Open frameworks for agentic hunting: Nebulock's ATHF, Sigma and ATT&CK

By Autonomous Threat Hunting editors · 23 September 2026

• Frameworks
• ATT&CK

Why do open frameworks matter for agents?

An agent that hunts needs three things it cannot invent for itself: a method for moving from an idea to a result, a way to write down the logic it finds, and a vocabulary for saying what that logic covers. When these are open, a team can read them, check a vendor's output against them and carry work from one tool to another. When they are closed, the same questions have to be answered from a vendor's documentation alone.

This note looks at one open resource for each need. It describes what each project publishes and what changed in 2026, taken from the projects' own pages. It does not rate them.

Nebulock's Agentic Threat Hunting Framework

Nebulock publishes two open-source projects on its GitHub organization: the Agentic Threat Hunting Framework (ATHF) and the Agentic Detection Engineering Framework. Both are released under the MIT license, which allows reuse and modification with attribution.

On its platform page, Nebulock describes its own hunting method as the LOCK framework: Learn, which starts with a hypothesis mapped to MITRE ATT&CK, then Observe, Check and Keep. Its detection engineering documentation adds a gate before anything ships: "Every detection rule must pass a Retrohunt before deployment." Together these show the shape an agentic hunt method tends to take: a hypothesis, data collection, a check, and a record kept for later.

For a buyer, the value of an open framework is that it can be read without a sales call. If a vendor says its agents follow a method, a published framework lets you compare what the method says with what the product does in a trial. The repository is the place to confirm current contents; this note does not summarise files that may change.

Sigma: a shared format for detection logic

Sigma describes itself as a "generic and open signature format" for detection rules. The SigmaHQ repository holds more than 3000 rules under the Detection Rule License 1.1, and the project maintains Sigma CLI and pySigma, which convert rules into the query languages of specific data platforms.

For agentic hunting, Sigma matters at the promotion step. When a hunt finds something worth keeping, the logic has to be written down in a form that can be reviewed, tested and deployed. A rule in an open format can be read by a person who does not use the vendor's product, converted for more than one data platform, and kept in version control like any other code.

The project publishes releases on a regular cadence. In 2026 so far:

• r2026-01-01, published 29 January 2026: 33 new rules, with emphasis on EDR evasion and vulnerable driver abuse.
• r2026-04-01, published 28 April 2026: 54 new rules and improvements to more than 60 existing detections, focused on NPM compromises and credential access.
• r2026-07-01, published 9 July 2026: 20 new rules and updates to more than 80 existing rules, including supply-chain attack coverage.

A useful trial question follows: if the system writes or proposes detections, can it export them as Sigma, and can it read existing Sigma rules as input to a hunt?

MITRE ATT&CK: the shared vocabulary

MITRE ATT&CK is a public knowledge base of adversary tactics and techniques. Hunts start from hypotheses that name techniques, and detections are mapped back to them, so ATT&CK is how a hunting agent says what it looked for and what a rule covers. Most vendor entries in this guide's directory state some form of ATT&CK mapping.

2026 brought structural changes that affect any mapping:

• On 14 April 2026 ATT&CK created tactic TA0112, Defense Impairment, covering adversary efforts to undermine security mechanisms and monitoring.
• ATT&CK v19, released 28 April 2026, split the Enterprise Defense Evasion tactic into Stealth and Defense Impairment. It lists 15 Enterprise tactics and 222 techniques.
• MITRE's updates page dates v19.2 to 6 August 2026. It is described as the first narrower-scope agile release and adds groups including ShinyHunters and TeamPCP, with related supply chain software.

The practical consequence for agentic hunting is that a coverage map built against an earlier version may file techniques under a tactic that no longer exists. When a vendor shows ATT&CK coverage, ask which version it is mapped to and how the mapping is updated when MITRE publishes a new release.

Other open work at the agent layer

Open specifications are also appearing for the agents themselves. On 4 August 2026 Vega released Detection Skills, which it describes as an open specification built on the Agent Skills format, with a library of more than 50 skills. Specifications at this layer are newer than Sigma or ATT&CK, so the same test applies: read the published specification, then check what a product does with it.

How the three fit together

A simple way to hold them: ATT&CK names what an adversary does, a hunting framework such as ATHF describes how an agent goes looking for it, and Sigma records what was found as logic others can reuse. A system that uses all three openly leaves a trail a reviewer can follow from hypothesis to rule. The page on how autonomous threat hunting works maps these steps to the six stages of a hunt, and the glossary defines each term.

Sources

• Nebulock on GitHub github.com
• Nebulock, platform nebulock.io
• Nebulock, detection engineering docs docs.nebulock.io
• SigmaHQ, Sigma repository github.com
• SigmaHQ, releases github.com
• MITRE ATT&CK, Enterprise tactics attack.mitre.org
• MITRE ATT&CK, TA0112 Defense Impairment attack.mitre.org
• MITRE ATT&CK, April 2026 update (v19) attack.mitre.org
• MITRE ATT&CK, updates attack.mitre.org
• Vega, Detection Skills announcement vega.io