Phishix - Email Threat Hunting & Analysis Platform

Advanced email analysis platform for threat hunting operations, focusing on DKIM/DMARC verification, malware detection, and forensic analysis.

Features

• Email Parsing: Complete .eml file parser with support for headers, body, HTML, and Base64-encoded attachments
• DKIM/DMARC Verification: Extract and validate email authentication signatures
• Fingerprinting: Generate cryptographic hashes (SHA256) and unique fingerprints for emails
• YARA Integration: Pattern matching and regex-based threat detection
• Threat Database: Secure database for storing threat signatures and samples
• Artemis Integration: Built on top of POLSKA CERT's Artemis framework
• Karton Pipeline: Distributed task processing for scalable analysis
• Modular Hooks: Event-driven architecture for automation and custom workflows

Architecture

phishix/
├── src/phishix/
│   ├── api/              # REST API (FastAPI)
│   ├── parsers/          # Email parsing (EML, DKIM, DMARC)
│   ├── analysis/         # Fingerprinting, hashing, YARA
│   ├── database/         # Threat database layer
│   ├── integrations/     # Artemis/Karton integration
│   └── hooks/            # Event hooks and automation
├── tests/                # Test suite with safe email samples
├── yara_rules/           # YARA detection rules
└── config/               # Configuration files

Security Considerations

• Designed for isolated VM analysis (use flake.nix for NixOS deployment)
• All samples are stored securely with hash verification
• YARA rules for malware detection
• Sandboxed execution environment

Quick Start

Using Nix Flakes (Recommended)

# Enter development environment
nix develop

# Run tests with safe emails
pytest tests/

# Start API server
python -m phishix.api.main

Manual Setup

# Install dependencies
pip install -e .

# Initialize database
python -m phishix.database.operations init

# Run API
uvicorn phishix.api.main:app --reload

Testing

Initial testing uses safe, benign email samples. For malware analysis:

1. Clone repository to isolated VM
2. Use flake.nix for reproducible environment
3. Never test on production systems

Integration with Artemis

Phishix integrates with Artemis for comprehensive malware analysis:

• Karton-based task distribution
• Shared threat intelligence
• Automated sample submission

License

MIT License - See LICENSE file

Warning

This tool is designed for security research and authorized threat hunting operations only. Always obtain proper authorization before analyzing email systems.