threat hunting
3 storiesHunting MacSync Stealer infrastructure through behavioral pivots
MacSync Stealer, a macOS information stealer, has been observed using rapidly changing infrastructure for its operations. Microsoft Defender Experts identified persistent behavioral patterns, such as specific request characteristics and upload methods, that allow for tracking the malware's activity even as its command-and-control domains rotate. These durable pivots enable defenders to investigate payload delivery, data collection, staging, and exfiltration.
CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX
CrowdStrike researchers have identified 21 novel methods for obfuscating shell commands on VMware ESX hypervisors. These techniques, ranging from simple encoding to complex cryptographic ciphers and invisible Unicode characters, evade traditional log-based detection by exploiting the parsing stage of command execution. CrowdStrike has developed detection patterns to identify these obfuscated commands at scale, enhancing security for ESX environments frequently targeted by ransomware.
SharpHound Recon Attack – How AI enhanced the threat hunt
Researchers integrated an AI-driven security agent with full packet capture technology at Cisco Live AMER 2026 to automate threat hunting and analysis. The system successfully identified a potential SharpHound reconnaissance attack, analyzed network traffic, and accurately determined it to be a benign near-miss, saving significant analyst time and demonstrating the AI's potential to boost SOC efficiency.