HADES
Hidden Artifact Detection & EXIF Scanner - Enterprise Metadata Forensics Engine
PRODUCTION-READY | v1.7.1 GA
Court-ready metadata forensics for security teams, incident responders, and SOC operations. Zero-execution analysis, never runs target files.
Measured 2026-09-13 on engine source at commit de6bf83f (v1.7.1 plus unreleased detection changes), with threat intelligence enabled. Malware sample composition: MalwareBazaar 3,269 (99.72% detection) · Contagio 11,877 (99.98%) · targeted Gootloader 10 (100%). Overall malware detection: 99.93% across 15,156 samples, 10 undetected, 1 timeout. A 4,726-file clean corpus was scanned the same day: 1 CRITICAL, 396 HIGH. That corpus is assembled for machine-learning training and deliberately includes known-false-positive categories, so its 8.40% HIGH-or-CRITICAL share is not a false-positive rate over a typical customer file mix. Figures measured on engine source, not on a release binary.
HADES is an enterprise metadata forensics engine built for security teams and incident responders. Measured 2026-09-13 on engine source at commit de6bf83f (v1.7.1 plus unreleased detection changes) across 15,156 malware samples: 99.72% detection on MalwareBazaar (3,269), 99.98% on Contagio (11,877), 100% on the targeted Gootloader set (10 files), and 99.93% overall, with 10 samples undetected and 1 timeout. A separate 4,726-file clean corpus scanned the same day returned 1 CRITICAL and 396 HIGH; that corpus is built for machine-learning training and deliberately includes known-false-positive categories, so its 8.40% HIGH-or-CRITICAL share is not a false-positive rate over a typical customer file mix. Figures measured on engine source, not on a release binary. Multi-layer detection combines 144 YARA detection rules across 55 rule files, ML ensemble models, behavioral analysis, 20 dedicated forensic analyzer modules, and deep format parsing, without executing target files. Two-axis scoring (confidence × severity), with court-ready evidence handling and automated response playbooks.
Get Started
HADES v1.7.1 is available now via two install paths. Buy a license at the customer portal or try the live demo in your browser first.
- No Python runtime needed, the binary is Nuitka-compiled with all dependencies bundled inline. ExifTool is optional for scanning (a native fallback ships in the binary) and recommended for the metadata sanitizer.
- Linux x86_64 and Windows x86_64 available today; Windows binaries are Authenticode-signed and RFC3161-timestamped. macOS is not yet available and has no release date.
- License required, Pro+ tier unlocks YARA, ML, deep format analysis; community tier (no license) runs heuristics + IOC only
Capabilities
Metadata Forensics & Deep Format Analysis
Core scanning engine, extracts metadata and runs 20 dedicated forensic analyzer modules. Deep-parses PDF (shadow attacks, filter chains), Office (macros, DDE, VBA stomping, hidden content), RTF (Equation Editor, template injection), archive structures (Zombie ZIP, RAR5/7z), and analyzes audio, video, email, and web file metadata for embedded threats.
Detection Layers:
- 20 forensic analyzer modules, including PDF, Office/OLE, RTF, OneNote, LNK, MSI, PE, JAR/APK, fonts, firmware, scripts, email, HTML, CSV, EPS, TIFF, steganography
- Archive forensics: Zombie ZIP, concatenation, bombs, RAR5/7z headers
- Document forensics: RTF, LNK, legacy Office, OneNote, VBA stomping
- Audio/video: MP3 ID3, WAV, OGG, FLAC, MKV, MP4, AVI metadata
- Email/web: phishing detection, CSV formula injection, HTML threats, EPS
- Steganography: JPEG DCT analysis, palette stego, EOF data, tool signatures
- 144 YARA detection rules across 55 rule files + firmware analysis (UEFI, SPI flash, BadUSB, wipers)
ML Ensemble & Behavioral Analysis
Multi-model machine learning ensemble (Isolation Forest + Random Forest + optional XGBoost) with 25 statistical features including Shannon entropy statistics. Behavioral engine detects coordinated attack campaigns through IOC correlation and metadata pattern similarity.
Analysis Capabilities:
- Weighted multi-model voting with labeled data management
- Campaign detection via shared IOC correlation (union-find)
- Metadata similarity scoring (Jaccard) and temporal clustering
- GPS forensics with impossible travel detection
- Auto-retraining on labeled datasets with CSV import/export
MITRE ATT&CK Mapping
Automatic mapping of detection findings to 51 MITRE ATT&CK techniques across 14 tactics. Every finding is classified with technique IDs, tactic categories, and severity scores, ready for compliance reporting and threat intelligence correlation.
Coverage:
- 51 techniques: script injection, backdoors, steganography, polyglot, macros, encoding
- 14 tactics, from Reconnaissance through Impact
- 83 finding types mapped to techniques
- API endpoint for technique lookup and tactic queries
Evidence Chain & Case Management
Forensic-grade evidence handling, SHA-256 hash-chained immutable audit log, case management with analyst notes, and self-verifying evidence export packages with HMAC-SHA256 signatures. Built for court-admissible forensics.
Forensic Features:
- Append-only hash-chained audit log with tamper detection
- Case CRUD with scan linking and analyst notes
- Evidence export as self-verifying ZIP (includes verify script)
- Chain of custody timeline
Automated Response Playbooks
Event-driven response automation with 10 built-in playbooks covering phishing triage, malware analysis, BEC detection, ransomware response, and insider threat workflows. Actions include case creation, SIEM forwarding, Slack/Teams notification, evidence export, and file quarantine.
Playbook Engine:
- Trigger conditions: threat score, YARA match, finding type, file extension, sender domain
- Priority ordering with retry and exponential backoff
- Per-action status tracking and execution history
- Quarantine manager with audit trail
- WebSocket broadcast for real-time dashboard updates
REST API & Dashboard
FastAPI server with authenticated endpoints, WebSocket live updates, and a 12-view browser-based dashboard.
Interface Options:
- FastAPI with async endpoints, Pydantic models, Swagger UI at /docs
- 12-view dashboard: Scan, Monitor, Cases, Audit, System, MITRE, Rules, Analytics, Playbooks, Alerts, Quarantine, Sanitize
- X-API-Key auth, rate limiting, CORS, WebSocket
Enterprise Security & Observability
Role-based access control with admin/analyst/viewer roles, SSO via OIDC and SAML, AES-256-GCM field-level encryption at rest, multi-tenant isolation, and full observability with Prometheus metrics and four pre-built Grafana dashboards.
Enterprise Features:
- RBAC with permission matrix and API key rotation
- SSO: OIDC JWT validation, SAML AuthnRequest, JIT user provisioning
- AES-256-GCM encrypted storage with key management
- Multi-tenant isolation with API key to tenant mapping
- Prometheus metrics (21), Grafana dashboards (4), Alertmanager
SIEM & Platform Integrations
Native SIEM connectors for Splunk HEC, Elasticsearch, and Microsoft Sentinel with batching, retry, and health checks. Format-based output in Syslog, CEF, STIX, LEEF, and ECS. Plus cloud storage scanning (S3, GCS, Azure), network sensors (Zeek, Suricata), email gateway, CI/CD pipelines, and Slack/Teams bots.
Integration Points:
- Native SIEM: Splunk HEC, Elasticsearch bulk API, Sentinel Log Analytics
- Cloud: AWS S3, Google Cloud Storage, Azure Blob Storage
- Network: Zeek connector, Suricata connector, SMTP email gateway
- DevOps: CI/CD scanning with SARIF output, GitHub/GitLab integration
- Chat: Slack bot with Block Kit, Teams bot with Adaptive Cards
Deployment & Scaling
Deploy as a single self-contained binary, no Python, ExifTool, or other runtime needed on the host. The binary ships with its full dependency tree bundled inline via Nuitka. Async scan pipeline with persistent in-process worker pool, two-tier scan caching, and pipeline profiler all run inside the binary. Containerized + distributed deployments (Docker Compose, Kubernetes Helm chart with HPA, Redis-backed worker queues) are on the Enterprise roadmap.
Deployment Options:
- Single-process binary (Linux x86_64 and Windows x86_64 today; macOS not yet available)
- Direct download via signed URL from the customer portal, or Homebrew tap (DarkHorse-InfoSec/tap)
- FastAPI REST API server (
hades-server) for SOC integrations and CI/CD pipelines - Containerized + distributed deployments (Docker Compose, Kubernetes Helm chart, Redis-backed worker queues) on the Enterprise roadmap
Pricing
HADES is a proprietary platform with a free Community tier. Paid tiers are unlocked via license key activation.
Community
- 10 scans/month
- Heuristic & IOC detection
- Threat score & severity summary
- Evidence chain
- 10 MB file size limit
Professional
$799/yr (save 33%)
- 5,000 scans/month
- 144 YARA detection rules & ML ensemble detection
- All 20 forensic analyzer modules
- Full findings, MITRE ATT&CK mapping
- Batch scanning & SIEM export
- Threat intelligence feeds
- 100 MB file size limit
- Priority email support
Team
$2,499/yr (save 30%)
- 50,000 scans/month
- Everything in Professional, plus:
- RBAC (admin/analyst/viewer roles)
- SSO (OIDC + SAML)
- Cloud scanning (S3, GCS, Azure)
- CI/CD pipeline integration
- Slack & Teams bots
- AES-256-GCM encrypted storage
- 500 MB file size limit
Enterprise
Annual contract
- Unlimited scans
- Everything in Team, plus:
- Multi-tenant isolation
- Unlimited file size
- Dedicated support & custom SLA
Annual plans save up to 33%. Contact sales@darkhorseinfosec.com for volume discounts.
Frequently Asked Questions
Ready to detect hidden threats in your file metadata?