Project 03 — Threat Intelligence
HunterEngine
Deterministic threat-enrichment engine. Maps phishing and insider lures to MITRE ATT&CK, generates YARA + STIX 2.1.
A glass-box analyzer for suspicious text. HunterEngine triages phishing, business-email-compromise, and insider-exfiltration lures—scoring, extracting indicators, mapping ATT&CK techniques, and generating reports. Deterministic first; optional Claude advisory layer.
The problem
Threat triage tools either hide their logic behind AI ("just trust the score") or require manual inspection. Teams can't defend what they don't understand, and security findings that shift between runs erode trust.
What HunterEngine does
It puts the scoring rules in plain sight. Same input → same verdict, every time. The engine reads keywords, extracts indicators, maps MITRE ATT&CK techniques deterministically, and generates YARA rules. The AI is optional, strictly advisory, and never changes the core score.
What you get
-
1
Deterministic-first scoring
Readable heuristic rules. Same input always produces the same verdict. Turn off the AI—numbers stay byte-for-byte identical.
-
2
Fail-closed ATT&CK mapping
Techniques validated against real MITRE ATT&CK dataset. Unknown IDs are logged and skipped, never guessed.
-
3
Professional reporting
MITRE ATT&CK Navigator layers, case-by-tactic heatmaps, executive summaries, and anonymized charts for sharing.
-
4
STIX 2.1 & YARA
Machine-readable intel bundles for MISP, OpenCTI, and SIEMs. One deployable YARA rule per scored item.
-
5
Optional AI advisory
Cloud or local Claude enrichment adds analyst notes. Strictly advisory—it never touches the verdict.
-
6
Safe to share
Reports contain no message content. Cases anonymized; only indicators of compromise are included.