Hunting Execution: PowerShell and Living-Off-the-Land Binaries
A focused, practical guide to hunting PowerShell abuse and living-off-the-land binaries, the execution techniques attackers rely on most.
ThreatHuntLabs
Hunting Execution: How Attackers Actually Run Their Code
A hunter's guide to detecting execution techniques used after initial access, from scripting interpreters to scheduled task abuse.
Hunting Initial Access Part 2: Supply Chain and Trusted Relationships
Detecting initial access through supply chain compromise and abuse of trusted third-party access, the hardest foothold to hunt for.
Hunting Initial Access: Catching the Breach Before It Begins
How to hunt for the techniques adversaries use to gain their first foothold, before it turns into a deeper compromise.
Hunting Resource Development: Find Infrastructure Before It Is Used
How to hunt for adversary infrastructure being staged and developed, catching signals of an attack before it's actually launched.
Hunting Reconnaissance: Finding Pre-Intrusion Warning Signals
Hunt external scanning, enumeration, and social-engineering preparation as early-warning signals before an intrusion.
MITRE ATT&CK for Hunters: Beyond the Matrix Poster
Mastering MITRE ATT&CK Navigator as a real hunt planning and documentation tool, not just a reference chart on the wall.
Phase 3 Capstone: Run Three Hunts, Three Different Ways
A capstone exercise running three full end-to-end threat hunts using intelligence-driven, behavioural, and TTP-based methodologies.
Structured Analytic Techniques for Threat Hunters
How intelligence analysis methods like ACH and devil's advocacy help hunters catch their own cognitive bias before it costs an investigation.
TTP-Based Hunting: Working at the Top of the Pyramid
Why hunting attacker tactics, techniques, and procedures instead of artefacts produces the most durable, hardest-to-evade detections.