ShadowHunt

Inspired by cybersecurity talent shortages and DSOC's secure systems challenge, I built ShadowHunt a containerized red-team simulator with privacy-preserving detection. This framework turns a simple VM into a live ATT&CK lab, blending attack emulation, real-time alerts, and anonymized logging for ethical pentesting demos.

Inspiration

Real-world breaches like SolarWinds showed detection gaps, while hackathon limits demanded isolated sims. DSOC's privacy focus sparked the diffprivlib integration fuzz logs during attacks to prove compliant threat hunting. Drew from MITRE Caldera for emulation and Docker labs for rapid setup, but added evasion-hardening demos missing in existing tools.

What I Learned

• ATT&CK in action: T1003 credential dumps via Impacket trigger Suricata SMB sigs, but ML isolation forests catch stealthier lateral moves on syslogs.
• Privacy math: Differential privacy with (\epsilon = 1.0) adds Gaussian noise to metrics like connection counts, preserving heatmap utility: (\tilde{x} = x + \mathcal{N}(0, \sigma^2)) where (\sigma \propto \frac{1}{\epsilon}).
• Container isolation: Docker networks prevent breakout; Helm charts scale to K8s for cloud judges.

How I Built It

1. Day 1 - Sim Core: Docker Compose spun up victim (Ubuntu+Impacket-sim AD), attacker (Kali-lite), and airgapped network (--internal). Scripted T1078 brute-force and SecretsDump.
2. Day 2 - Detection + Privacy: Suricata IDS container with custom rules; scikit-learn anomaly model trained on baseline PCAPs. diffprivlib hashed PII pre-storage.
3. Day 3 - API/Dashboard: FastAPI /start_sim triggers attacks; Streamlit dashboard shows ATT&CK matrix heatmaps and evasion rates (80% → 20% post-patch).

Repo at https://github.com/elonmasai7/ShadowHunt includes full stack: docker-compose.yml, API, models, and README with GIF demo.

Challenges Faced

• Network Leaks: Sims escaped initial namespaces; fixed with unshare -n and --network none for true isolation.
• ML Tuning: 40% false positives on benign traffic; grid-searched hyperparameters, cutting FPR to 12% via cross-validation.
• Time Crunch: Metasploit flaked headless; pivoted to pure Impacket/Scapy (saved 6h). Slow Nakuru internet delayed pulls—added multi-arch manifests.
• Privacy Balance: High noise ((\epsilon < 0.5)) broke dashboards; settled on (\epsilon=1.0) after utility testing.

ShadowHunt proves iterative hardening works even evasion v1 fooled sigs, but v2 ML crushes it. Ready for DSOC judges: clone, run, watch attacks get caught live!

Built With

• docker
• python
• shell