Cyber Threat Hunting

A collection of tools and other resources for threat hunters.

Sections

Hunting Tools - A collection of our open source tools for hunting
Resources - Useful resources to get started in Threat Hunting
Hunting with AI - Leverage the power of ChatGPT prompts for Threat Hunting
Must Read - Articles and blog posts covering different aspects of Threat Hunting
Custom Scripts - Our own tools and scripts to support different types of hunts

MITRE ATT&CK - A curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s lifecycle and the platforms they are known to target.
MITRE CAR - A knowledge base of analytics developed by MITRE based on the Adversary Tactics, Techniques, and Common Knowledge (ATT&CK™) threat model.
Threat Hunting with Bro IDS
Automating APT Scanning with Loki Scanner and Splunk
The ThreatHunting Project - A great collection of hunts by @DavidJBianco
Threat Hunting Techniques - AV, Proxy, DNS and HTTP Logs
Cyber Threat hunting with Sqrrl (From Beaconing to Lateral Movement)
The ThreatHunter-Playbook - Hunting by leveraging Sysmon and Windows Events logs
Detecting Lateral Movement through Tracking Event Logs
How to build a Threat Hunting platform using ELK Stack
Endpoint Detection of Remote Service Creation and PsExec - Hunting for lateral movement with Event Tracing for Windows (ETW)