Hunt 2.4 Adds Phishing Kit Details and Expanded Threat-Hunting Search

· Original article ↗

Summary

Hunt 2.4 adds searchable archive extraction, expanded HTTP and HTML fields, phishing kit details and filters, and improvements to malware search, IOC Hunter, and domain enrichment.

Key points

  • AttackCapture now automatically extracts and indexes ZIP and other common archive files.
  • HuntSQL adds HTTP, HTML, and hash fields in the httpv2 table; the original http table remains unchanged.
  • The phishing kit page provides details on individual kits, and the expanded list includes more than 1,400 kits.
  • Phishing kit listings can be filtered by multiple brand domains and sorted by extracted directory size or file count.
  • IOC Hunter adds filters for posts by threat actor or source.
  • Malware search now queries more than 3,500 malware names and supports filtering by name.

Article Details

Event Type
Hunt IO announced the release of Hunt 2.4, adding investigation and threat-hunting features and updates.
Impact
The release adds archive extraction and indexing in AttackCapture, expanded HTTP and HTML fields in HuntSQL, phishing-kit details and filtering, IOC Hunter filters, hosting information, and improvements and bug fixes across search and user interfaces.

Products

Related Articles