I'll be running a workshop at DEF CON 34! Agentic Threat Hunting: Building AI That Remembers What You Hunted This isn't a walkthrough or an AI demo. It's a real threat hunt. Workshop registration opens Tuesday, July 14 at 12:00 PM PT. Hope to see you there. 🖤 events.humanitix.com/fri_am_ws4_4...

WS4 - Agentic Threat Hunting: Building AI That Remembers What You Hunted

Instructed by: Sydney “letswastetime” Marrone Level of Difficulty: Intermediate, Advanced

events.humanitix.com

I GOT A TEXT!!!!! Anthropic analyzed 832 malicious cyber actors using AI. The takeaway: your detections probably aren't broken. Assumptions about attacker speed might be. New @thorcollective.bsky.social Dispatch from guest author Kassandra Murphy👇 dispatch.thorcollective.com/p/ai-has-ent...

Ideas are easy. Following through is the hard part. I'll be joining Women's Society of Cyberjutsu for "You've Got This: Just Hit Submit on That Brilliant Idea!" to talk about turning ideas into action. Hope to see you there. womenscyberjutsu.org/event/youveg...

That CFP. That blog post. That workshop. That idea. Hit submit. Some of the best opportunities in my career started with putting myself out there before I felt ready. 🔥 New @thorcollective.bsky.social Dispatch: You've Got This. Just Hit Submit. dispatch.thorcollective.com/p/youve-got-...

I’ll be speaking at the Threat Hunting Summit on June 17 about hunt memory and building lightweight repos your AI assistant can actually use during investigations. Because most hunts still end up in “wait… have we seen this before?” Come hang 👀 www.antisyphontraining.com/event/threat...

HEARTH just got operational. 160+ hunts, now with: What can I hunt? → based on your telemetry Coverage map → see your gaps Context graph → prioritize what matters now Same library. Way more usable. dispatch.thorcollective.com/p/three-new-...

Breaking into cybersecurity can feel like opening 23 tabs and learning nothing. In this @THOR_Collective Dispatch guest post, Bella San Lorenzo shares practical ways to break the cycle and start making real progress. Part II is live! dispatch.thorcollective.com/p/all-roads-...

We teach people how to start a threat hunt. Nobody teaches them when to stop. New post on @thorcollective.bsky.social Dispatch on closing hunts with actual criteria instead of gut feelings 👇 👉 dispatch.thorcollective.com/p/when-to-st...

New on the @thorcollective.bsky.social Dispatch - Bella San Lorenzo on the paralysis of trying to find your place in cybersecurity. 47 browser tabs. A perfectly organized Notion page. Zero actual progress. Sound familiar? 👉 dispatch.thorcollective.com/p/the-more-i...

OpenClaw isn't malware. It's a legitimate tool that store credentials, retain memory, and act autonomously. That's what makes it dangerous when misused. Full behavioral breakdown in our latest Hunt Mode post. 🦀 nebulock.io/blog/hunting...

Hunting OpenClaw and Agentic AI Through Behavior | Nebulock blog

This Hunt Mode breaks down the behaviors that give away OpenClaw (formerly ClawdBot / MoltBot), regardless of how it is packaged, renamed, or delivered.

nebulock.io

You don’t need a desk to build. I used AI more from my phone last month than from my desk. What mattered was removing friction and building where ideas show up. 👉 New on @thorcollective.bsky.social Dispatch: dispatch.thorcollective.com/p/you-dont-n...

“I’m not a developer” is a self-imposed limit. If you’ve written a query, a script, or an automation to fix a problem, you’re already building. In the latest @thorcollective.bsky.social Dispatch, we talk about why building is a core security skill. dispatch.thorcollective.com/p/why-you-sh...

DigitStealer is an excellent example of where macOS malware is heading: multi-stage, modular, and using legit macOS tools like it belongs there. Detect the attack, not the sample. Shoutout Jamf Threat Labs 🙌 nebulock.io/blog/hunting...

80 posts. @thorcollective.bsky.social kept hitting publish. This year was about doing the work, writing it down, and sharing it anyway. If you read, argued, bookmarked, or built alongside us, thank you. Happy New Year. Happy thrunting. dispatch.thorcollective.com/p/80-posts-l...

It's happening! Meet the Agentic Threat Hunting Framework (ATHF). Tired of copy-pasting the same hunt template over and over? Same. I built a framework designed for an AI-assisted future that adds structure, memory, and context to every hunt. Come check it out! nebulock.io/blog/agentic...

November’s @thorcollective.bsky.social Dispatch Debrief is live with SCADA weirdness, Taylor’s Version SOC vibes, and purple team chaos. Come thrunt with us. dispatch.thorcollective.com/p/dispatch-d...

🚨New post on @THOR_Collective Dispatch🚨 “Aligning Risk Management and Threat-Informed Defense Practices (Part 2)” by Micah VanFossen What happens when you sync risk, controls, and threat intel to drive real-security outcomes. dispatch.thorcollective.com/p/aligning-r... #thrunting #grc

Aligning Risk Management and Threat-Informed Defense Practices (Part 2)

We’re back with part two of a series analyzing how to align common GRC tasks/teams with SecOps and threat-informed defense practices.

dispatch.thorcollective.com

🚨New post on @THOR_Collective Dispatch🚨 Purple teaming isn’t shiny. It’s delays, blockers, tickets & pivots. And that’s okay. open.substack.com/pub/thorcoll... #thrunting #PurpleTeaming

Purple Teaming in the Real World: When Everything Goes Off the Rails (and That’s Normal)

People love the glossy version of purple teaming:

open.substack.com

Have you ever run the best hunt of your life and then forget how two weeks later? Same. Meet the PEAK Threat Hunting Template. Built to make your hunts repeatable, reviewable, and impossible to lose. 👉 Read on THOR Collective Dispatch - dispatch.thorcollective.com/p/the-peak-t...

🎤 The Autonomous SOC (Taylor’s Version) Guest post with @kassafras09.bsky.social AI hype is loud. Most teams are just automating chaos. Fix the basics first. Then scale the magic. Read it on @thorcollective.bsky.social Dispatch. dispatch.thorcollective.com/p/the-autono...

The Autonomous SOC (Taylor’s Version)

Opening Act: Welcome to the SOC Show

dispatch.thorcollective.com

In the latest @thorcollective.bsky.social guest post, Sam Hanson breaks down two TTP-driven hunts — KurtLar_SCADA and a weird .NET Modbus binary — proving simple hypotheses > chasing IOCs. IOCs show where the fire was. TTPs show where it will be. dispatch.thorcollective.com/p/hunting-be...

dispatch.thorcollective.com

October delivered AI agents, time mastery, and purple team curveballs. From scaling hunts like code to aligning GRC with threat-informed defense, this month’s Dispatch lineup from @thorcollective.bsky.social hit every layer of the stack. Full recap here: dispatch.thorcollective.com/p/dispatch-d...

Dispatch Debrief: October 2025

Seven Dispatch drops that prove hunting smarter beats hunting harder.

dispatch.thorcollective.com

Finding nothing ≠ failing the hunt. Sometimes “nothing” is the loudest signal that your defenses worked. @jotunvillur.bsky.social breaks down how to measure the quiet wins in in one of my favorite @thorcollective.bsky.social Dispatch posts: dispatch.thorcollective.com/p/measuring-...

Measuring the Hunt When You Find “Nothing”

Because sometimes success looks like silence.

dispatch.thorcollective.com

In this week’s @thorcollective.bsky.social Dispatch, Sam Hanson lays out how to move beyond indicator-based hunting and build detection muscle that actually scales. 👉 dispatch.thorcollective.com/p/hunting-be...

If tstats gives you speed and eventstats gives you context...timechart gives you shape. This week’s @thorcollective.bsky.social SPL Dispatch breaks down how to use timechart to uncover rhythm, automation, and the a cron job masquerading as “normal.” dispatch.thorcollective.com/p/the-shape-...

Threat hunting falls apart when your “docs” live in Slack threads. Part 2 of the @thorcollective.bsky.social Dispatch Agentic Threat Hunting series covers the first step to scaling: put your hunts in a GitHub repo and give your AI bestie memory. dispatch.thorcollective.com/p/agentic-th...

✨ To get you ready for Taylor Swift’s latest album… ✨ 🎶 Check out Life of a Detection Girl - a playlist I created inspired by Taylor Swift and Alex Hurtado, with a touch of cyber woven in. Give it a listen and let me know your favorite track! suno.com/playlist/5cf...

Life of a Detection Girl by @letswastetime | Suno

✨ inspo by alex hurtado & taylor swift ✨

suno.com

We at @thorcollective.bsky.social are waking you up before September ends, because a new Ask-a-Thrunt3r episode just dropped with: 2K subscriber milestone 🎉 15 baseline examples The great data vs. data debate Plus: Is Git the future of hunting collab? 🎧: dispatch.thorcollective.com/p/ask-a-thru...

Ask-a-Thrunt3r: September 2025 Recap 🐏

Mainly ramblings. And maybe some wisdom.

dispatch.thorcollective.com

From temporal to behavioral, baselines are the thrunter’s compass. September’s Dispatch from @thorcollective.bsky.social shows how to use them to sharpen the hunt and includes ten baseline hunts you should be running now. 🔗 dispatch.thorcollective.com/p/dispatch-d...

You can’t find weird if you don’t know normal. @thorcollective.bsky.social just dropped 10 baseline hunts you can shine in the dark parts of your env and magnify the adversaries from the noise. Join us for all the thrunting 👉: open.substack.com/pub/thorcoll... #threathunting #infosec