Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.
Oriana was built using Python, the Django Web Framework, the Postgres database and Bootstrap. The Windows Event exporting script was written in PowerShell.
For more information on how Oriana works, visit the Wiki https://github.com/mvelazc0/Oriana/wiki
To see Oriana in action, check the demos https://github.com/mvelazc0/Oriana/wiki/Demos
Oriana was initially presented at Derbycon VII (https://www.youtube.com/watch?v=hVTkkkM9XDg) and released at the SANS Threat Hunting Summit (https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1536265369.pdf)
Download & install Python 2.7 https://www.python.org/downloads/
Download & install Postgres https://www.postgresql.org/download/windows/
sudo apt-get install postgresql postgresql-contrib
git clone https://github.com/mvelazc0/Oriana.git
pip install -r Oriana/requirements.txt
Oriana relies on a PowerShell script to export certain Windows events into CSV files. The files will be written to a network share specified on the source code (dont forget to change this !) that can then be loaded into the database for indexing and analysis. The script needs to run in the context of an Administrator and can be deployed in different ways:
- Using a software deployment platform like SSCM
- Command Execution through an agent
powershell.exe -File \\path\GetEvents.ps1
- Powershell Remoting
Invoke-Command -ComputerName PC1,PC2 -FilePath C:\path\GetEvents.ps1
python oriana.py -A createdb
python oriana.py -A startdb
createdb will ask for a Postgres username/password and will create a database as well as update the Django configuration files that allow it to connect to Postgres. Note: settings.py will contain the password in clear text.
startdb will initialize oriana's database schema.
python oriana.py -A load -d [path_to_logs]
The load action will read the CSV files located on the path and store all events in the database.
python oriana.py -A analytics
Analytics details can be found on the Wiki.
python oriana.py -A runserver
Oriana will run on port 8080 of the loopback interface http://127.0.0.1:8000
Happy Hunting !
- Mauricio Velazco - @mvelazco
- Andriy Noble - skrtu
This project is licensed under the BSD 3-Clause License - see the LICENSE file for details