Welcome to the Cyber Threat Hunting (CTH) Repository! This repository is designed for security professionals, researchers, and enthusiasts who want to proactively detect, analyze, and hunt cyber threats before they cause damage.
Whether you're an experienced threat hunter or just getting started, this repository will provide practical methodologies, hunting playbooks, tools, case studies, and resources to help you stay ahead of adversaries.
This repository is structured to cover every aspect of threat hunting, from fundamental concepts to advanced AI-powered techniques.
📁 Threat_Hunting_Fundamentals – Learn the core principles, including hunting models, intelligence-driven hunting, and required data sources.
📁 Hunting_Methodologies – Explore TTP-based, anomaly-based, and hypothesis-driven hunting techniques using MITRE ATT&CK and Cyber Kill Chain.
📁 Tools_and_Techniques – Discover essential tools like YARA, Sigma, MSTICpy, NOVA, Splunk, ELK, and how to leverage them for threat hunting.
📁 Threat_Hunting_Playbooks – Practical step-by-step playbooks for persistence, lateral movement, C2 communications, ransomware, insider threats, and more.
📁 Real-World_Case_Studies – Analysis of notorious cyber incidents, lessons learned, and successful threat hunting operations.
📁 Threat_Feeds_and_OSINT_for_Hunting – Leverage OSINT techniques, dark web monitoring, and automated threat intelligence feeds for hunting.
📁 Hunting_in_Cloud_Environments – Threat hunting techniques for AWS, Azure, Google Cloud, and cloud-native security tools.
📁 AI_and_Machine_Learning_in_Threat_Hunting – Explore AI-driven detection, anomaly detection, behavioral analytics, and LLMs in threat hunting.
📁 Reading_and_References – A curated list of books, research papers, blogs, newsletters, and conference talks to deepen your knowledge.
📁 Miscellaneous – Helpful resources like cheat sheets, community links, and additional tools.
- Learn: If you're new, start with Threat Hunting Fundamentals.
- Research: Use the Case Studies and Threat Feeds sections to track real-world threats.
- Implement: Follow the Threat Hunting Playbooks for hands-on investigations.
- Automate: Explore AI & Machine Learning to enhance detection capabilities.
- Contribute: Have insights or new hunting techniques? Feel free to contribute!
I welcome contributions! If you have hunting queries, tools, methodologies, or case studies to share, check out our Contributing Guidelines (coming soon).
Cyber threats evolve daily. Follow this repository to stay ahead with the latest threat hunting techniques, playbooks, and case studies.