# Strelka extracts a file and everything hidden inside it

> Strelka is a real-time, container-based file scanning system for threat hunting, threat detection and incident response, descended from Lockheed Martin's Laika BOSS design. It has a Go core and a Python 3.10 or later worker, ships native client applications for Windows, Mac and Linux, and works by running a file through a pipeline of scanners, where each scanner can hand an extracted file back into the pipeline so that a password protected archive becomes an executable with YARA matches attached.

**target/strelka** — Real-time, container-based file scanning at enterprise scale

- Repository: https://github.com/target/strelka
- Stars: 1,004 · Forks: 144
- Language: Python
- License: NOASSERTION
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/target-strelka

## File scanning built for a queue, not for a person

Strelka is a real-time, container-based file scanning system used for threat hunting, threat detection and incident response, and its purpose is to perform file extraction and metadata collection at enterprise scale. The scale is the point. A human opening a file to look at it is a process that does not scale, and a system that receives a file from a mail gateway, a proxy or an endpoint agent and returns structured metadata about what is inside it does. The README describes it as a modular data scanning platform where users or systems submit files for the purpose of analyzing, extracting and reporting file content and metadata, and it is coupled with a SIEM so that the platform can aggregate, alert and give an analyst the picture without the analyst doing the data gathering. The audience is a detection engineering team, and the design assumption is that the interesting file is one that is several layers deep.

## The lineage, and the four ways it differs

Strelka was originally based on the design established by Lockheed Martin's Laika BOSS and similar projects, and the README lists the ways it differs from its siblings. The core codebase is Go and Python 3.10 or later. The server components run in containers for ease and flexibility of deployment. There are OS-native client applications for Windows, Mac and Linux. And it is built using libraries and formats that allow cross-platform, cross-language support. That last point is the one with the longest reach, because it means a scanner written in one language can be reused wherever the platform runs, and it is why the repository is a Go module and a Poetry project at the same time. The Go side carries the Kafka client, gRPC, Redis, fsnotify for watching and a MIME type detector, and the Python side is the worker, and the two talk over the queue.

## The pipeline, and why a scanner can send a file back

The mechanism that makes Strelka interesting is in the quickstart, where the README walks through what happens to an encrypted ZIP. Strelka determined that the submitted file was an encrypted ZIP, using taste.yara and backend.yaml. The ScanEncryptedZip scanner used a dictionary to crack the ZIP file password and extract the compressed file. The extracted file was then sent back into the Strelka pipeline by the scanner, and Strelka determined that the extracted file was an EXE. The ScanPe scanner dissected the EXE and added metadata to the output, and ScanYara analysed it with the provided rules and added numerous matches, some indicating the file might be malicious. So a scanner is not a filter, it is a participant in the pipeline, and the file it produces is analysed again. That is why the output has a depth field, and why the first result is a depth 0 ZIP and the second is a depth 1 executable.

## Running the quickstart

The quickstart is written for a one-off analysis, and the documentation warns that the real deployment instructions are elsewhere. The prerequisites are installed first, and the step is written for Ubuntu 23.04:

```bash
sudo apt install -y wget git docker docker-compose golang jq && \
sudo usermod -aG docker $USER && \
newgrp docker
```

Then the repository is cloned, and the YARA rules are optional and downloaded separately, because the rules are the part you are most likely to want to replace with your own:

```bash
rm configs/python/backend/yara/rules.yara && \
git clone https://github.com/Yara-Rules/rules.git configs/python/backend/yara/rules/ && \
echo 'include "./rules/index.yar"' > configs/python/backend/yara/rules.yara
```

The service is then started with docker compose, either pulling precompiled images or building them, and the oneshot client is compiled with go build for the one-off path:

```bash
docker compose -f build/docker-compose-no-build.yaml up -d && \
go build github.com/target/strelka/src/go/cmd/strelka-oneshot
```

A sample is fetched, and the scan is run with the oneshot client, which prints JSON to stdout for jq to read:

```bash
wget https://github.com/ytisf/theZoo/raw/master/malware/Binaries/Win32.Emotet/Win32.Emotet.zip -P samples/
./strelka-oneshot -f samples/Win32.Emotet.zip -l - | jq
```

The UI is at http://0.0.0.0:9980 if you would rather not use the command line at all.

## The output is a structured record, not a verdict

The JSON output is worth reading because it shows the design. Each result has a file section with the depth, the flavors it was identified as, the list of scanners that ran against it and its name, and a scan section holding the per-scanner results. The first document, the encrypted ZIP, has flavors of mime application/zip and yara encrypted_zip and zip_file, and its scan section reports the cracked_password and the elapsed time and the totals of extracted and files. The second, the extracted executable, has flavors of mime application/x-dosexec and yara mz_file, and its scan section holds the PE details, with the entry point address, the base of code and data, the checksum, the compile time, the file alignment, the file info with the company name, the description, the version and the original filename, and the yara section with the matches, including names such as SEH__vba, IsPE32, HasOverlay and several Visual Basic 50 rules, and the tags such as AntiDebug, SEH and the ATT&CK identifiers for defensive evasion. The platform reports what it found and lets the detection rules elsewhere decide what it means, which is the correct division of labour for a scanning system.

## The dependency list is a description of the file formats

The Python worker's dependency list is a catalogue of the file types the platform understands. For executables there is pefile, lief, dnfile, dotnetfile and signify for signed binaries, oletools and olefile for Office documents, and dncil and construct for .NET intermediate structures. For archives and containers there is pyzipper, pycdlib, rarfile, rpmfile, libarchive-c and tnefparse for transport and mail formats. For documents there is python-docx, openpyxl, xlrd and xlrd2, formulas, pyxlsb2 and PyMuPDF. For images there is opencv-python, pillow-heif and pillow-avif-plugin, and for text extraction pytesseract and pyzbar. The media and hashing work is py-tlsh and python-magic. And the platform itself is wired for operation with redis, boto3 for object storage, yara-python, and the OpenTelemetry API, SDK and OTLP exporters. Reading that list tells you the coverage of the scanning pipeline more accurately than any feature list would.

## Enterprise deployment, and the licence to read first

Two things deserve attention before an evaluation. The first is the deployment, because the quickstart is explicitly a demonstration and the README asks you to review the documentation for details on how to properly build and deploy Strelka in an enterprise environment, and the deploy directory and the docker-compose files are the beginning of that rather than the whole of it. The second is the licence, because the repository carries a LICENSE file and two notice files, NOTICE and NOTICE2, which is the pattern of a codebase assembled from several sources with different terms, and the people who need to check it are the ones who will not enjoy the reading. The project is maintained by people at Target, with the Python worker package described as Strelka's backend Python worker, the releases are v1.0.0 from 2025-04-09, 1.0.1 in October 2025 and v1.0.2 in August 2026, and the last push was on 2026-10-10, so the code is moving even though the version line has only just passed one.

## Conclusion

Strelka is the right tool if your threat hunting depends on looking inside files rather than at their names, because the recursive extraction is the feature, and a password protected archive that gets unpacked and then scanned for YARA matches is something most pipelines never do. It is the wrong tool for a single analyst on a laptop who wants to look at one document, since the deployment is a set of containers and a queue, and it is the wrong tool if your licence review cannot accommodate a custom licence with a NOTICE file and a second notice. Before you deploy it, read the documentation on enterprise deployment rather than the quickstart, and decide your YARA rule set first, since the rules are what the output is worth.

## FAQ

### What is Strelka and what is it for?

It is a real-time, container-based file scanning system for threat hunting, threat detection and incident response, performing file extraction and metadata collection at enterprise scale. It is coupled with a SIEM so the platform can aggregate and alert on the results.

### How does Strelka handle a file inside an archive?

A scanner can hand an extracted file back into the pipeline. In the README example, ScanEncryptedZip cracks the ZIP password with a dictionary and extracts the file, the extracted file is sent back into Strelka, which identifies it as an EXE, and then ScanPe and ScanYara dissect it and add matches. That is why the output carries a depth field.

### Which file types can Strelka analyse?

The Python worker dependencies describe the coverage: pefile, lief, dnfile and signify for executables, oletools and olefile for Office documents, pyzipper, pycdlib, rarfile, rpmfile, libarchive-c and tnefparse for archives, python-docx, openpyxl, xlrd and PyMuPDF for documents, opencv and the pillow plugins for images, and pytesseract and pyzbar for text extraction, with YARA rules applied by yara-python.

### What is the quickstart in the Strelka README?

A one-off analysis on Ubuntu 23.04. You install the prerequisites, clone the repository, optionally download YARA rules, start the service with docker compose and build the strelka-oneshot client with go build, then run ./strelka-oneshot -f samples/Win32.Emotet.zip -l - | jq. The UI is at http://0.0.0.0:9980.

## Sources

- [Issues](https://github.com/target/strelka/issues)
- [README](https://github.com/target/strelka/blob/master/README.md)
- [Releases](https://github.com/target/strelka/releases)
- [target/strelka on GitHub](https://github.com/target/strelka)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/target-strelka