Threat Hunting Guides
Detection Rules • Hunting Queries • IOCs
Free, actionable threat hunting guides built from real-world investigations. Each guide includes MITRE ATT&CK mapping, detection rules for Splunk/Sigma/KQL, and hunting queries you can deploy today.
Featured Guide
BRICKSTORM Backdoor
UNC5221 / WARP PANDA • 5-7 hours
Comprehensive hunting procedures for BRICKSTORM backdoor targeting VMware vCenter and ESXi. 13 hunt modules, CISA-verified IOCs, and DNS-over-HTTPS C2 detection.
All Hunting Guides
BRICKSTORM Backdoor
UNC5221 / WARP PANDA
Comprehensive hunting procedures for BRICKSTORM backdoor targeting VMware vCenter and ESXi. 13 hunt modules, CISA-verified IOCs, and DNS-over-HTTPS C2 detection.
Qilin Ransomware
Qilin / Agenda
#1 ransomware threat to US SLTT organizations. GPO-based Chrome credential harvesting, BYOVD EDR evasion with dark.sys driver detection.
Scattered Spider
UNC3944 / Octo Tempest
Social engineering specialists targeting identity providers. SIM swapping, MFA bombing, and help desk impersonation detection.
APT44 / Sandworm
Sandworm Team / IRIDIUM
Russian military intelligence unit. NotPetya, Olympic Destroyer, Ukraine/NATO targeting. Critical infrastructure defense focus.
Volt Typhoon
VANGUARD PANDA / Bronze Silhouette
China-nexus actor pre-positioning in US critical infrastructure. Living-off-the-land techniques for long-term persistence detection.
Z-Pentest
ZPT
Pro-Russian hacktivist group targeting industrial control systems and critical infrastructure in NATO countries.
SafePay Ransomware
SafePay
Emerging RaaS operation with unique encryption and double extortion tactics. Growing victim count in Q4 2024.
What's Included in Each Guide
Every guide is built from real investigation data and includes actionable content you can deploy immediately.
MITRE ATT&CK Mapping
Techniques and sub-techniques with T-codes for framework alignment.
Detection Rules
Production-ready Splunk SPL, Sigma, and KQL queries with copy buttons.
Hunt Modules
Step-by-step hunting procedures with priority levels and time estimates.
IOCs & Artifacts
IPs, domains, file hashes, registry keys, and file paths.
Automate Your Threat Hunting
BRACE provides continuous monitoring for 175+ threat actors with weekly detection rule updates and sector-specific intelligence.