
Threat Hunting Case Study: FileFix
FileFix bypasses Mark of the Web (MotW) protections by hijacking the Windows File Explorer address bar. Here is how to hunt for it.

The HUNTER Platform streamlines organizations’ threat hunting operations and processes. Whether you are a mature, battle-hardened, hunt team, or just getting started, the HUNTER threat hunting content platform will get you hunting faster and more repeatable. HUNTER isn’t just for threat hunters though – it can upskill and reskill existing SOC teams into threat hunters and extend scarce content and SIEM engineering resources!
Check out some of the ways Cyborg Security’s customers and partners are using the HUNTER threat hunting content platform!
The HUNTER Platform helps security teams recognize and increase the ROI of their existing security tools. HUNTER enables security teams to significantly enhance the capabilities of organizations’ existing SIEM, EDR, NDR, and XDR toolsets without the need to rip and replace another appliance or agent. Instead, the HUNTER Platform can deliver best-in-class threat hunting content while allowing organizations to continue to use their existing tools and platforms.

FileFix bypasses Mark of the Web (MotW) protections by hijacking the Windows File Explorer address bar. Here is how to hunt for it.

Initial access brokers sell information about or access to compromised computers. Here's how to threat hunt for a known attack behavior involving PowerShell that's used by a prolific initial access broker.

In July 2025 threat actors exploited zero-day vulnerabilities in on-premises Microsoft SharePoint servers in an incident known as ToolShell. In this case study, we conduct a threat hunt for ToolShell-related activity.
Stay informed with our weekly executive update, sending you the latest news and timely data on the threats, risks, and regulations affecting your organization.