What's new

The hunt loop

Threat hunting is proactively searching for attacker activity that evaded your detections. It is not "go look at logs" — it is testing a specific, falsifiable idea about what an adversary is doing in your environment.

• 1 · Scope. Write an ABLE hypothesis: an Actor performing a Behavior in a Location you can see, leaving Evidence in a named data source. Map it to ATT&CK. Define what would prove or disprove it (success criteria). A good hypothesis is falsifiable — you can describe the data that would prove you wrong.
• 2 · Hunt. Work through your analysis steps, data source by data source. Write the query before you run it. Record the result of every step — even "nothing found." Triage each finding: benign, suspicious, malicious, or inconclusive. Escalate anything malicious immediately; don't wait for the hunt to close.
• 3 · Conclude. Declare the outcome: proven, disproven, inconclusive, or still open. Then produce at least one improvement: a new detection rule, a visibility gap you found, a response playbook update, or a baseline that makes the next hunt faster. A hunt that finds nothing but creates a detection still won.

Hunt for behaviors, not indicators. Aim at the top of the Pyramid of Pain — TTPs and tools are durable detection targets. An adversary can rotate a hash in minutes; changing their technique takes weeks.

Open the ⬡ PoP button in any hunt footer for the full Pyramid of Pain reference, or ? Glossary for term definitions.

Where your hunts live

Every hunt program is stored in your browser's localStorage, on this device and this browser only. Nothing is uploaded anywhere.

Backing up

The Export button saves every program to a single .pumapack file; ⌘/Ctrl+S saves a quick .json backup. Restore either with Import, or by dragging the file onto the window.

Clear all local data

About PumaHunter

PumaHunter is a lightweight, offline threat-hunting workbench that runs entirely in your browser. It is built for technically capable people — analysts, incident responders, sysadmins — who can query their own data but have never been handed a repeatable hunt method. The same "teach by doing" stance as PumaTTX.

This tool is provided as-is, for informational and productivity purposes only. It is not professional security advice. All hunting decisions, findings, and escalations are your own.

About PumaWorx

PumaWorx is a suite of offline, single-HTML productivity apps that run entirely in your local browser. The entire suite is a personal, open source vibecoding project.