Visualizing File Analysis with the Strelka UI

October 11, 2024

Headshot of Paul Hutelmyer
Paul Hutelmyer

Principal Engineer, Cyber Defense

In today's threat landscape, security professionals are bombarded with complex files that demand deep understanding. Strelka, a powerful file analysis framework developed by Target, empowers analysts to dissect and investigate hundreds of millions of files daily across networks and endpoints. While Strelka's raw output offers invaluable details in JSON format, efficiently grasping key relationships and visualizing intricate file structures can be challenging. 
 
Enter the Strelka UI, an open-source tool conceived at Target to bridge this gap. It provides a user-friendly interface specifically designed to visualize files, their characteristics, and how they interconnect. This blog post delves into the Strelka UI, exploring its features, practical applications, and its pivotal role in streamlining file analysis for enhanced threat detection. 
Dashboard for the Strelka UI
Transforming Raw Data into Insights
 
To fully appreciate the utility of the Strelka UI, let us examine a file that has numerous child elements and a substantial amount of output data. In the example below, Strelka churned through a sample file, dissecting it, and providing us with a JSON formatted output that, while comprehensive, can be overwhelming due to the sheer volume and depth of the data.
Snippet of Strelka’s JSON Response
With the Strelka UI however, that same information is presented to analysts in an accessible format, extracting highlights and providing a visual view into the relationships between the submitted file, and files hidden within. The Strelka UI takes the extensive JSON output and parses it into a clear, manageable display, emphasizing key findings and illustrating the connections between the submitted file and its embedded components. Analysts can closely examine these relationships, as well as the extracted file metadata and scan results, through a straightforward interface. This design allows for rapid identification and analysis of nested files and their attributes, streamlining the process of determining potential security threats or investigating the file's contents. The UI effectively surfaces the most pertinent information, reducing the time required to analyze complex file systems and enhancing the accuracy of the analysis.
File Analysis in the Strelka UI
Understanding Key Features of the Strelka UI
 
To streamline file analysis, the Strelka UI offers an array of powerful features:
 
  • Interactive Visualizations: A graphical representation of file relationships and structures enables users to quickly comprehend complex connections.
  • File Content Exploration: Drill-down functionality allows users to inspect the contents of a file without the need for additional tools.
  • Relationship Mapping: Users can see how files relate to one another, highlighting dependencies and potential propagation paths for malware.
  • Highlighting of Suspicious Indicators: The UI automatically flags potential security concerns, drawing attention to critical areas for expedited investigation.
 
Each feature serves real-world scenarios, from cybersecurity incident response to compliance auditing, ensuring that Strelka UI is versatile across multiple domains.
 
Strelka UI Highlights
 
Let’s look at three different scenarios in which the Strelka UI can assist in visualizing file analysis.
 
File Archive Extraction
 
Compressed files can present a challenge in understanding their content without extraction. Strelka simplifies this by automatically extracting and listing all the contents of an archive, providing a clear view of the files contained within. Moreover, Strelka’s capabilities extend to dealing with encrypted files: It can either attempt to brute force password decryption or use a provided list of known passwords to unlock and extract these files.
ZIP File Analysis in the Strelka UI
In the above example scenario, we see a zip file that has been submitted to Strelka for analysis. The UI clearly displays each file extracted from the archive, along with their file types and any highlights that indicate their relationship to the parent file. Additionally, integration with external tools like VirusTotal can provide immediate insights into the safety of each file, flagging any malicious content within the archive.
 
Optical Character Recognition and Image Analysis
 
Strelka also can provide context and details pertaining to images. This can be useful in examining documents and images sourced from emails or phishing attempts. It is equipped to analyze images within documents to extract and render text visible, which can be used in searching and detecting known patterns in phishing. The Strelka UI provides analysts with preview thumbnails via a hover-over action on the “Camera” icon, or by inspecting details in the “Optical Character Recognition” section.
PDF File Analysis in the Strelka UI
In the above example, we observe how Strelka successfully extracted textual content from a PDF file and displays images of the content. The UI shows a thumbnail of the PDF, making any embedded images directly viewable. Strelka's analysis does not stop there; it extracts text from these images as well as metadata, pinpointing suspicious domains, IP addresses, or other Indicators of Compromise (IoCs) that signal potential threats.
PDF File Analysis Showing Extracted IoCs in the Strelka UI
Script Analysis
 
Strelka can also analyze web content such as HTML pages, where it can dissect and extract scripts, uncovering the underlying functions, operators, and structural elements. The following is a view into an HTML file and the scripts observed from that file.
HTML File Analysis in the Strelka UI
In the above HTML analysis, Strelka deconstructed the webpage to reveal any embedded scripts. The extracted data, including functions and operators, is displayed, providing a comprehensive view of the script's components. Although VirusTotal may flag the content as malicious, the dissection performed by Strelka offers additional confirmation of the content's suspicious nature. Like the OCR example, we can see that Strelka has also extracted an IoC from the webpage. This IoC, which could be a suspicious domain or script source, serves as an additional data point for file disposition.
HTML File Analysis Showing Extracted Script Objects and IoCs in the Strelka UI
Contact, Feedback, and Assistance
 
As cyber threats evolve in complexity, tools like Strelka UI are essential for empowering security professionals to keep pace. In today's landscape, simply possessing data is not enough. The ability to swiftly understand and derive insights from it is crucial. Strelka UI facilitates this understanding, enabling analysts to visualize complex file structures and expose potential threats. This streamlined analysis promotes efficient decision-making and a rapid response to security incidents.
 
Strelka UI demonstrates the strength of open-source collaboration and a commitment to advancing cybersecurity solutions. By releasing this tool, Target aims to assist the broader community in building a strong defensive posture.
 
If you are interested in utilizing Strelka UI, you can find it along with the Strelka platform on GitHub. If you have any questions, concerns, or feedback, we encourage you to explore its capabilities and share your feedback in the Strelka UI repository.

RELATED POSTS

Strelka: Real-Time Threat Hunting Scanner

By Paul Hutelmyer, August 24, 2022
Strelka is a real-time, container-based, file scanning system used for threat hunting, threat detection, and incident response, built by our Target cybersecurity team.

Boost Detection Confidence: Lessons from Target's Rule Management Strategy

By Paul Hutelmyer, October 7, 2024
Strategies on how to manage rulesets to achieve a more confident security posture.