🎯 Threat Hunting Tools

14 proactive threat hunting tools for cybersecurity practitioners — from structured hunt planning and query libraries to lateral movement deep dives and insider threat detection.

Hunt Planning

Hunt Plan Builder

Build a complete, structured hunt plan from a hypothesis with data sources, indicators, and escalation path.

Build hunt plan →

Hunt Hypothesis Library

Structured hunt hypotheses organised by MITRE tactic with rationale, log sources, and ready queries.

Browse hypotheses →

Sigma Rule Converter

Paste any Sigma rule and convert to SPL, KQL, or EQL instantly. Runs client-side.

Convert rule →
Query Libraries

SPL Hunt Query Library

Production-ready Splunk SPL hunt queries organised by MITRE technique with tuning guidance.

Browse SPL queries →

KQL Hunt Query Library

Microsoft Sentinel and Defender KQL queries for Windows, Azure AD, and O365.

Browse KQL queries →

IOC to Hunt Query Converter

Paste IOCs from any threat report. Get SPL and KQL queries searching all event types.

Convert IOCs →
Statistical Hunting

Beacon Detection Calculator

Understand C2 beacon timing patterns and get SPL/KQL queries for beaconing detection.

Hunt beacons →

Long Tail Frequency Analyser

Find rare process executions or DNS queries appearing on only 1-2 hosts.

Analyse frequency →

LOLBin Cluster Hunt

Clusters of 3+ LOLBins from same process in 15 minutes are near-uniquely malicious.

Hunt clusters →
Lateral Movement Deep Dives

Kerberos Attack Hunt Suite

Complete hunt suite for Kerberoasting, AS-REP Roasting, Pass-the-Ticket, Golden/Silver Ticket.

Hunt Kerberos attacks →

SMB Lateral Movement Hunt

Distinguish malicious SMB lateral movement from legitimate file sharing.

Hunt SMB movement →

Lateral Movement Hunt Pack

WMI, DCOM, WinRM, RDP, token impersonation — every lateral movement technique.

View hunt pack →
Insider Threat Hunting

Insider Threat Hunt Pack

Off-hours activity, abnormal data access, bulk downloads, email forwarding rules.

View hunt pack →

Data Staging & Exfil Hunt

Hunt for pre-exfiltration staging — large file copies, ZIP creation, cloud uploads.

Hunt data staging →

Ransomware Pre-Encryption Hunt

Catch ransomware before encryption — shadow copy enumeration, credential dumping.

Hunt ransomware staging →

Hunt Plan Builder

Hunt Hypothesis Library

Sigma Rule Converter

SPL Hunt Query Library

KQL Hunt Query Library

IOC to Hunt Query Converter

Beacon Detection Calculator

Long Tail Frequency Analyser

LOLBin Cluster Hunt

Kerberos Attack Hunt Suite

Kerberoasting
AS-REP Roast
Pass-the-Ticket
Golden Ticket

SMB Lateral Movement Hunt

Lateral Movement Hunt Pack

WMI
DCOM
WinRM
RDP

Insider Threat Hunt Pack

Data Staging & Exfiltration Hunt

Ransomware Pre-Encryption Hunt

About Threat Hunting

Threat hunting is the proactive practice of searching through networks and endpoints to detect advanced threats that evade existing security solutions. Unlike reactive detection, hunting assumes compromise and looks for evidence of attacker activity before alerts fire.

In enterprise environments, the most impactful hunt programmes focus on lateral movement via Kerberos abuse, credential dumping from LSASS, and living-off-the-land techniques using built-in Windows tools. These techniques are heavily used by APT groups targeting government and financial sector organisations.

Effective hunting requires a hypothesis-driven approach: start with a specific attacker behaviour, identify the data sources that would show evidence of that behaviour, write queries to surface anomalies, and document findings regardless of outcome.

Frequently Asked Questions

What is the difference between threat hunting and threat detection?

+

Detection is reactive — a rule fires when a known bad pattern occurs. Hunting is proactive — an analyst forms a hypothesis about attacker behaviour and searches for evidence of it, even without a prior alert. Successful hunts become new detection rules.

What data sources are needed for effective threat hunting?

+

The minimum viable data set is: Windows Security Event Logs (4624, 4625, 4688, 4698), Sysmon (process create, network connect, DNS), EDR telemetry, and DNS query logs. Network flow data and proxy logs significantly expand hunting capability.

What is a Sigma rule?

+

Sigma is a generic, open signature format for SIEM detection rules written in platform-agnostic YAML that can be converted to SPL, KQL, EQL, and other query languages. The Sigma Rule Converter on this page performs that conversion client-side.

How do I detect Kerberoasting?

+

Kerberoasting generates Windows Event ID 4769 with Ticket Encryption Type 0x17 (RC4). Hunt for multiple 4769 events from a single source requesting tickets for different service accounts within a short window. The Kerberos Hunt Suite on this page provides ready-to-run SPL and KQL queries.