event cache and a PostgreSQL backed web interface for submitting files and browsing results. It suits detection engineers building and testing YARA rules against real samples, incident responders decomposing suspicious attachments, and security teams that want a self hosted analysis pipeline running inside their own subscription rather than uploading evidence to a third party.

Common uses

• Recursively decompose suspicious archives and attachments during incident response
• Test and tune YARA rules against real samples at scale
• Feed structured file scan events into a SIEM for threat hunting