About
Open Intelligence. Better Hunts.
Focused Hunts is an independent publisher of open-source cyber threat intelligence. It tracks the current state of cyber activity, from traditional threats such as ransomware, espionage and vulnerability exploitation to real-world AI incidents, and turns that activity into guidance defenders can act on.
Good threat intelligence is often locked behind subscriptions or written for analysts with large budgets and larger teams. Focused Hunts takes the opposite approach: high-fidelity analysis, cited sources and ready-to-adapt detection queries, published openly for anyone to read and use.
The audience is global and includes commercial and private defenders alike: enterprise security teams, small businesses, students, researchers and individuals protecting their own data.
Mission
Focused Hunts provides quality, high-fidelity, open-source cyber threat intelligence based on the current state of cyber activity, from traditional threats to AI realities, to educate the global public and support the threat hunting work of commercial and private defenders.
What Focused Hunts Publishes
Hunting off the Red
Technical hunting guides built from current threat research, each with a MITRE ATT&CK mapping and paired Splunk SPL and Microsoft KQL queries.
Last Week in Threats
A weekly retrospective of ransomware, exploited vulnerabilities and malicious infrastructure, built from public threat feeds with every figure attributed.
Articles
Plain-language articles on how threat hunting, monitoring and detection fit together, written for leaders and practitioners.
The Vault
An open-source, privacy-first password manager for Windows and Android that keeps encrypted data in storage the user already owns.
Books
Two books on applying AI in security work: Prompt Intelligence and Beyond the Pilot.
Editorial Standards
Accuracy
Every claim comes from a named source. Facts from a second source carry that source's name and the date it was checked, and nothing is invented to fill a gap.
Reproducibility
Every number in the weekly recap traces back to a saved snapshot of the feeds it came from, and each edition explains its method.
Behavior over Indicators
Queries hunt for what attackers do, not only the addresses and hashes they use this week, so they keep working after the infrastructure changes.
Validated Queries
Detection queries are checked mechanically against Splunk and Microsoft schemas before publication. AI assists in drafting them, and each query section says so.
Openness
No paywall, no sign-up and no tracking without consent. Readers may share the work and adapt the queries to their own environments.
Vendor Neutrality
Focused Hunts sells no security products or services and favors no vendor. The analysis follows the evidence.
Independence
Focused Hunts offers no paid services, consulting or engagements, and it is not affiliated with any employer, vendor or government agency. Everything on this site is published for education. Readers should test any query in their own environment before relying on it; the Terms of Use explain more.
Found an error, have a tip, or want to suggest a topic? Send it through the feedback page.