maltrail

by stamparm

8.1Kstars

1.2Kforks

236watchers

Updated 3 months ago

About

Maltrail is a malicious traffic detection system that leverages public blacklists and heuristic analysis to identify suspicious network activity.

Malicious traffic detection system

Primary Use Case

Maltrail is primarily used by network administrators and security professionals to monitor network traffic for signs of intrusion, malware communication, and other malicious activities. It helps in real-time detection and alerting of suspicious domains, IPs, URLs, and user-agent strings, facilitating proactive threat hunting and network security enforcement.

Key Features

Utilizes numerous public blacklists and custom user-defined lists for threat detection
Supports detection of malicious domains, IP addresses, URLs, and HTTP User-Agent headers
Includes advanced heuristic mechanisms to identify unknown threats
Provides a web-based reporting interface for monitoring and analysis
Detects a wide range of suspicious activities including mass scans, port scanning, and data leakage
Manually curated static trails from AV reports and personal research
Supports real-life case detection such as ransomware, malware C&Cs, and anonymous attackers
Open-source with MIT license and supports Python 2.6/2.7 and 3.x

Installation

Clone the repository: git clone https://github.com/stamparm/maltrail.git
Navigate to the maltrail directory
Install required dependencies (Python environment recommended)
Run the sensor component to start monitoring network traffic
Run the server component to enable the web-based reporting interface

Usage

>_ python sensor.py

Starts the sensor to capture and analyze network traffic for malicious trails

>_ python server.py

Starts the server to provide the web-based reporting interface

Security Frameworks

Reconnaissance

Discovery

Collection

Command and Control

Exfiltration

Usage Insights

Integrate Maltrail alerts with SIEM platforms for centralized incident correlation and faster response.
Use Maltrail's heuristic detection to identify zero-day or unknown threats during red team exercises.
Leverage Maltrail's blacklist feeds to automate network access blocking for suspicious IPs and domains.
Deploy sensors at network choke points to maximize visibility of lateral movement and data exfiltration attempts.
Combine Maltrail with endpoint detection tools to enrich threat hunting and forensic investigations.