CodeHunter is a behavioral analysis platform for Zero Trust for Code. Under Zero Trust for Code, no software is trusted because of where it came from or whether it has been seen before. It earns trust through behavioral verification before it runs.
What CodeHunter shows you
CodeHunter analyzes files and software artifacts down to the binary level, without executing them, and shows you what each one is capable of doing: how it interacts with the operating system, what it communicates with, what it changes, and how those actions connect. Each behavior is categorized and mapped to MITRE ATT&CK and the MITRE Malware Behavior Catalog (MBC). Verdicts and recommended next steps come from those behaviors, so your team can decide whether an artifact should be allowed to run and has the evidence to back that decision.
How the analysis works
Behavior Specification Units (BSUs): CodeHunter's proprietary units for describing program behavior, independent of any specific algorithm or coding technique.
Data-flow analysis: links behaviors together. For example, it can establish that a file an artifact downloads is the same file it later launches, rather than reporting two unrelated capabilities.
Malicious vs. dangerous: malicious behaviors have no legitimate use. Dangerous behaviors are powerful or context-dependent (broad file-system access, for example) and can be appropriate in the right software. CodeHunter labels them separately so you can judge risk in context.
Deterministic findings: the same artifact produces the same findings every time, with the evidence behind each one.
The approach is covered by three U.S. patents (12,190,128; 12,223,061; 12,259,805).
Why behavior matters
Signature and hash matching tells you whether a file has been seen before. New, modified, and AI-generated code often has no history to match against. Behavioral analysis evaluates what the code can do, whether or not anyone has seen it before.
Where CodeHunter fits
CodeHunter integrates with your EDR and delivers its findings into the workflow you already run. When your EDR flags an artifact, CodeHunter analyzes it and returns the behaviors, mappings, and verdict in minutes. SentinelOne is our productized integration today.
Questions about submitting an artifact, reading behavior findings, or how CodeHunter maps to MITRE ATT&CK? Ask here.