Threat hunting for
actors, not alerts.

Not a security operations center

People searching for threat hunting often want a SOC: endpoint alerts, a SIEM, and a night shift. That is not this practice. Rook hunts people and networks. The questions are who is behind an account or a campaign, how the infrastructure connects, and whether an insider or a fraud ring is already inside the picture.

What the work produces

• Threat-actor attribution and profiling, where the sources support it
• Infrastructure and network mapping
• Insider and fraud investigations
• A written record counsel can use in a civil matter, a referral, or a board conversation

Findings from this kind of work have supported criminal referrals, civil cases, Office of Inspector General investigations, expert witness testimony, and judicial filings. Those are categories of historical use, not a promise about your matter, and not a description of any named client.

Anonymous and coordinated accounts

Often, accounts that look anonymous or coordinated can be linked to the people or organizations behind them, combining technical signals with the same open-source analysis used elsewhere on the practice. Often is not always. The scoping call is where the firm says whether the sources are likely to support an answer.

What is not on this page

Collection procedures, tool lists, and anything that would help someone target a private person are not published. Unlawful access is out of scope. If the question is a real matter, counsel or the principal requests a confidential call. If the question is how to do it yourself, this site will not answer it.

Related work: fractional OSINT when the requirement is ongoing, and protective intelligence when the question is a principal's exposure rather than an actor's infrastructure.