Introducing Hunt Advanced Search

Hunt shows proactive hunting: pivoting on certificate names from Microsoft's Flax Typhoon report yielded four unreported SoftEther servers, plus Cobalt-related files found via keyword search.

Hunt.io recovered a 12-file SMTP proxy toolkit from exposed PCPJack infrastructure, showing how 230 hijacked cloud servers were turned into a persistent email relay network with Sliver and Chisel.

Part 4 of the Cobalt Strike series: automating the C2 feed via API—normalizing indicators into core, network and endpoint outputs for SIEM, IDS/EDR and sandbox pipelines.

Part 3 of the Cobalt Strike series: the C2 dashboard automates discovery—certificate matching, header analysis and protocol inspection track 800–1,000 active servers with 90% validation confidence.

Part 2 of the Cobalt Strike series: ten-plus HuntSQL recipes for detecting, grouping and tracking C2 infrastructure by certificate reuse, beacon traits and enrichment—from real hunting scenarios.

Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.