thrunt.me is a threat intel to detection pipeline run by Applied Cybernetics Group. Every morning it pulls leak-site postings, SEC filings, breach notices from state attorneys general and HHS, data-breach class actions, CISA KEV, EPSS, NVD, MITRE ATT&CK, about fifty research publishers, government advisories and the SigmaHQ, Elastic and Splunk rule sets into one SQLite database, and this site is what comes out the other end.
What you get
- Hunt packages for every group posting victims: who they hit, what's been written about them, their techniques, which rules cover those techniques, and the indicators to sweep.
- Sigma rules written from those reports, each one citing the report it came from. Grab rules.tar.gz, or pin rules.lock.json in CI.
- Convergence: organizations named by two independent parties, such as a leak site and the company's own 8-K or breach notice.
- A daily brief and the corpus behind it.
Why it's free
A detection rule gets better when more people run it and tell you where it breaks. Put it behind a login and fewer people run it, and nobody can see where it came from. So everything here is CC BY 4.0, there are no accounts, and every rule and package links the reports it was built from. Check them before you deploy anything.
Caveats
Leak-site postings are the attacker's claims. ATT&CK lags the groups it profiles, and plenty of busy groups have no public reporting at all; their packages note that. The rules are experimental until someone has run them against real traffic. If one misfires in your environment, we want to hear about it.
Not here
The site has no trackers, analytics, third-party fonts, comments, newsletter or paywall.
Feeds
Briefs: /feed.xml. Rules: /sigma/sigma-feed.xml. Convergence: /convergence/feed.xml. Hunt packages: /hunt/index.json.