The source compiles huntable procedures mapped to Lazarus Group references in MITRE ATT&CK, while explicitly warning that the hunts are not proof of compromise or independent attribution. It highlights initial-access tradecraft such as DOCX phishing, RAR-delivered LNK files that execute payloads and open decoy PDFs, and template injection using remote Office templates. The hunting guidance also covers scheduled tasks or renamed wmic activity loading remote XSL, certutil decoding, regsvr32 and other LOLBAS DLL execution, PowerShdll use, VS Code project build abuse, wmic lateral movement, and startup-folder LNK persistence. The value is operational detection logic for known Lazarus-attributed procedures rather than a single new intrusion report.