#threathunting #threatdetection #thrunting #agentai #openclaw #clawdbot #moltbot

OpenClaw isn't malware. It's a legitimate tool that store credentials, retain memory, and act autonomously. That's what makes it dangerous when misused.

Full behavioral breakdown in our latest Hunt Mode post.

🦀 https://nebulock.io/blog/hunting-openclaw-and-agentic-ai-through-behavior

You don’t need a desk to build.

Last month, I used AI more from my phone than I did from my desk.

What mattered was removing friction and building where ideas actually show up. Couch. Bed. Airport. Ten minutes at a time.

With the right systems, context persists. You don’t start over every time you sit down.

Start now. Wherever you are.

👉 Full post:
https://dispatch.thorcollective.com/p/you-dont-need-a-desk-to-build

#building #ai #softwaredevelopment #neurodiversity #shipping #threathunting #thrunting #THORcollective

“I’m not a developer” is a self-imposed limit.

If you’ve written a query, a script, or an automation to fix a problem, you’re already building. That counts.

In the latest THOR Collective Dispatch, we talk about why building is a core security skill and why more practitioners should stop waiting for permission.

What are you building next?

https://dispatch.thorcollective.com/p/why-you-should-build

#infosec #threathunting #builders #ai #thrunting #THORcollective

DigitStealer is an excellent example of where macOS malware is heading: multi-stage, modular, and using legit macOS tools like it belongs there.

Detect the attack, not the sample.
Shoutout Jamf Threat Labs 🙌

https://nebulock.io/blog/hunting-digitstealer-behaviors-that-give-away-macos-infostealers

#threathunting #macos #cybersecurity #dfir #thrunting

80 posts. We kept hitting publish.
This year was about doing the work, writing it down, and sharing it anyway.
If you read, argued, bookmarked, or built alongside us, thank you.
Happy New Year. Happy thrunting.

https://dispatch.thorcollective.com/p/80-posts-later

#threathunting #infosec #cybersecurity #thrunting #THORcollective

I’m excited to share Hunt Mode, a new guided hunt series from Nebulock focused on real-world threats.

The first hunt dives into CVE-2025-55182, highlighting the behaviors the exploit leaves behind after initial access.

Join the hunt 👉 https://nebulock.io/blog/cve-2025-55182-behaviors-that-give-away-react-server-components-rce

It's happening!

Meet the Agentic Threat Hunting Framework (ATHF).

Tired of copy-pasting the same hunt template over and over? Same. I built a framework designed for an AI-assisted future that adds structure, memory, and context to every hunt.

Come check it out, so you never have to say “uhh, what was our last hunt?” again.

https://nebulock.io/blog/agentic-threat-hunting-framework

November’s @THOR_Collective Dispatch Debrief is live with SCADA weirdness, Taylor’s Version SOC vibes, and purple team chaos.

Come thrunt with us.

https://dispatch.thorcollective.com/p/dispatch-debrief-november-2025

#threathunting #cybersecurity #thrunting #soc #blueteam #detectionengineering #incidentresponse #cyberdefense #aiinsecurity #agenticai #scada #otsecurity #purpleteam #grc #peakframework #THORcollective #dispatchdebrief

Have you ever run the best hunt of your life and then forget how two weeks later?
Same.

Meet the PEAK Threat Hunting Template. Built to make your hunts repeatable, reviewable, and impossible to lose.

👉 Read on THOR Collective Dispatch - https://dispatch.thorcollective.com/p/the-peak-threat-hunting-template

#threathunting #cybersecurity #soc #dfir #blueteam #thrunting #thrunting #THORcollective

🎤 The Autonomous SOC (Taylor’s Version)
Guest post with Kassandra Murphy

AI hype is loud. Most teams are just automating chaos.
Fix the basics first. Then scale the magic.

Read it on THOR Collective Dispatch.
Autonomy doesn’t replace us. It remasters us.

https://dispatch.thorcollective.com/p/the-autonomous-soc-taylors-version

#autonomousSOC #taylorsversion #cybersecurity #threathunting #SOClife #detectionengineering #automation #THORcollective #infosec #securityoperations

In the latest guest post, threat hunter Sam Hanson walks through two real TTP-driven hunts — KurtLar_SCADA and a strange .NET Modbus binary — showing how simple hypotheses can surface novel activity without chasing IOCs.

IOCs show where the fire was.
TTPs show where it will be.

Read it on THOR Collective Dispatch → https://dispatch.thorcollective.com/p/hunting-beyond-indicators-part-2

#threathunting #ICS #OTSecurity #THORcollective #thrunting #threatdetection #threatintel

October delivered AI agents, time mastery, and a few purple team curveballs. From scaling hunts like code to aligning GRC with threat-informed defense, this month’s Dispatch lineup hit every layer of the stack.

Read the full recap:
🔗 https://dispatch.thorcollective.com/p/dispatch-debrief-october-2025

#threathunting #cybersecurity #THORcollective #purpleteaming #baselines #grc #thrunting #ai

Finding nothing ≠ failing the hunt.
Sometimes “nothing” is the loudest signal that your defenses worked.

Lauren Proehl breaks down how to measure the quiet wins in in one of my favorite THOR Collective Dispatch posts:

https://dispatch.thorcollective.com/p/measuring-the-hunt-when-you-find

“Give a CTI analyst an indicator, they’ll be fed for a day.
Teach a CTI analyst to hunt for TTPs, and they’ll be fed for a lifetime.”

In this week’s THOR Collective Dispatch, Sam Hanson lays out how to move beyond indicator-based hunting and build detection muscle that actually scales.

👉 https://dispatch.thorcollective.com/p/hunting-beyond-indicators

#threathunting #cybersecurity #TTPhunting #mitre #THORcollective #thrunting #infosec #cybersecurity

If tstats gives you speed and eventstats gives you context...timechart gives you shape.

This week’s THOR Collective SPL Dispatch breaks down how to use timechart to uncover rhythm, automation, and the occasional cron job masquerading as “normal.”

https://dispatch.thorcollective.com/p/the-shape-of-time-mastering-timechart

#splunk #threathunting #cybersecurity #infosec #THORcollective #thrunting

Threat hunting gets messy fast when your “documentation” lives in Slack threads and sticky notes.

That’s why in Part 2 of our Agentic Threat Hunting series, I walk through the first real step to scaling: putting your hunts in a GitHub repo and giving your AI sidekick a memory.

Full post: https://dispatch.thorcollective.com/p/agentic-threat-hunting-part-2

#threathunting #thrunting #cybersecurity #AI #thrunting #THORcollective #AIbestie

✨ To get you ready for Taylor Swift’s latest album, here’s something to hold you over… ✨

🎶 I put together a playlist called Life of a Detection Girl - 12 tracks inspired by the storytelling of Taylor Swift and Alex Hurtado, with a touch of cyber woven in.

Give it a listen and let me know your favorite track!

https://suno.com/playlist/5cf27de7-59ba-493b-861a-e37088af7909

From temporal to behavioral, baselines are the thrunter’s compass. September’s Dispatch from THOR Collective shows how to use them to sharpen the hunt and includes ten baseline hunts you should be running now.
🔗 https://dispatch.thorcollective.com/p/dispatch-debrief-september-2025

#threathunting #baselines #cybersecurity #THORcollective #thrunting #infosec