📝 Episode Summary

We’re cutting it close but making it count! In this July edition of Ask a Thrunter, the crew drops into the studio right before Hacker Summer Camp kicks off to talk DEF CON plans, survival kit must-haves, and the latest Dispatch highlights. We’re joined by special guest Brett Schoenwald — designer, creative force, and the EDM + AI mastermind behind Elipscion — who’s making his DEF CON debut on the official artist lineup.

We swap our earliest hacker con gear lists for today’s “we’re older and wiser” essentials (spoiler: electrolytes beat out bash bunnies), break down posts on time charting in Splunk, proving pen test impact, and AI-powered hunting, and preview the Thrunting Hotlist for DEF CON 33.

The Hunt Clinic is open with subscriber questions on AI agents running hunts, our most toxic threat hunting traits, and what genre would soundtrack our latest investigations. Plus, Brett takes us behind the scenes of building his Hacker Summer Camp playlist and shares where to catch his Friday night set.

If you’re headed to the desert or just want the next best thing, this episode’s your all-access pass.

⏱ Episode Breakdown

* 00:00 – Welcome to Ask a Thrunter (July Edition)

* 01:10 – DEF CON countdown & Hacker Summer Camp theme

* 02:01 – Shoutout to new, paid, and founding subscribers

* 03:07 – Team intros: Lauren, John, Sydney, Brett

* 05:03 – Icebreaker: Hacker Summer Camp survival kit must-haves

* 07:33 – Dispatch Deep Cuts

* 08:01 – Highlight: If You Like It, Put a Time Chart on It (Sydney)

* 10:49 – Highlight: Make It Hurt (a little) (John)

* 14:21 – Highlight: The Agentic Threat Hunter (Sydney)

* 17:11 – Highlight: DEF CON 33 Thrunting Hotlist (Lauren)

* 20:21 – What we’re excited to see at DEF CON

* 23:12 – Brett’s upcoming DEF CON DJ set

* 28:23 – Villages, parties, and can’t-miss events

* 29:22 – Hunt Clinic Q&A: Would you let an AI run part of your hunt?

* 33:28 – Hunt Clinic Q&A: Toxic threat hunting traits

* 36:11 – Hunt Clinic Q&A: Soundtrack genres for your last hunt

* 37:44 – Special guest chat: Brett Schoenwald (Ellipseon)

* 46:32 – Wheel of Spins swag winner

* 47:17 – Wrap-up & next episode preview

THOR Collective Dispatch is a reader-supported publication. To receive new posts and support our work, consider becoming a free or paid subscriber.

🎤 Hosts & Guests

* Lauren Proehl (Host) – Global Head of Detection & Response at a Fortune 500 financial firm. Co-founder of THOR Collective.

* Sydney Marrone (Host) – Principal Threat Hunter at a major software company. Co-founder of THOR Collective.

* John Grageda (Host) – Red Teamer and original member of THOR. Brings a purple team/red team lens to threat hunting. Co-founder of THOR Collective.

* Brett Schoenwald (Guest) – Founder of ELIPSCION, DEF CON 33 performing artist, and official THOR Collective creative designer.

🔗 Resources & Mentions

🛠️ If You Like It, Put a Time Chart on It by Sydney Marrone💻 Make It Hurt (a little) by John Grageda🤖 The Agentic Threat Hunter by Sydney Marrone📋 DEF CON 33 Thrunting Hotlist by Lauren Proehl🎵 ELIPSCION DEF CON set on SoundCloud🎟️ DEF CON Party Listings – defconparties.org👕 THOR Collective merch – shop.thorcollective.com

📢 Call to Action

💬 Join the THOR Collective Discord (paid subscribers get live Q&A access)📬 Subscribe to the Dispatch🎯 Submit your threat hunting content for future Dispatch features👕 Rep your THOR pride with merch (code: THRUNT20)❓ Send your questions for the next Ask a Thrunter

Thanks for reading THOR Collective Dispatch! This post is public so feel free to share it.

📬 Connect with THOR Collective

* 🌐 thorcollective.com

* 🗺️ Twitter/X: THOR_Collective

* 💼 LinkedIn: THOR Collective

🎧 Episode Title:

Ask-a-Thrunter: June 2025 Recap 🐏

🗓️ Release Date:

June 2025

📝 Episode Summary

The thrunters are back in high definition! In this June edition of Ask a Thrunter, the crew settles into a new virtual podcast studio, dishes out Dispatch Deep Cuts, and unveils a massive revamp to HEARTH, our collaborative GitHub project for threat hunting hypotheses.

We talk about our favorite (and most frustrating) log sources, how AI and automation are reshaping contribution workflows, and get real about visibility gaps in Chrome extensions. The Hunt Clinic is open with subscriber questions on Python notebooks for hunting, dream hunts that never got enough data, and our unanimous answer to “What tool would you kill in your stack?”

If you love chaos, practical tips, and community-powered threat hunting, you’re in the right place.

⏱️ Episode Breakdown

* 00:00 – Welcome to Ask a Thrunter (June Edition)

* 01:18 – Team intros: John, Sydney, Lauren

* 03:11 – DEF CON DJ meetup plans to see Brett (8PM local on 8/8)

* 03:51 – Shoutout to free, paid, and founding subscribers

* 05:28 – Icebreaker: Logs we love (and hate)

* 08:25 – HEARTH gets a full revamp: new frontend, database, auto-submission from CTI

* 12:05 – Leaderboard unveiled + swag potential

* 15:40 – Dispatch Deep Cuts

* 16:22 – Highlight: From the Fire Q1 FY25 (Lauren)

* 18:45 – Highlight: If I Were a Threat Hunter (Jordan Hind)

* 23:56 – Highlight: Red With Benefits (John)

* 26:48 – Shoutouts: Plugin & Extension Hunt (Sydney), Misinformation and the Intel Cycle (Sherpa), Purple Teaming the Fallout (John)

* 31:08 – Ask a Thrunter

* 31:42 – Ask a Thrunter: Hunts we wish we could do

* 33:38 – Ask a Thrunter: Python notebooks + PEAK

* 35:43 – Ask a Thrunter: One tool to kill in your stack

* 36:50 – Giveaway winner

* 41:37 – Wrap up & see you next month!

🎤 Hosts & Guests

* Lauren Proehl (Host) – Global Head of Detection & Response at a Fortune 500 financial firm. Co-founder of THOR Collective.

* Sydney Marrone (Host) – Principal Threat Hunter at a major software company. Co-founder of THOR Collective.

* John Grageda (Host) – Red Teamer and original member of THOR. Brings a purple team/red team lens to threat hunting. Co-founder of THOR Collective.

🔗 Resources & Mentions

* 🛠️ HEARTH GitHub Project

* 🔥 From the Fire Q1 FY25 by Lauren Proehl

* 👀 If I Were a Threat Hunter by Jordan Hind

* 💻 Red With Benefits by John Grageda

* 🧩 Your Plugins and Extensions Are (Probably) Fine. Hunt Them Anyway by Sydney Marrone

* 🧠 Don't Let Mis(s) Information Take the Crown by Sherpa Intelligence

* ⚙️ Purple Teaming the Fallout: A Red Team Perspective on U.S. Infrastructure Risks Amid Israel-Iran Conflict by John Grageda

* 🎵 THOR Collective soundtrack brought to you by ELIPSCION (Brett)

📢 Call to Action

* 💬 Join the THOR Collective Discord (paid subscribers get access to live Q&A)

* 📬 Subscribe to the Dispatch

* 📝 Submit to HEARTH using your favorite CTI source

* 👕 Rep your THOR pride with merch (code: THRUNT20)

* ❓ Send your questions in for July’s Ask a Thrunter!

📬 Connect with THOR Collective

* 🌐 thorcollective.com

* 🗺️ Twitter/X: THOR_Collective

* 💼 LinkedIn: THOR Collective

🎧 Episode Title:

Ask-a-Thrunter: May 2025 Recap 🐏

🗓️ Release Date:

May 2025

📝 Episode Summary

In this episode of Ask a Thrunter, we’re catching up on the best of May and making up for missing our usual THORsday slot (thanks, Broadway). We finally do proper introductions and shout out two of our favorite Dispatch posts: one on SOC personality dynamics and another on integrating AI into your hunt workflows.

We debate whether threat hunters should be using AI, share our hottest takes (and horror stories) on LLMs, and talk about risk, tooling, and practicality when bringing generative AI into real-world hunting. There's a surprise drop you won't want to miss, and we close things out with a fantastic paid subscriber Q&A from Austin that covers rule validation, detection review cadences, and PEAK framework nuances.

If you like a little chaos with your cyber, you’re in the right place.

⏱️ Episode Breakdown

* 00:00 – Intro & Broadway vs. THORsday

* 02:03 – Team introductions: Lauren, Sydney, and John

* 05:57 – Episode overview

* 07:10 – Dispatch highlights begin

* 07:30 – Dispatch pick: Quiet, Loud, and in the Log Files by Alex Hurtado

* 12:24 – Dispatch pick: AI Is My Bestie by Lauren Proehl

* 14:11 – Claude AI hallucinations

* 17:49 – Should threat hunters use AI?

* 19:28 – Should orgs block access to LLM tools like Claude and Copilot?

* 22:37 – AI integrated in supply chain

* 24:01 – Giveaway winner announcement

* 25:05 – Ask a Thrunter Q&A

* 26:51 – Rule and detection validation question

* 30:27 – Defining queries from the PEAK template question

* 34:16 – Detection lifecycle validation question

* 37:19 – Alert vs event vs incident question

* 39:43 – Special announcement

* 39:59 – THOR Supply Shop announcement – use code THRUNT20 for 20% off!

* 41:41 – We love Brett!

* 43:28 – Outro

🎤 Hosts & Guests

* Lauren Proehl (Host) – Global Head of Detection & Response at a Fortune 500 financial firm. Co-founder of THOR Collective.

* Sydney Marrone (Host) – Principal Threat Hunter at a major software company. Co-founder of THOR Collective.

* John Grageda (Host) – Red Teamer and original member of THOR. Brings a purple team/red team lens to threat hunting. Co-founder of THOR Collective.

🔗 Resources & Mentions

* 🧵 Quiet, Loud and in the Log Files by Alex Hurtado

* 🧠 AI is My Bestie by Lauren Proehl

* 🧪 Red Canary Atomic Red Team

* 🧑‍🏫 PEAK Threat Hunting Framework

* 💬 Anthropic’s report on Claude abuse by threat actors

* 👕 THOR Collective Merch Store – use code THRUNT20 for 20% off

* 🎵 THOR Collective soundtrack brought to you by ELIPSCION (Brett)

📢 Call to Action

* 💬 Join the THOR Collective Discord (paid subscribers get access to live Q&A)

* 📬 Subscribe to the Dispatch

* 🧵 Submit your questions for June's Ask-a-Thrunter

* 👕 Use THRUNT20 at shop.thorcollective.com for merch!

📬 Connect with THOR Collective

* 🌐 thorcollective.com

* 🗺️ Twitter/X: THOR_Collective

* 💼 LinkedIn: THOR Collective

🎧 Episode Title:

Ask-a-Thrunter: May 2025 Recap 🐏

🗓️ Release Date:

May 2025

📝 Episode Summary

In this episode of Ask a Thrunter, we’re catching up on the best of May and making up for missing our usual THORsday slot (thanks, Broadway). We finally do proper introductions and shout out two of our favorite Dispatch posts: one on SOC personality dynamics and another on integrating AI into your hunt workflows.

We debate whether threat hunters should be using AI, share our hottest takes (and horror stories) on LLMs, and talk about risk, tooling, and practicality when bringing generative AI into real-world hunting. There's a surprise drop you won't want to miss, and we close things out with a fantastic paid subscriber Q&A from Austin that covers rule validation, detection review cadences, and PEAK framework nuances.

If you like a little chaos with your cyber, you’re in the right place.

⏱️ Episode Breakdown

* 00:00 – Intro & Broadway vs. THORsday

* 02:03 – Team introductions: Lauren, Sydney, and John

* 05:57 – Episode overview

* 07:10 – Dispatch highlights begin

* 07:30 – Dispatch pick: Quiet, Loud, and in the Log Files by Alex Hurtado

* 12:24 – Dispatch pick: AI Is My Bestie by Lauren Proehl

* 14:11 – Claude AI hallucinations

* 17:49 – Should threat hunters use AI?

* 19:28 – Should orgs block access to LLM tools like Claude and Copilot?

* 22:37 – AI integrated in supply chain

* 24:01 – Giveaway winner announcement

* 25:05 – Ask a Thrunter Q&A

* 26:51 – Rule and detection validation question

* 30:27 – Defining queries from the PEAK template question

* 34:16 – Detection lifecycle validation question

* 37:19 – Alert vs event vs incident question

* 39:43 – Special announcement

* 39:59 – THOR Supply Shop announcement – use code THRUNT20 for 20% off!

* 41:41 – We love Brett!

* 43:28 – Outro

🎤 Hosts & Guests

* Lauren Proehl (Host) – Global Head of Detection & Response at a Fortune 500 financial firm. Co-founder of THOR Collective.

* Sydney Marrone (Host) – Principal Threat Hunter at a major software company. Co-founder of THOR Collective.

* John Grageda (Host) – Red Teamer and original member of THOR. Brings a purple team/red team lens to threat hunting. Co-founder of THOR Collective.

🔗 Resources & Mentions

* 🧵 Quiet, Loud and in the Log Files by Alex Hurtado

* 🧠 AI is My Bestie by Lauren Proehl

* 🧪 Red Canary Atomic Red Team

* 🧑‍🏫 PEAK Threat Hunting Framework

* 💬 Anthropic’s report on Claude abuse by threat actors

* 👕 THOR Collective Merch Store – use code THRUNT20 for 20% off

* 🎵 THOR Collective soundtrack brought to you by ELIPSCION (Brett)

📢 Call to Action

* 💬 Join the THOR Collective Discord (paid subscribers get access to live Q&A)

* 📬 Subscribe to the Dispatch

* 🧵 Submit your questions for June's Ask-a-Thrunter

* 👕 Use THRUNT20 at shop.thorcollective.com for merch!

📬 Connect with THOR Collective

* 🌐 thorcollective.com

* 🗺️ Twitter/X: THOR_Collective

* 💼 LinkedIn: THOR Collective

What happens when you put a bunch of threat hunters in a Discord call and ask them questions?

* Watch the replay of our first Ask-a-Thrunter—exclusively from the THOR Collective Discord

* Want in on the next live one? Paid subscribers get access, live Q&A privileges, and a shot at monthly giveaways.

THOR Collective Dispatch is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

THOR Collective Dispatch is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.