Advanced Threat Hunting with New SSL Features: Unlocking HuntSQL™ Anomaly Flags for Deeper Detection

Hunt 2.5 adds a Pivots table tying IPs to certificate subjects, hashes, and TLS fingerprints, 50+ certificate fields in HuntSQL, an Add to Query button, and a downloadable phishing feed.

Hunt explains how it identifies, tracks and 'burns' malicious C2 servers using TLS certificates, HTTP headers, SSH keys, JARM/JA4x hashes and TCP banners, seen in Gh0st and ShadowPad cases.

Hunt shows proactive hunting: pivoting on certificate names from Microsoft's Flax Typhoon report yielded four unreported SoftEther servers, plus Cobalt-related files found via keyword search.

Part one of Wiz's series on tracking cloud-fluent threat actors explains why cloud-specific IOCs—IAM metadata, control plane API calls, container image names—are essential for detection and attribution in the cloud.

Measures detection maturity across MITRE ATT&CK with a logging-detection-alerting-response-prevention pipeline, letting security teams map visibility gaps in their threat detection landscape.

Explores the promise and shortcomings of MITRE ATT&CK Evaluations for judging EDR products, warning that vendors' 100 percent claims can mislead and SOCs need a data-driven detection landscape view.