THOR — Threat Hunting & Open Research

THOR — Threat Hunting & Open Research https://sakshamtushar.com/ Security researcher & threat hunting educator. THOR-HQ videos, blogs, talks, and open research on cyber threat hunting. Detecting APT Simulator Defense Evasion Techniques with ES|QL https://sakshamtushar.com/blogs/detecting-apt-simulator-es-ql.html https://sakshamtushar.com/blogs/detecting-apt-simulator-es-ql.html Sat, 08 Nov 2025 00:00:00 GMT Detecting defense evasion techniques used by APT simulators with ES|QL. TH201 Ep4 — Clustering: Full ES|QL Queries https://sakshamtushar.com/blogs/th201-ep4-clustering.html https://sakshamtushar.com/blogs/th201-ep4-clustering.html Sat, 01 Nov 2025 00:00:00 GMT Demonstrates ES|QL clustering queries for advanced threat hunting. Threat Detection Lab — THOR-HQ https://sakshamtushar.com/blogs/threat-detection-lab-thor-hq.html https://sakshamtushar.com/blogs/threat-detection-lab-thor-hq.html Sat, 01 Jun 2024 00:00:00 GMT A comprehensive guide to building a threat detection lab from scratch. Hunting & Detecting Remcos RAT with Splunk & Sysmon https://sakshamtushar.com/blogs/hunting-remcos-rat.html https://sakshamtushar.com/blogs/hunting-remcos-rat.html Fri, 15 Dec 2023 00:00:00 GMT Detecting and analyzing Remcos RAT malware using Splunk and Sysmon. Hunting APT DarkHotel https://sakshamtushar.com/blogs/hunting-apt-darkhotel.html https://sakshamtushar.com/blogs/hunting-apt-darkhotel.html Thu, 01 Jun 2023 00:00:00 GMT Analyzing the APT DarkHotel threat and its malware tactics. Revil - Kaseya Supply Chain Attack https://sakshamtushar.com/blogs/revil-kaseya-supply-chain.html https://sakshamtushar.com/blogs/revil-kaseya-supply-chain.html Thu, 01 Jul 2021 00:00:00 GMT The blog discusses the Revil ransomware attack on Kaseya's supply chain.