Adversary Intelligence & Threat Hunting

Track the Full Adversary Campaign, Not Just the Indicator

Censys ARC threat intelligence lets your team investigate, pivot to the infrastructure that matters, and feed findings back into the SOC as continuously refreshed detection feeds.

Explore capabilities Contact Us

How Censys enables threat hunting at campaign scale

Curated Threat Intelligence

Censys ARC tracks recycled infrastructure signals across named threat groups including MuddyWater, Sandworm, Volt Typhoon, Lazarus, and APT28 — with evidence drawn directly from first-party Internet scans.

Investigation Manager

Investigation Manager provides a node-based pivot map for documenting investigation trails, visualising infrastructure relationships, and monitoring how adversary campaigns evolve over time.

Signal Pivoting With CensEye

CensEye signal pivoting extracts rare, high-signal attributes — HTTP headers, SSH banners, TLS values — and surfaces how frequently they appear across the Internet, revealing hidden related infrastructure.

Open Directory Explorer

Open Directory Explorer surfaces web-accessible directories containing staged payloads, hacktools, and webshells — uncovering attacker staging infrastructure that traditional scanning often overlooks.

Historical Context & Live Rescanning

Certificate history timelines and TLS fingerprints (JARM, JA4X, JA3S) link infrastructure across campaigns, surface certificate reuse patterns, and build investigation timelines for attribution.

Operationalised Hunt Intelligence

Operationalise hunt workflows via the Censys Adversary Investigation MCP server and Censys Assistant — converting saved Collections into continuously refreshed infrastructure intelligence feeds for the SOC.

Key capabilities

Tracks adversary infrastructure by durable traits such as recycled certificates, SSH banners, and TLS fingerprints, enabling teams to follow campaigns even as attackers rapidly rotate hosts and IP addresses
Covers named threat groups including MuddyWater, Sandworm, Volt Typhoon, Lazarus, and APT28, with evidence sourced directly from first-party scans rather than third-party feeds
Investigation Manager provides a node-based pivot mapping interface so analysts can document investigation trails, visualise infrastructure relationships, and track how campaigns evolve over time
CensEye signal pivoting extracts rare HTTP, SSH, and TLS attributes to reveal how frequently they appear across the internet — uncovering hidden related infrastructure beyond the initial indicator
Open Directory Explorer surfaces web-accessible directories hosting staged payloads, hacktools, and webshells, finding attacker staging infrastructure that traditional scanning often misses
Investigations can be operationalised into SOC workflows via the Censys Adversary Investigation MCP server and Censys Assistant, converting saved Collections into continuously refreshed intelligence feeds

How It Works

Identify

Research labels and durable trait tracking — recycled certificates, SSH banners, and TLS fingerprints — pinpoint likely threat actor infrastructure across named groups including MuddyWater, Sandworm, Volt Typhoon, Lazarus, and APT28 without requiring an initial known IOC.
Investigate

CensEye signal pivoting surfaces rare HTTP, SSH, and TLS attributes that reveal attacker infrastructure patterns. Open Directory Explorer finds web-accessible directories hosting staged payloads, hacktools, and webshells — expanding the scope of each investigation automatically.
Track

Tracked Threats continuously monitors known adversary infrastructure for changes — alerting on campaign evolution without requiring manual re-query — so hunters can follow threat actors across the internet in real time rather than in point-in-time snapshots.
Operationalise

Convert investigation findings into repeatable SOC detections and enrichment feeds via Collections, APIs, and the Adversary Investigation MCP server — closing the loop from hunting discovery to durable detection engineering that benefits the wider security team.