A collection of actionable threat hunting runbooks published as a static GitHub Pages site. Each runbook covers a specific threat actor or campaign with KQL detection queries, IOC tables, MITRE ATT&CK mappings, and investigation guidance.
| Runbook | Type | Severity |
|---|---|---|
| Axios NPM Supply Chain RAT | Supply Chain | Critical |
| Notepad++ Hijacking (Chrysalis) | Supply Chain | Critical |
| Rekoobe Backdoor via Go Crypto Module | Supply Chain | Critical |
| SANDWORM_MODE npm Worm | Supply Chain | Critical |
| Shai-Hulud NPM Supply Chain Attack | Supply Chain | Critical |
| StegaBin / FAMOUS CHOLLIMA | Supply Chain | Critical |
| Void Manticore / Handala Hack | APT | Critical |
| APT38 / Lazarus Group | APT | Critical |
| Etelaat Team | APT | Critical |
| Salt Typhoon | APT | Critical |
| Scattered Spider | APT | Critical |
index.htmlfetchesreports.jsonat runtime to list all reportsreports.jsonis auto-generated by a GitHub Action (.github/workflows/update-reports.yml) that parses<meta>tags from each report HTML file on every push - do not edit it manually- All CSS and JavaScript is self-contained in each report file (no external dependencies except Google Fonts)
- Copy
TEMPLATE-threat-hunt-runbook.htmland rename it{name}-threat-hunt-runbook.html - Fill in all
REPORT_TITLE,QUERY_TITLE, and other placeholders - Set the required meta tags in
<head>:
<meta name="report-title" content="Report Title">
<meta name="report-description" content="Brief description of the threat.">
<meta name="report-severity" content="critical|high|medium|low">
<meta name="report-type" content="Supply Chain|APT|Malware|General">
<meta name="report-tags" content="tag1,tag2,tag3">
<meta name="report-date" content="Mon DD, YYYY">
<meta name="report-queries" content="10">
<meta name="report-version" content="1.0">- Commit and push — the GitHub Action will update
reports.jsonautomatically