Nebulock Blog

Hunting the Notepad++ Update Hijack

Software supply chain attacks have shifted from occasional, high-profile incidents into a repeatable and increasingly preferred intrusion technique and the Notepad++ incident is the latest evolution. This gives hunters a case for looking at deviations from behavioral baselines.

Nebulog: What's New in Nebulock

The latest Nebulock product updates: Insights, integrations, additional detection, SOC 2 Type 2, and more.

Hunting OpenClaw and Agentic AI Through Behavior

This Hunt Mode breaks down the behaviors that give away OpenClaw (formerly ClawdBot / MoltBot), regardless of how it is packaged, renamed, or delivered.

coreSigma: Developing an Endpoint Security Framework Pipeline

The need for standardized macOS detection capabilities is clear. Based on the response to introducing coreSigma, we wanted to make it even easier for the community to gain additional macOS observability and implement their own macOS detections in their environment. That’s why we’ve made coreSigma publicly available in the Nebulock GitHub repository.

Hunting DigitStealer: Behaviors That Give Away macOS Infostealers

DigitStealer is the next evolution of macOS malware evolution. This breakdown outlines the behaviors to observe to properly hunt for it in your environment.

CVE-2025-55182: Finding Behaviors That Give Away React Server Components RCE

Breakdown of the hunt for the malicious behaviors in CVE-2025-55182, a pre-authentication exploit that bypasses most traditional web app firewalls and signature-based controls.

The Agentic Threat Hunting Framework

Give your threat hunting program memory and agency.

Vibe Hunting: Outcome-Driven Threat Hunting

Vibe Hunting is the meeting of human intuition with machine reasoning. Agents built by hunters to democratize threat hunting. Not just another co-pilot or AI overlay, but an enabler for security teams to add threat hunting to their skillset whether there’s dedicated threat hunters or not.

coreSigma: Expanding Sigma Detection for macOS

coreSigma, a macOS endpoint telemetry collection, detection, and analysis app built with the primary goal of extending Sigma's capabilities for macOS ESF and UL logs. Learn how coreSigma expands visibility and ways take a more proactive approach to macOS threat detection and response.

Why I Joined Nebulock

Introducing Nebulock: Agentic Threat Hunting for Everyone

We've launched the first autonomous threat hunting platform to democratize threat hunting for all security teams.