Low Severity
Published: Nov 2, 2026
Free threat-hunting queries and detection rules from Cyber-Threat.net Hunt Lab: Sigma, KQL (Microsoft Sentinel, Defender XDR) and Splunk SPL hunts mapped to MITRE ATT&CK, with CISA KEV and EPSS context for each CVE hunt, plus tuning and test notes. Defensive only: no exploit code.
# Cyber-Threat.net Hunt Lab
[](https://github.com/CyberThreatNet/hunt-lab/actions/workflows/validate.yml)
[](LICENSE-DRL)
[](LICENSE)
[](https://attack.mitre.org/)
[](https://cyber-threat.net/category/hunt-lab/)
[](https://cyber-threat.net/category/hunt-lab/feed/)
Free threat-hunting queries and detection rules from **Hunt Lab** at [Cyber-Threat.net](https://cyber-threat.net).
Each week's threats and CVEs become copy-ready hunts for threat hunters, SOC analysts and detection engineers. Hunts are written in **KQL** (Microsoft Sentinel and Defender XDR), **Sigma** and **Splunk SPL**, and mapped to MITRE ATT&CK. Each folder matches a "Hunt of the week" or CVE query pack entry on the site.
Read the write-ups behind each hunt on the [Hunt Lab pages at Cyber-Threat.net](https://cyber-threat.net/category/hunt-lab/), and follow new hunts with the [Hunt Lab RSS feed](https://cyber-threat.net/category/hunt-lab/feed/). Everything here is free to use under the licences below.
Repository: <https://github.com/CyberThreatNet/hunt-lab>
> **Defensive content only.** No exploit code, no proofs of concept and no step-by-step exploitation. Indicators appear only where a cited source publishes them. They are never invented. Behavioural hunts are labelled as such.
## Latest hunts
| Date | Hunt | CVE | ATT&CK | Write-up | Folder |
|---|---|---|---|---|---|
| 2026-10-31 | LiteLLM 1.107.0 cook.pth / sitecustomize credential theft | — | T1195.001, T1195.002, T1059.006,