Mastering ANY.RUN TI Lookup: Building High‑Fidelity Threat Hunting Queries with IOCs, IOAs & IOBs

ANY.RUN’s TI Lookup is a fast threat intelligence search platform designed to enrich investigations using IOCs, IOAs, and IOBs from sandbox telemetry. This post turns the official query guide into a practical SOC playbook—covering query types, key fields, wildcards, operators, and subscription-based monitoring you can operationalize for threat hunting.