What this is

The host-side companion to the network threat hunt reference. Where the network reference covers what adversaries do across the wire, this site covers what they do inside the endpoint: process execution, persistence, privilege escalation, credential theft, and destruction.

Every indicator includes paste-ready syntax for Sysmon and Kibana (KQL) queries, PowerShell/auditd hunt scripts, registry artifacts, and open-source detection mappings.

How to use it

• Pick a tactic card above to open its reference page
• Use the search box or technique filter buttons to narrow down indicators
• Copy the query syntax matching your tool (Sysmon, KQL, PowerShell)
• Click the ★ star on any row to add it to your hunt list
• Open My Hunts from the header to review and export your hunt as TXT or CSV

About hunts

Starred indicators persist across browser restarts and sync across open tabs in real-time. Hunts are stored in localStorage under the key hunt_reference_hunts_v1; nothing leaves the browser.

Starred indicators from both NET and HOST surfaces appear together in the ATTRIB engine for unified scoring.

Coverage

7 built tactics, 93 techniques, 174 indicators spanning Windows and Linux endpoints. Detection fields: Sysmon event IDs, Kibana KQL queries, PowerShell hunt scripts, auditd rules, registry artifacts, open-source rule mappings (Sigma, Elastic, Wazuh, osquery, Falco).

APT attribution covers 29 named threat actors across China, Russia, DPRK, Iran, and criminal groups.