Threat Hunting
Threat Hunting
Hypothesis-driven hunts with queries in KQL and CrowdStrike CQL. Shared at TLP:CLEAR.
Hunt Drop 10 | Edge-to-Domain: Hunting the k0t Post-VPN Playbook
A VPN edge foothold has been turned into domain access.
Hunt Drop 09 | LLMJacking: find the hijacked AI before the bill does
A stolen cloud identity is reselling our AI quota.
Hunt Drop 08 | Trojanised Claude Code extension: hunt the reverse SSH backdoor
An editor loader plants an SSH key and a reverse tunnel.
Hunt Drop 07 | Oracle EBS: hunting the TCF servlet RCE
An EBS Java process or app account starts a shell.
Hunt Drop 06 | Fake "IT Support" in Teams
An IT-desk chat becomes a remote session and a stager in under 30 minutes.
Hunt Drop 05 | Hunting the LiteLLM 1.107.0 startup-hook stealer
Python itself runs the stealer on every start.
Hunt Drop 04 | Hiding in plain System32
Trusted software spawns a LOLBin host, then a renamed Windows binary side-loads a DLL.
Hunt Drop 03 | When your MSP's app becomes the attacker
A stolen app credential signs in app-only, then grants itself roles and credentials.
Hunt Drop 02 | PHP2Shell: hunt PHP workers gone rogue
A PHP web worker has been turned into a shell on the host.
Hunt Drop 01 | ROMULUS ClickFix: hunt the paste-to-loader chain
Run-box PowerShell leads to a silent MSI or passworded 7-Zip, then a loader on the host.