Publication: Cyber OSINT — threat hunting, attribution, vulnerability intelligence, brand monitoring
Cyber OSINT use cases:
- Attack surface mapping: subdomain enumeration (Amass, Subfinder), port scanning (Shodan, Censys), SSL certificate transparency (crt.sh), technology fingerprinting (Wappalyzer, BuiltWith), cloud asset discovery (AWS, GCP, Azure metadata)
- Vulnerability intelligence: CVE monitoring (NVD, GitHub Advisories, vendor advisories), exploit availability (ExploitDB, Metasploit, 0day.today), weaponisation timeline, EPSS scoring for patch prioritisation
- Threat actor tracking: infrastructure mapping (passive DNS, WHOIS history, SSL certificate pivoting), TTP profiling (MITRE ATT&CK), campaign clustering (malware config extraction, C2 protocol analysis), attribution confidence scoring
- Data leak and credential monitoring: paste sites (Pastebin, Ghostbin), dark web markets, combo lists, stealer logs (RedLine, Raccoon, Vidar), GitHub and GitLab secrets (TruffleHog, Gitleaks), cloud storage exposure
- Brand and phishing protection: typosquatting detection (dnstwist), phishing kit tracking, logo and image abuse (reverse image search), fake social media accounts, mobile app impersonation
Tools (production stack 2026):
- Passive DNS: DNSDB (Farsight), SecurityTrails, PassiveTotal
- SSL and infrastructure: Censys, Shodan, ZoomEye, GreyNoise
- Vulnerability intelligence: Vulners, VulnDB, Tenable.io, Qualys
- Dark web: DarkOwl, Intel 471, Flashpoint, KELA
- Leaks: HaveIBeenPwned API, DeHashed, Intelligence X, a custom stealer log parser
- Attribution: Maltego with custom transforms, VirusTotal Graph, AlienVault OTX
Threat hunting workflow: hypothesis → data collection (API and scraping) → enrichment (VirusTotal, OTX, PassiveTotal) → clustering (graph analysis) → attribution scoring → IOC generation → detection rules (Sigma, YARA, Snort) → SOC handoff.
Download the guide (PDF plus Sigma rules pack): pdf | sigma rules
← Back to news