# Threat Hunting & Intel Cybersecurity discipline involving threat hunting and cyber threat intelligence. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## A Threat Hunter's Guide to Detecting Malicious Activity in GitHub Audit Logs DevFeed: [A Threat Hunter's Guide to Detecting Malicious Activity in GitHub Audit Logs]() Original publisher: [Read original article]() Author: Julie Agnes Sparks, Juvenal Araujo Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [GitHub](), [Threat Hunting & Intel](), [Security](), [Logging](), [Authentication](), [personal access token]() Tags: [authentication](), [github](), [logging](), [oauth](), [personal-access-token](), [secrets](), [security](), [security-research]() ### AI overview This article examines threats targeting GitHub organizations, including compromised accounts, personal access tokens, OAuth tokens, leaked secrets, phishing, and malicious extensions or OAuth apps. It describes GitHub audit-log queries and behaviors that can help detect account compromise, reconnaissance, and source-code exfiltration. ### Source excerpt In this post, we walk through different threats to GitHub and how to detect them. ## Black Hat USA 2026: Building the Agentic SOC, One Live Event at a Time DevFeed: [Black Hat USA 2026: Building the Agentic SOC, One Live Event at a Time]() Original publisher: [Read original article]() Author: Jessica (Bair) Oppenheimer Published: 2026-09-07T15:00:58Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Detection engineering](), [SIEM, Security, Observability](), [Threat Hunting & Intel](), [telemetry](), [NOC](), [Malware]() Tags: [agentic-soc](), [black-hat](), [cisco-secure-access](), [cisco-talos](), [cybersecurity](), [duo](), [firewall](), [malware](), [network-operations-center](), [noc](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [telemetry](), [thousandeyes]() ### AI overview Cisco describes its work protecting the Black Hat USA 2026 network alongside NOC leaders and technology partners. The team combined security telemetry and workflows to support visibility, detection engineering, threat hunting, malware analysis, AI protection, and Agentic SOC development. ### Source excerpt Cisco is the Security Cloud Provider for the Black Hat conferences. Learn about the latest innovations for the Agentic SOC. ## How iFood built its agentic security platform on ClickHouse Cloud DevFeed: [How iFood built its agentic security platform on ClickHouse Cloud]() Original publisher: [Read original article]() Author: ClickHouse Published: 2026-08-12T15:29:05Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [clickhouse](), [Security](), [Incident response](), [Threat Hunting & Intel](), [Architecture & Design](), [Cloud](), [data](), [real-time](), [Amazon Web Services]() Tags: [agentic](), [architecture](), [aws](), [clickhouse](), [cloud](), [cost](), [data](), [incident-response](), [logs](), [real-time](), [scale](), [security](), [workflows]() ### AI overview iFood rebuilt its in-house security platform on ClickHouse Cloud to handle high-volume log ingestion, long-term retention, and rapid incident response. Compared with its earlier Databricks-based approach, the platform delivered 9-16x faster queries at 40-50% lower cost, near real-time data freshness, and agentic threat-hunting workflows that reduced work from about a week to roughly two hours. ### Source excerpt iFood rebuilt its in-house security platform on ClickHouse Cloud, getting 9-16x faster queries at 40-50% of the cost and unlocking agentic threat hunts that cut a week of analyst work down to two hours. ## Automatically enrich security logs with MITRE ATT&CK context before they reach your SIEM DevFeed: [Automatically enrich security logs with MITRE ATT&CK context before they reach your SIEM]() Original publisher: [Read original article]() Author: Danielle Park Published: 2026-06-24T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [observability pipelines](), [SIEM, Security](), [SIEM, Security, Observability](), [log management](), [Incident response](), [Threat Hunting & Intel](), [Firewall](), [MFA](), [Amazon Web Services](), [DDoS]() Tags: [api](), [aws](), [cloud-siem](), [devsecops](), [firewall](), [incident](), [incident-response](), [log-management](), [logs](), [malware](), [mfa](), [network](), [observability](), [observability-pipelines](), [security](), [techniques](), [threat-detection]() ### AI overview This article explains how Observability Pipelines uses MITRE ATT&CK Enrichment Packs to automatically map security logs and events to common attacker tactics and techniques before they reach a SIEM, data lake, or archive. It describes the initial packs for Okta, Palo Alto, FortiGate, and AWS WAF, covering identity, firewall, network, and web security activity. ### Source excerpt Learn how Observability Pipelines enriches security logs with MITRE ATT&CK tactics and techniques before routing them to your SIEM or storage destination. ## LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine DevFeed: [LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine]() Original publisher: [Read original article]() Author: LABScon Published: 2026-06-02T13:00:58Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [LABScon](), [Malware](), [Threat Research](), [Reverse Engineering](), [Threat Hunting & Intel](), [backdoor]() Tags: [analysis](), [apt](), [attacks](), [backdoor](), [conferences](), [labscon](), [labscon25](), [malware](), [presentation](), [research](), [reverse-engineering]() ### AI overview ESET researchers present technical evidence that Gamaredon facilitated Turla's access to high-value Ukrainian targets between February and June 2025. The presentation examines their operational collaboration, the deployment of Turla's Kazuar backdoor, and the implications for defenders tracking Russian cyberespionage. ### Source excerpt ESET researchers show how Gamaredon facilitated Turla access to Ukrainian targets, revealing rare cooperation between FSB-linked espionage groups. ## Locks, SOCs and a cat in a box: What Schrödinger can teach us about cybersecurity DevFeed: [Locks, SOCs and a cat in a box: What Schrödinger can teach us about cybersecurity]() Original publisher: [Read original article]() Author: Steven Connolly Published: 2025-12-11T10:00:00Z Content type: opinion Language: en Sources: [WeLiveSecurity]() Topics: [Cybersecurity](), [Monitoring](), [Threat Hunting & Intel](), [Business Security]() Tags: [business-security](), [cybersecurity](), [marketing](), [monitoring](), [security](), [strategy]() ### AI overview The article uses Schrödinger's cat as an analogy for the uncertainty facing organisations that lack visibility into their security environment. It argues that organisations should assume threats may already be present and strengthen their cybersecurity strategy through internal threat hunting, monitoring, and appropriate security tools. ### Source excerpt If you don't look inside your environment, you can't know its true state - and attackers count on that ## Threat Hunting with Kubernetes Audit Logs - Part 2 DevFeed: [Threat Hunting with Kubernetes Audit Logs - Part 2]() Original publisher: [Read original article]() Author: Ramesh Ramani Published: 2021-08-17T19:00:00Z Content type: tutorial Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [Kubernetes](), [Threat Hunting & Intel](), [SIEM, Security, Observability](), [Authorization]() Tags: [audit](), [authorization](), [engineering](), [events](), [kubernetes](), [logs](), [policy]() ### AI overview This tutorial explains how to use Kubernetes audit logs with the MITRE ATT&CK framework and a Kubernetes threat matrix to hunt for attackers. It develops hypotheses and example queries, including an investigation of repeated failed pod exec attempts by an anomalous user. ### Source excerpt Using the MITRE ATT&CK® Framework to hunt for attackers ## Threat Hunting with Kubernetes Audit Logs DevFeed: [Threat Hunting with Kubernetes Audit Logs]() Original publisher: [Read original article]() Author: Ramesh Ramani Published: 2021-08-03T19:00:00Z Content type: tutorial Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [Kubernetes](), [Threat Hunting & Intel](), [SIEM, Security, Observability](), [Amazon EC2](), [Amazon Elastic Kubernetes Service](), [Operator Lifecycle Manager]() Tags: [api-server](), [audit](), [audit-trail](), [aws](), [clusters](), [ec2](), [engineering](), [kubernetes](), [kubernetes-clusters](), [logs]() ### AI overview This tutorial introduces Kubernetes audit logs and explains how they can provide an audit trail of API calls for threat hunting. It outlines a process for understanding the environment, forming and testing hypotheses, identifying anomalous behavior, establishing repeatable patterns, and enriching detection pipelines. ### Source excerpt Analyzing Kubernetes audit logs to look for potential threats ## Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion DevFeed: [Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion]() Original publisher: [Read original article]() Author: bohops Published: 2021-03-16T04:08:58Z Content type: article Language: en Sources: [Bohops]() Topics: [Endpoint Security & XDR](), [Logging](), [.NET](), [Security](), [Threat Hunting & Intel](), [Machine Learning, Security Attacks]() Tags: [code](), [endpoint-security](), [logging](), [net](), [process](), [processes](), [security](), [uncategorized]() ### AI overview This article examines how .NET CLR Usage Logs can help defenders detect and investigate .NET execution, including assembly injection into process memory. It describes how the CLR creates Usage Log files and discusses tampering techniques intended to evade endpoint detection, along with monitoring opportunities for identifying that tampering. ### Source excerpt Introduction In recent years, there have been numerous published techniques for evading endpoint security solutions and sources such as A/V, EDR and logging facilities. The methods deployed to achieve the desired result usually differ in sophistication and implementation, however, effectiveness is usually the end goal (of course, with thoughtful consideration of potential tradeoffs). Defenders can [...]