Hunt Lab

Threat hunts and detection rules you can run, in Sigma, KQL and SPL. Each one says how it was tested.

Start here: Hunt: Plex2Shell implants in the Plex Codecs folder · The Hunt Lab repository on GitHub

Hunt Lab, Threats & Vulnerabilities

When there’s no patch: how to find and fence unfixed flaws

Pulp-style illustration of a rocket-age engineer building a fence of glowing barriers around a cracked, sparking machine that no one can repair

Some flaws will never get a patch, some don't have one yet, and some have one you can't install. How to find them, fence them, watch them and plan their exit.

24 Oct 2026

Alert, Hunt Lab, Threats & Vulnerabilities

Arista EOS CVE-2026-7473: still unfixed, and no fix is coming

Pulp-style illustration of a rocket-age network switch with an unlocked hatch, a stray tunnel of light slipping past a sleeping robot guard

Arista's tunnel decapsulation flaw has been on CISA's KEV list since June, and Arista says no software fix is planned. Find the exposed switches and fence them with ACLs.

24 Oct 2026

AI Security, Hunt Lab

AI in the hunt, part 1: Microsoft’s Project Perception and Codename MDASH

Pulp sci-fi illustration of three chrome robots glowing red, blue and green around a radar-style map table, watched from a gantry by a 1950s woman scientist with her hand on a red lever

Microsoft's Project Perception puts red, blue and green AI agents inside Defender. Codename MDASH hunts bugs in source code. What each does, what hunters can use, and what to check before trusting the output.

23 Oct 2026

Hunt Lab, Threats & Vulnerabilities

Hunt: Plex2Shell implants in the Plex Codecs folder

Pulp-style illustration of a brass detective robot with a magnifying glass examining a glowing red codec drawer

Two untested draft Sigma rules for Plex2Shell on Linux: shared objects written to Plex's Codecs folder, and Plex spawning shells, downloaders or known miners.