Nebulock Blog
Insights, research, and more in threat hunting and proactive secops.
Nebulock Raises $25M Series A for Hunt-First, Always-On Security Operations
Today we're announcing our $25 million Series A funding, led by FirstMark, to build a hunt-first contextual security platform.
.avif)
.avif)
AI Artifacts: A New Layer of Endpoint Activity to Hunt
AI assistants and coding tools introduce a new layer of endpoint activity. These tools operate with a high degree of access: they read local files, execute commands, persist prompts and context, and communicate with external APIs. In many environments, this creates a blind spot where AI-assisted activity can occur with little to no detection coverage.
Hunting MCP Server Exploitations
Shadow AI is not a future risk. It is already inside your environment. Developers are connecting MCP servers to AI clients without centralized approval, visibility, or governance. These servers inherit user-level access, persist across sessions, and execute locally with no additional authentication prompt. From a defender's perspective, the activity looks like the user did it — because the process tree says so. That is the problem. And it is exactly where you hunt.
Hunting Supply Chain Compromises LiteLLM & Axios
Supply chain attacks are not new. What is new is the pace and the precision. In the recent Axios and TeamPCP campaigns, we have different actors, different tooling, but the same fundamental constraint: both must install through package managers, execute outside the language runtime, access credentials, persist, and communicate externally. Each step leaves a behavioral trace that outlasts any IOC list.
Vespyr: Your Autonomous Hunter
Autonomous hunting means the agent doesn't wait for a user directive. It monitors global intelligence, determines what's relevant to your environment, scopes and executes the hunt, and delivers findings without anyone having to kick it off. The human reviews, validates, and acts. The agent does everything before that.
Hunting the Notepad++ Update Hijack
Software supply chain attacks have shifted from occasional, high-profile incidents into a repeatable and increasingly preferred intrusion technique and the Notepad++ incident is the latest evolution. This gives hunters a case for looking at deviations from behavioral baselines.
coreSigma: Developing an Endpoint Security Framework Pipeline
The need for standardized macOS detection capabilities is clear. Based on the response to introducing coreSigma, we wanted to make it even easier for the community to gain additional macOS observability and implement their own macOS detections in their environment. That’s why we’ve made coreSigma publicly available in the Nebulock GitHub repository.
Vibe Hunting: Outcome-Driven Threat Hunting
Vibe Hunting is the meeting of human intuition with machine reasoning. Agents built by hunters to democratize threat hunting. Not just another co-pilot or AI overlay, but an enabler for security teams to add threat hunting to their skillset whether there’s dedicated threat hunters or not.
coreSigma: Expanding Sigma Detection for macOS
coreSigma, a macOS endpoint telemetry collection, detection, and analysis app built with the primary goal of extending Sigma's capabilities for macOS ESF and UL logs. Learn how coreSigma expands visibility and ways take a more proactive approach to macOS threat detection and response.
Hunt-first security
For what your alerts can't see.