Advanced Threat Hunting: Automating Large-Scale Operations with LLMs

This report recaps a LABScon workshop on automating large-scale threat hunting with the VirusTotal API and Gemini in Google Colab, featuring a “meta Colab” preloaded with reference documentation and vt-py code snippets. It walks through practical examples—such as hunting malicious LNK files over a time range, flattening and visualizing attributes, building Sankey diagrams of relationships, and mapping submission geographies—along with additional query ideas for campaigns, threat actors, and malware. The focus is on methodology, tooling, and scalable analysis workflows rather than specific incidents or IoCs.