threat-hunting

Name: threat-hunting
Author: briiirussell

320stars36forks

How to install threat-hunting?

briiirussell/cybersecurity-skills/threat-hunting

$npx -y skills add briiirussell/cybersecurity-skills --skill threat-hunting

Installs into the current project.

Summary

Conduct proactive, hypothesis-driven threat hunts — search SIEM / EDR / logs for adversaries who haven't tripped an alert yet. ATT&CK-driven, hypothesis-based methodology. Use when the user mentions 'threat hunting,' 'proactive hunt,' 'TaHiTI,' 'PEAK framework,' 'MITRE ATT&CK hun

Files · 1

View on GitHub

SKILL.md

1	# Threat Hunting — Proactive Adversary Detection
2
3	Hunt for adversaries who are already inside but haven't tripped an alert. Distinct from `incident-triage` (reactive, alert is firing) and from `siem-detection` (engineer rules so future alerts fire). This skill is the proactive layer — assume something has slipped through, look for it.
4
5	Hunting is hypothesis-driven, not browse-driven. "Let's look around the SIEM" is not hunting; "let's check for the specific pattern of T1059.001 (PowerShell) being launched by Office processes" is.
6
7	Cross-references: `siem-detection` (queries you write here often graduate to detection rules), `incident-triage` (what to do if a hunt confirms a finding), `breach-patterns` (a rich source of hunt hypotheses), `disk-forensics` (deeper analysis on confirmed hits).
8
9	## Methodology — PEAK framework
10
11	The PEAK (Prepare, Execute, Act, Knowledge) framework from Splunk SURGe — the most actionable hunting methodology I've seen.
12
13	### Step 1: Prepare
14
15	Form the hypothesis. Strong hypotheses share three properties:
16
17	1. Specific — names a technique, log source, and expected artifact
18	2. Testable — describes what evidence would confirm or deny
19	3. Bounded — has a defined time window and scope
20
21	Bad hypothesis: "Look for anomalies in the SIEM"
22	Good hypothesis: "Within the last 30 days, no service account should have run interactive PowerShell with `-encodedCommand` flag (T1059.001 + T1027). Search Sysmon event 1 for parent process = service-account-launched scheduled task, child = `powershell.exe`, command line contains `-enc` or `-encodedcommand`."
23
24	Hunt hypothesis sources, ranked by yield:
25
26	\| Source \| Yield \| Effort \|
27	\|---\|---\|---\|
28	\| Recent incident (yours or peer's) \| High \| Low — pattern is concrete \|
29	\| `breach-patterns` skill catalog \| High \| Low — generalizes from public breaches \|
30	\| MITRE ATT&CK technique you don't have a detection for \| Medium \| Medium — read the technique, design the hunt \|
31	\| Threat intel report (CrowdStrike, Mandiant, vendor reports) \| Medium \| Medium — current patterns \|
32	\| Anomaly: "this number went up — why" \| Low \| Low — often FP, occasionally gold \|
33
34	### Step 2: Execute
35
36	Run the hunt. Three execution patterns:
37
38	Pattern A — Pivot from indicator. Start with a specific IOC (IP, hash, domain) and look for any host or user that touched it.
39
40	```kql
41	// Sentinel — pivot from a suspicious IP across all log sources
42	union *
43	\| where TimeGenerated > ago(90d)
44	\| where contains("198.51.100.42")
45	\| project TimeGenerated, Type, Computer, _ResourceId
46	```
47
48	Pattern B — Pivot from technique. Start with an ATT&CK technique and look for any host doing that.
49
50	```spl
51	// Splunk — T1547.001 Registry Run Keys persistence
52	index=sysmon EventCode=13
53	TargetObject="\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\"
54	\| stats values(Details) by Computer, User
55	\| where len(values(Details)) > 1
56	```
57
58	Pattern C — Anomaly hunt. Establish a baseline; look for outliers.
59
60	```kql
61	// Sentinel — service accounts authenticating from new geographies
62	SigninLogs
63	\| where TimeGenerated > ago(30d)
64	\| where UserType == "Service"
65	\| summarize Countries = make_set(Location) by UserPrincipalName
66	\| where array_length(Countries) > 1
67	```
68
69	### Step 3: Act
70
71	For every hit, three possible outcomes:
72
73	\| Outcome \| Action \|
74	\|---\|---\|
75	\| Confirmed malicious \| Escalate to `incident-triage` immediately \|
76	\| Confirmed benign \| Document and move on \|
77	\| Unknown / unable to confirm \| Deepen investigation (host artifacts, network traffic, user interview) \|
78
79	Don't leave hits in the "unknown" state. Either resolve, or hand off with a documented next-step.
80
81	### Step 4: Knowledge
82
83	The hunt's value isn't the one hit — it's the artifacts.
84
85	For each hunt:
86
87	- If you found something, write a detection rule so future occurrences fire automatically (see `siem-detection`)
88	- If you didn't find anything, document the hunt — query, scope, time window, conclusion. Future hunters won't re-do it
89	- If the hunt was hard because of missing log coverage, document the gap and create a backlog item to fix log ingestion
90
91	Hunts that don't produce artifacts are work without compounding return. The whole point of the methodology is to turn every hunt into either a rule, a documented dead-end, or a coverage improvement.
92
93	## High-yield hunt catalog
94
95	### Persistence
96
97	- Scheduled tasks created outside business hours — `schtasks

briiirussellPublisher · 30 listings

Preview

briiirussell/cybersecurity-skills

# Threat Hunting — Proactive Adversary Detection

Hunt for adversaries who are already inside but haven't tripped an alert. Distinct from `incident-triage` (reactive, alert is firing) and from `siem-detection`

Hunting is hypothesis-driven, not browse-driven. "Let's look around the SIEM" is not hunting; "let's check for the specific pattern of T1059.001 (PowerShell) be

Cross-references: `siem-detection` (queries you write here often graduate to detection rules), `incident-triage` (what to do if a hunt confirms a finding), `bre

Repobriiirussell/cybersecurity-skills

LicenseMIT

TypeSkills

CategorySecurity

UpdatedMay 2026

Repo stars320

First seenJul 22, 2026

People who liked this also viewed

6 picks

Type

threat-hunting

320stars36forks

View on GitHub

How to install threat-hunting?

briiirussell/cybersecurity-skills/threat-hunting

$npx -y skills add briiirussell/cybersecurity-skills --skill threat-hunting

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Threat Hunting — Proactive Adversary Detection
2
3	Hunt for adversaries who are already inside but haven't tripped an alert. Distinct from `incident-triage` (reactive, alert is firing) and from `siem-detection` (engineer rules so future alerts fire). This skill is the proactive layer — assume something has slipped through, look for it.
4
5	Hunting is hypothesis-driven, not browse-driven. "Let's look around the SIEM" is not hunting; "let's check for the specific pattern of T1059.001 (PowerShell) being launched by Office processes" is.
6
7	Cross-references: `siem-detection` (queries you write here often graduate to detection rules), `incident-triage` (what to do if a hunt confirms a finding), `breach-patterns` (a rich source of hunt hypotheses), `disk-forensics` (deeper analysis on confirmed hits).
8
9	## Methodology — PEAK framework
10
11	The PEAK (Prepare, Execute, Act, Knowledge) framework from Splunk SURGe — the most actionable hunting methodology I've seen.
12
13	### Step 1: Prepare
14
15	Form the hypothesis. Strong hypotheses share three properties:
16
17	1. Specific — names a technique, log source, and expected artifact
18	2. Testable — describes what evidence would confirm or deny
19	3. Bounded — has a defined time window and scope
20
21	Bad hypothesis: "Look for anomalies in the SIEM"
22	Good hypothesis: "Within the last 30 days, no service account should have run interactive PowerShell with `-encodedCommand` flag (T1059.001 + T1027). Search Sysmon event 1 for parent process = service-account-launched scheduled task, child = `powershell.exe`, command line contains `-enc` or `-encodedcommand`."
23
24	Hunt hypothesis sources, ranked by yield:
25
26	\| Source \| Yield \| Effort \|
27	\|---\|---\|---\|
28	\| Recent incident (yours or peer's) \| High \| Low — pattern is concrete \|
29	\| `breach-patterns` skill catalog \| High \| Low — generalizes from public breaches \|
30	\| MITRE ATT&CK technique you don't have a detection for \| Medium \| Medium — read the technique, design the hunt \|
31	\| Threat intel report (CrowdStrike, Mandiant, vendor reports) \| Medium \| Medium — current patterns \|
32	\| Anomaly: "this number went up — why" \| Low \| Low — often FP, occasionally gold \|
33
34	### Step 2: Execute
35
36	Run the hunt. Three execution patterns:
37
38	Pattern A — Pivot from indicator. Start with a specific IOC (IP, hash, domain) and look for any host or user that touched it.
39
40	```kql
41	// Sentinel — pivot from a suspicious IP across all log sources
42	union *
43	\| where TimeGenerated > ago(90d)
44	\| where contains("198.51.100.42")
45	\| project TimeGenerated, Type, Computer, _ResourceId
46	```
47
48	Pattern B — Pivot from technique. Start with an ATT&CK technique and look for any host doing that.
49
50	```spl
51	// Splunk — T1547.001 Registry Run Keys persistence
52	index=sysmon EventCode=13
53	TargetObject="\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\"
54	\| stats values(Details) by Computer, User
55	\| where len(values(Details)) > 1
56	```
57
58	Pattern C — Anomaly hunt. Establish a baseline; look for outliers.
59
60	```kql
61	// Sentinel — service accounts authenticating from new geographies
62	SigninLogs
63	\| where TimeGenerated > ago(30d)
64	\| where UserType == "Service"
65	\| summarize Countries = make_set(Location) by UserPrincipalName
66	\| where array_length(Countries) > 1
67	```
68
69	### Step 3: Act
70
71	For every hit, three possible outcomes:
72
73	\| Outcome \| Action \|
74	\|---\|---\|
75	\| Confirmed malicious \| Escalate to `incident-triage` immediately \|
76	\| Confirmed benign \| Document and move on \|
77	\| Unknown / unable to confirm \| Deepen investigation (host artifacts, network traffic, user interview) \|
78
79	Don't leave hits in the "unknown" state. Either resolve, or hand off with a documented next-step.
80
81	### Step 4: Knowledge
82
83	The hunt's value isn't the one hit — it's the artifacts.
84
85	For each hunt:
86
87	- If you found something, write a detection rule so future occurrences fire automatically (see `siem-detection`)
88	- If you didn't find anything, document the hunt — query, scope, time window, conclusion. Future hunters won't re-do it
89	- If the hunt was hard because of missing log coverage, document the gap and create a backlog item to fix log ingestion
90
91	Hunts that don't produce artifacts are work without compounding return. The whole point of the methodology is to turn every hunt into either a rule, a documented dead-end, or a coverage improvement.
92
93	## High-yield hunt catalog
94
95	### Persistence
96
97	- Scheduled tasks created outside business hours — `schtasks

briiirussellPublisher · 30 listings

Preview

briiirussell/cybersecurity-skills

# Threat Hunting — Proactive Adversary Detection

Hunt for adversaries who are already inside but haven't tripped an alert. Distinct from `incident-triage` (reactive, alert is firing) and from `siem-detection`

Hunting is hypothesis-driven, not browse-driven. "Let's look around the SIEM" is not hunting; "let's check for the specific pattern of T1059.001 (PowerShell) be

Cross-references: `siem-detection` (queries you write here often graduate to detection rules), `incident-triage` (what to do if a hunt confirms a finding), `bre

Repobriiirussell/cybersecurity-skills

LicenseMIT

TypeSkills

CategorySecurity

UpdatedMay 2026

Repo stars320

First seenJul 22, 2026

People who liked this also viewed

6 picks

Type