Agents/Hunter
Hunter

Hunter

Finds what hides Active

Proactively hunts for hidden threats and IOCs, and continuously checks posture — surfacing misconfigurations and CSPM deviations from playbooks and best practice before they can be exploited.

3
Hunts running
27
IOCs matched (7d)
10
Open risks
SilverFin
Top profile match
Threats
Active threats the Hunter has surfaced — IOC matches, sweeps and anomalies
STREAMING
IOC matchMatched IOC 8f3a… to APT profile SilverFinHigh1m ago
TLS/JA3 fingerprint + AssumeRole sequence align with 3 prior SilverFin campaigns.
● Confirmed
AnomalyBeaconing to 2.54.178.107 across 3 hostsHigh12m ago
Periodic outbound to a residential IL ASN. Handed to Investigator as part of #2287.
● Escalated
IOC matchNew autorun key on i-0ab3f matches known loaderHigh18m ago
Persistence artifact written post-UserData execution.
● Confirmed
SweepSwept 1,204 endpoints for persistence artifactsLow26m ago
Fleet-wide sweep triggered by the SilverFin match; one corroborating host found.
● 1 hit
IOC matchCredential-stuffing signature on the Okta tenantMedium48m ago
Low-volume attempts against 4 service accounts; no success yet.
● Monitoring
HuntOpened hunt: unusual service creation, Windows fleetMedium1h ago
Hypothesis-driven hunt for lateral-movement tooling.
● Running
AnomalyDNS-tunneling heuristic tripped in eu-centralMedium2h ago
High-entropy subdomains from a single VPC egress.
● Investigating
HuntRare parent→child: winword → powershellHigh3h ago
Traced to an approved macro-enabled finance workbook.
● Closed · benign