Fresh research, tutorials, and practical guides from across our cyber threat intelligence work.
November 04, 2026
A fake job interview, five months of access and $6.34bn gone. What Binance, ReversingLabs and Vectra each saw, mapped in one STIX graph.
July 20, 2026
A Sigma rule says what matched. Pair it with YAML response guides and one AGENTS.md so an agent knows what to ask, decide and do. Design ...
June 15, 2026
PAP explains what recipients are allowed to do with intelligence, not just who they can share it with. This post covers why that distinct...
Explore the tools we build to help analysts structure, search, enrich, and operationalise threat intelligence.
Security research from blogs across the industry, turned into structured threat intelligence. See what researchers are writing about right now.
See today's threat research →Upload a threat report and get back the actors, techniques and indicators inside it as STIX, ready for your tools.
Upload your first report →The marketplace for threat intelligence feeds. Subscribe to specialist intelligence, or publish your own.
Browse the feeds →Find out when the software you run has a vulnerability that is being exploited.
Check your software →ATT&CK, ATLAS, CWE and the other threat intelligence knowledgebases, searchable in one place.
Search the knowledgebases →Your detection engineering assistant. Turn threat intelligence research into tuned detection rules.
Create your first rule →… a pyenv_ staging file is created in /Cellar/pyenv/…/libexec before the legitimate pyenv is replaced …
title: pyenv Staging File Created logsource: product: macos category: file_event detection: selection: TargetFilename|endswith: '/libexec/pyenv_' level: high