Network forensics for the encrypted traffic era.
Shrike is a Python network forensics tool that detects threats in PCAP files without reading encrypted payloads. It uses behavioral analysis, flow statistics, and timing patterns to identify C2 beaconing, port scans, data exfiltration, DNS tunneling, lateral movement, and more — mapping every finding to MITRE ATT&CK.
Named after the shrike — a predatory bird that impales its prey on thorns. Shrike impales threats on evidence.
git clone https://github.com/fevra-dev/Shrike.git
cd Shrike
pip install -e .
# Analyze a PCAP
shrike analyze capture.pcap
# Generate an interactive HTML report
shrike analyze capture.pcap -o report.html
# JSON output
shrike analyze capture.pcap --json-out -o results.json| Detection Module | Technique | MITRE ATT&CK |
|---|---|---|
| C2 Beaconing | Inter-arrival time regularity, coefficient of variation analysis | T1071.001, T1573 |
| Port Scanning | SYN/NULL/XMAS scan detection via unique port enumeration | T1046 |
| Data Exfiltration | Upload/download ratio anomaly, volume thresholds | T1048 |
| DNS Tunneling | Entropy scoring, subdomain length, query frequency | T1071.004 |
| HTTP/2 C2 | SETTINGS frame analysis, ping-based covert channels | T1071.001 |
| NTLM Relay | LLMNR poisoning, SMB relay chain detection | T1557.001 |
| Kerberoasting | SPN request anomalies, AS-REP roasting patterns | T1558 |
| Cloud C2 | Slack/Teams/DevTunnels webhook abuse detection | T1102.002 |
| IPv6 Attacks | Rogue RA, NA poisoning, SLAAC abuse | T1557.001 |
| OT/ICS Attacks | Modbus write coils, DNP3 control relay, OT scanning | T0855, T0846 |
| WebSocket C2 | Persistent WebSocket channels with C2 patterns | T1071.001 |
| mTLS C2 | Sliver/Mythic mutual TLS fingerprinting | T1573.002 |
| DNS Rebinding | TTL anomaly, IP flip detection | T1557 |
| QUIC/HTTP3 C2 | Transport parameter fingerprinting, ALPN analysis | T1095 |
| Supply Chain | Package manager traffic deviation (npm/pip/cargo) | T1195.002 |
| DGA Detection | Character n-gram perplexity, LLM-generated domain scoring | T1568.002 |
| WASM Malware | WebAssembly binary detection in HTTP traffic | T1059 |
| MCP Traffic | Model Context Protocol anomaly detection | T1071.001 |
| Timing Channels | ISN covert channels, inter-packet timing analysis | T1205 |
| CT Log Correlation | Newly-issued certificate age anomaly | T1587.003 |
| Tor Exit Detection | Live consensus verification of exit relays | T1090.003 |
PCAP File
│
▼
┌────────────────────────────────┐
│ PCAP Parser │
│ Scapy (primary) + dpkt │
│ Normalized packet dicts │
└──────────────┬─────────────────┘
│
▼
┌────────────────────────────────┐
│ Flow Builder │
│ Bidirectional 5-tuple flows │
│ Forward/reverse tracking │
│ Payload + timestamp capture │
└──────────────┬─────────────────┘
│
▼
┌────────────────────────────────┐
│ Detection Registry │
│ │
│ 25+ detection modules │
│ Per-packet + per-flow analysis│
│ BaseDetector interface │
└──────────────┬─────────────────┘
│
▼
┌────────────────────────────────┐
│ Output │
│ Interactive HTML dashboard │
│ JSON report · CLI summary │
│ MITRE ATT&CK mapping │
│ SARIF (CI/CD integration) │
└────────────────────────────────┘
The --output report.html flag generates a self-contained interactive dashboard with 26 analysis tabs:
- Summary — Severity breakdown, key metrics, attack chain visualization
- Findings — All detections with evidence, filterable by severity
- Timeline — Chronological attack reconstruction
- MITRE ATT&CK — Technique heatmap with hit counts
- Network Graph — D3 force-directed host communication map
- Protocols — Traffic distribution with Chart.js visualization
- Fingerprints — JA3/JA4/JARM/HASSH/QUIC transport parameter table
- DNS — Entropy scoring, DGA analysis, tunnel detection
- Beaconing — Interval analysis charts, CV scoring
- IOCs — Indicators of compromise with enrichment data
- CVE Intelligence — Matched CVE signatures with CISA KEV status
- eBPF Attribution — Process-to-flow mapping (when available)
- And more: OT/ICS, Cloud C2, WebSocket, QUIC, IPv6, Kubernetes...
Shrike/
├── shrike/
│ ├── __init__.py
│ ├── cli.py # Click CLI entry point
│ ├── engine.py # Analysis orchestrator
│ ├── models.py # Finding, FlowRecord, Severity
│ ├── core/
│ │ ├── parser.py # PCAP parsing (Scapy + dpkt)
│ │ ├── flow_builder.py # Bidirectional flow aggregation
│ │ └── zeek_navigator.py # Zeek log ingestion + ATT&CK Navigator
│ ├── detection/
│ │ ├── base.py # BaseDetector abstract class
│ │ ├── registry.py # Detector fan-out + error isolation
│ │ ├── adapters.py # Built-in: port scan, exfil, beaconing
│ │ ├── http2_c2.py # HTTP/2 covert channel detection
│ │ ├── dns_rebinding.py # DNS rebinding attack detection
│ │ ├── ntlm_relay.py # NTLM relay + LLMNR poisoning
│ │ ├── cloud_c2.py # Cloud platform C2 detection
│ │ ├── ot_attacks.py # OT/ICS protocol attack detection
│ │ ├── k8s_attacks.py # Kubernetes attack detection
│ │ ├── websocket_c2.py # WebSocket C2 detection
│ │ ├── mtls_c2.py # Mutual TLS C2 fingerprinting
│ │ ├── ipv6_attacks.py # IPv6 attack detection
│ │ ├── quic_alpn.py # QUIC/HTTP3 C2 detection
│ │ ├── mcp_traffic.py # MCP protocol anomaly detection
│ │ ├── wasm_detector.py # WebAssembly malware detection
│ │ ├── timing_firmware.py # Timing channel + firmware analysis
│ │ └── ... # 25+ total detection modules
│ ├── ml/
│ │ ├── anomaly.py # IsolationForest flow anomaly
│ │ ├── clustering.py # HDBSCAN flow clustering
│ │ ├── dga_detector.py # DGA + LLM-DGA scoring
│ │ └── injection_scorer.py # LLM prompt injection classifier
│ ├── enrichment/
│ │ ├── ct_logs.py # Certificate Transparency correlation
│ │ └── tor_consensus.py # Tor exit relay verification
│ ├── mitre/
│ │ └── mapper.py # ATT&CK technique lookup + enrichment
│ ├── reporting/
│ │ ├── html_reporter.py # Jinja2 interactive HTML dashboard
│ │ └── sarif_reporter.py # SARIF 2.1.0 output
│ ├── templates/
│ │ └── report.html # 26-tab HTML report template
│ ├── cve/
│ │ └── sync.py # CVE database sync
│ ├── ebpf/
│ │ └── attribution.py # eBPF process-to-flow attribution
│ └── fingerprinting/
│ └── quic_tp.py # QUIC transport parameter fingerprinting
├── tests/
│ ├── test_models.py # Data model unit tests
│ ├── test_parser.py # PCAP parser tests
│ ├── test_flow_builder.py # Flow aggregation tests
│ ├── test_registry.py # Detection registry tests
│ ├── test_adapters.py # Detector adapter tests
│ ├── test_engine.py # Engine integration test
│ ├── test_cli.py # CLI end-to-end tests
│ ├── test_html_reporter.py # HTML report generation test
│ ├── test_mitre_mapper.py # MITRE mapper tests
│ └── test_integration.py # Full pipeline integration tests
├── pyproject.toml
└── README.md
# Install in development mode
pip install -e .
# Run tests
pytest tests/ -v
# Run a specific test
pytest tests/test_engine.py::test_engine_detects_port_scan -v- Create a new class extending
BaseDetectorinshrike/detection/ - Implement
analyze_flow(flow: FlowRecord) -> list[Finding] - Optionally implement
analyze_packet()andfinalize() - Register in
shrike/detection/adapters.py→get_all_detectors()
from shrike.detection.base import BaseDetector
from shrike.models import Finding, Severity, FlowRecord
class MyDetector(BaseDetector):
name = "my_detector"
description = "Detects something suspicious"
mitre_ids = ["T1234"]
def analyze_flow(self, flow: FlowRecord) -> list[Finding]:
if some_condition(flow):
return [Finding(
detector=self.name,
finding_type="SUSPICIOUS_THING",
severity=Severity.HIGH,
src_ip=flow.src_ip,
dst_ip=flow.dst_ip,
...
)]
return []Fevra — Security Developer
MIT License — see LICENSE for details.
MITRE ATT&CK is a registered trademark of The MITRE Corporation.