threat-hunting
starsforks
How to install threat-hunting?
hypnguyen1209/offensive-claude/threat-hunting
$npx -y skills add hypnguyen1209/offensive-claude --skill threat-huntingUse when hunting threats or engineering detections — ATT&CK Detection-Strategies, Sigma + correlation with Detection-as-Code CI, Windows endpoint hunting (Sysmon/ETW/LSASS/LOLBins), network C2 hunting (JA4+, beaconing, DNS tunneling), cloud-identity hunting, Atomic Red Team purpl
SKILL.md
| 1 | # Threat Hunting & Detection Engineering |
| 2 | |
| 3 | ## When to Activate |
| 4 | |
| 5 | - Hypothesis-driven hunting across endpoint, network, cloud, and identity telemetry |
| 6 | - Writing & shipping detections (Sigma + correlation) as version-controlled code in CI |
| 7 | - Mapping & measuring coverage against MITRE ATT&CK v18 (Detection Strategies / Analytics) |
| 8 | - Hunting Windows post-exploitation: ETW/AMSI tampering, LSASS dumping, LOLBins, injection |
| 9 | - Hunting C2 in encrypted traffic: JA4+/JA4X fingerprints, beaconing, DNS tunneling |
| 10 | - Hunting cloud-identity attacks: Entra device-code/OAuth phishing, PRT theft, CloudTrail abuse |
| 11 | - Purple-team validation: emulate ATT&CK with Atomic Red Team/Caldera, find detection gaps |
| 12 | - Triaging EVTX/Zeek/CloudTrail offline during IR without a SIEM |
| 13 | |
| 14 | ## Technique Map |
| 15 | |
| 16 | | Technique | ATT&CK | CWE | Reference | Script | |
| 17 | |-----------|--------|-----|-----------|--------| |
| 18 | | Hypothesis-driven hunt loop (PEAK/TaHiTI) | TA0043 | CWE-778 | references/methodology-hunt-loop.md | - | |
| 19 | | ATT&CK v18 Detection-Strategies / Analytics mapping | TA0043 | CWE-778 | references/methodology-hunt-loop.md | scripts/coverage_matrix.py | |
| 20 | | Detection-as-Code CI (lint + compile) | TA0043 | CWE-778 | references/methodology-hunt-loop.md | scripts/dac_validate.py | |
| 21 | | Sysmon 15 PPL + tamper/visibility-gap | T1562.001 | CWE-693 | references/windows-endpoint-hunting.md | scripts/sysmon_config_2025.xml | |
| 22 | | ETW / AMSI in-memory patch detection | T1562.001, T1562.002 | CWE-693 | references/windows-endpoint-hunting.md | scripts/evtx_hunt.py | |
| 23 | | LSASS credential-access handle hunt | T1003.001 | CWE-522 | references/windows-endpoint-hunting.md | scripts/evtx_hunt.py | |
| 24 | | LOLBin / process-tree anomaly hunt | T1218, T1105, T1059 | CWE-78 | references/windows-endpoint-hunting.md | scripts/evtx_hunt.py | |
| 25 | | Sigma rule + correlation engineering | TA0043 | CWE-778 | references/sigma-rule-engineering.md | scripts/dac_validate.py | |
| 26 | | EVTX triage (Hayabusa/Chainsaw/Velociraptor) | TA0043 | CWE-778 | references/sigma-rule-engineering.md | scripts/sigma_pipeline.sh | |
| 27 | | JA4+/JA4X C2 fingerprinting | T1071.001 | CWE-300 | references/network-c2-hunting.md | scripts/beacon_hunter.py | |
| 28 | | Beaconing / long-conn / prevalence (RITA-style) | T1071, T1571 | CWE-940 | references/network-c2-hunting.md | scripts/beacon_hunter.py | |
| 29 | | DNS tunneling / DGA / DoH abuse | T1071.004, T1572 | CWE-940 | references/network-c2-hunting.md | scripts/beacon_hunter.py | |
| 30 | | Entra device-code / OAuth consent phishing | T1528, T1566 | CWE-287 | references/cloud-identity-hunting.md | scripts/entra_hunt.kql | |
| 31 | | PRT theft / token replay | T1550.001 | CWE-522 | references/cloud-identity-hunting.md | scripts/entra_hunt.kql | |
| 32 | | AWS CloudTrail abuse / log tampering | T1078.004, T1098, T1562.008 | CWE-269 | references/cloud-identity-hunting.md | scripts/cloudtrail_hunt.py | |
| 33 | | Atomic Red Team / Caldera validation | TA0043 | CWE-778 | references/purple-team-validation.md | scripts/coverage_matrix.py | |
| 34 | | Coverage matrix + ATT&CK Navigator + gap report | TA0043 | CWE-778 | references/purple-team-validation.md | scripts/coverage_matrix.py | |
| 35 | |
| 36 | ## Quick Start |
| 37 | |
| 38 | ```bash |
| 39 | # 0. Deploy hunting telemetry baseline (Sysmon 15+, PPL self-protected) |
| 40 | sysmon -accepteula -i scripts/sysmon_config_2025.xml # or: sysmon -c <file> to update |
| 41 | |
| 42 | # 1. Offline endpoint triage over collected EVTX (no SIEM) |
| 43 | python3 scripts/evtx_hunt.py /cases/host01/EVT |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
