threat-hunting
FeaturedUse when hunting threats or engineering detections — ATT&CK Detection-Strategies, Sigma + correlation with Detection-as-Code CI, Windows endpoint hunting (Sysmon/ETW/LSASS/LOLBins), network C2 hunting (JA4+, beaconing, DNS tunneling), cloud-identity hunting, Atomic Red Team purple-team validation
Install
Quality Score: 95/100
Skill Content
Details
- Author
- hypnguyen1209
- Repository
- hypnguyen1209/offensive-claude
- Created
- 4 months ago
- Last Updated
- 5 days ago
- Language
- Python
- License
- MIT
Bundled in these plugins
Similar Skills
Semantically similar based on skill content — not just same category
threat-hunting
Plan, run, and write up hypothesis-driven threat hunts (PEAK / TaHiTI style): turn a threat report, an ATT&CK technique, a coverage gap, an anomaly, or "something feels off" into a testable hypothesis with data sources, queries, expected benign volume, an analysis technique (stacking, prevalence, baselining, clustering, sequencing, outliers), success criteria, and hand-offs. Use it whenever someone says "hunt for", "go look for", "is anyone doing X in our environment", "what should we hunt this week", "build a hunt from this report", "stack these values", "what is rare here", "baseline this data source", or hands over a CSV/JSONL export and asks what stands out. Also use it when a report or a purple-team result implies behaviour that no alert covers, even if nobody says the word hunt.
cybersecurity-analyst
Activates CybersecurityAnalyst for advanced threat detection, hunting, and incident response. Use when you need MITRE ATT&CK framework-based threat modeling, threat hunting hypothesis development and query writing, digital forensics and incident response (DFIR) investigation guidance, dark web and threat intelligence analysis, or security operations center (SOC) playbook design.
defense-log-analysis
Hunt for attacker activity in logs — auth, web, cloud, endpoint — with concrete queries and what to look for. Load for blue-team log/SIEM hunting, "analyze these logs", "find the attack", triage of auth/web/cloud logs, or building hunts. Signals: log files/SIEM, "what happened", IOC hunting.