06-threat-hunting

Name: 06-threat-hunting
Author: Masriyan

190stars37forks

How to install 06-threat-hunting?

masriyan/claude-code-cybersecurity-skill/06-threat-hunting

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 06-threat-hunting

Installs into the current project.

Summary

IOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generation, and detection rule creation

Files · 1

View on GitHub

SKILL.md

1	# Threat Hunting & IOC Analysis
2
3	## Purpose
4
5	Enable Claude to assist threat hunters with proactive threat detection, IOC extraction and normalization, MITRE ATT&CK mapping, hunt hypothesis generation, and converting threat intelligence into actionable detection rules across all major SIEM platforms.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Extracting IOCs from threat reports, emails, or security advisories
13	- Mapping behaviors or TTPs to MITRE ATT&CK framework
14	- Generating hunt hypotheses for a specific threat actor or technique
15	- Creating Sigma rules, Splunk SPL queries, KQL, or EQL
16	- Converting threat intelligence into SIEM detection queries
17	- STIX/TAXII or MISP-compatible indicator formatting
18	- ATT&CK Navigator layer creation
19	- Threat intelligence correlation across multiple sources
20	- Proactive threat hunting in a SIEM or EDR
21
22	---
23
24	## Prerequisites
25
26	```bash
27	pip install requests pyyaml stix2 taxii2-client
28	```
29
30	Optional platforms:
31	- MISP — Threat intelligence sharing platform
32	- OpenCTI — Threat intelligence platform
33	- YARA — Pattern matching (→ Skill 05)
34	- Sigma CLI — Rule conversion tool
35	- SIEM access (Splunk, Elastic, QRadar, Microsoft Sentinel)
36
37	---
38
39	## Core Capabilities
40
41	### 1. IOC Extraction & Normalization
42
43	When the user provides a threat report, article, email, or log snippet:
44
45	Claude performs these extraction steps:
46
47	1. Parse all text for indicators using pattern matching:
48
49	\| IOC Type \| Pattern Examples \|
50	\|----------\|----------------\|
51	\| IPv4 \| `192.0.2.1`, defanged: `192[.]0[.]2[.]1` \|
52	\| IPv6 \| `2001:db8::1` \|
53	\| Domain \| `evil.example.com`, `evil[.]example[.]com` \|
54	\| URL \| `hxxp://evil.com/path`, `https://malicious[.]io/c2` \|
55	\| Email \| `attacker@evil.com`, `phish[at]evil.com` \|
56	\| MD5 \| 32 hex chars \|
57	\| SHA1 \| 40 hex chars \|
58	\| SHA256 \| 64 hex chars \|
59	\| CVE \| `CVE-2024-XXXXX` \|
60	\| ATT&CK ID \| `T1059.001`, `TA0001` \|
61	\| Registry Key \| `HKCU\Software\...` \|
62	\| File path \| `C:\Windows\Temp\...`, `/tmp/...` \|
63	\| Mutex \| Named mutex patterns \|
64
65	2. Defang extracted indicators — refang before use:
66	- `hxxp://` → `http://`
67	- `[.]` → `.`
68	- `[at]` → `@`
69	- `[:]` → `:`
70
71	3. Categorize by type: Network / File / Host / Identity / Vulnerability
72
73	4. Score by confidence: High (specific, sourced), Medium (inferred), Low (generic)
74
75	5. Output in multiple formats:
76
77	```bash
78	python scripts/ioc_extractor.py --input threat_report.txt --output iocs.json
79	python scripts/ioc_extractor.py --input report.pdf --format stix --output iocs.stix.json
80	python scripts/ioc_extractor.py --input email.eml --defang --output iocs.csv
81	```
82
83	STIX 2.1 output template:
84	```json
85	{
86	"type": "indicator",
87	"id": "indicator--[uuid]",
88	"created": "2025-05-28T00:00:00.000Z",
89	"name": "Malicious IP — C2 Infrastructure",
90	"pattern": "[ipv4-addr:value = '192.0.2.10']",
91	"pattern_type": "stix",
92	"valid_from": "2025-05-28T00:00:00Z",
93	"labels": ["malicious-activity", "c2"],
94	"confidence": 85
95	}
96	```
97
98	### 2. MITRE ATT&CK Mapping
99
100	When the user provides TTPs, behaviors, or a malware report:
101
102	```bash
103	python scripts/mitre_mapper.py --input techniques.txt --output attack_map.json
104	python scripts/mitre_mapper.py --technique T1059.001 --detection-query splunk
105	```
106
107	Mapping process:
108
109	1. Analyze each behavior against ATT&CK technique descriptions
110	2. Map to specific Tactic → Technique → Sub-technique (T1059 → T1059.001)
111	3. Assign confidence level based on evidence quality
112
113	ATT&CK Tactics Reference:
114	\| Tactic \| ID \| Description \|
115	\|--------\|----\|-------------\|
116	\| Reconnaissance \| TA0043 \| Pre-attack information gathering \|
117	\| Resource Development \| TA0042 \| Establishing attack resources \|
118	\| Initial Access \| TA0001 \| Entry into target environment \|
119	\| Execution \| TA0002 \| Running malicious code \|
120	\| Persistence \| TA0003 \| Maintaining foothold \|
121	\| Privilege Escalation \| TA0004 \| Gaining higher permissions \|
122	\| Defense Evasion \| TA0005 \| Avoiding detection \|
123	\| Credential Access \| TA0006 \| Stealing credentials \|
124	\| Discovery \| TA0007 \| Understanding environment \|
125	\| Lateral Movement \| TA0008 \| Moving through network \|
126	\| Collection \| TA0009 \| Gathering data of interest \|
127	\| Command & Control \| TA0011 \| Communicating with compromised hosts \|
128	\| Exfiltration \| TA0010 \| Stealing data \|
129	\| Impact \| TA0040 \| Disrupting/destroying systems \|
130
131	ATT&CK Navigator Layer format (JSON for visualization):
132	```json
133	{
134	"name": "Threat Hunt Layer — [Threat Actor/Campaign]",
135	"versions": {"attack": "14", "navigator": "4.9"},
136	"domain": "enterprise-attack",
137	"techniques": [
138	{
139	"techniqueID": "T1059.001",
140	"color": "#ff6666",
141	"comment": "Observed PowerShell download cradle",

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

06-threat-hunting

190stars37forks

View on GitHub

How to install 06-threat-hunting?

masriyan/claude-code-cybersecurity-skill/06-threat-hunting

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 06-threat-hunting

Installs into the current project.

Summary

IOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generation, and detection rule creation

Files · 1

View on GitHub

SKILL.md

1	# Threat Hunting & IOC Analysis
2
3	## Purpose
4
5	Enable Claude to assist threat hunters with proactive threat detection, IOC extraction and normalization, MITRE ATT&CK mapping, hunt hypothesis generation, and converting threat intelligence into actionable detection rules across all major SIEM platforms.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Extracting IOCs from threat reports, emails, or security advisories
13	- Mapping behaviors or TTPs to MITRE ATT&CK framework
14	- Generating hunt hypotheses for a specific threat actor or technique
15	- Creating Sigma rules, Splunk SPL queries, KQL, or EQL
16	- Converting threat intelligence into SIEM detection queries
17	- STIX/TAXII or MISP-compatible indicator formatting
18	- ATT&CK Navigator layer creation
19	- Threat intelligence correlation across multiple sources
20	- Proactive threat hunting in a SIEM or EDR
21
22	---
23
24	## Prerequisites
25
26	```bash
27	pip install requests pyyaml stix2 taxii2-client
28	```
29
30	Optional platforms:
31	- MISP — Threat intelligence sharing platform
32	- OpenCTI — Threat intelligence platform
33	- YARA — Pattern matching (→ Skill 05)
34	- Sigma CLI — Rule conversion tool
35	- SIEM access (Splunk, Elastic, QRadar, Microsoft Sentinel)
36
37	---
38
39	## Core Capabilities
40
41	### 1. IOC Extraction & Normalization
42
43	When the user provides a threat report, article, email, or log snippet:
44
45	Claude performs these extraction steps:
46
47	1. Parse all text for indicators using pattern matching:
48
49	\| IOC Type \| Pattern Examples \|
50	\|----------\|----------------\|
51	\| IPv4 \| `192.0.2.1`, defanged: `192[.]0[.]2[.]1` \|
52	\| IPv6 \| `2001:db8::1` \|
53	\| Domain \| `evil.example.com`, `evil[.]example[.]com` \|
54	\| URL \| `hxxp://evil.com/path`, `https://malicious[.]io/c2` \|
55	\| Email \| `attacker@evil.com`, `phish[at]evil.com` \|
56	\| MD5 \| 32 hex chars \|
57	\| SHA1 \| 40 hex chars \|
58	\| SHA256 \| 64 hex chars \|
59	\| CVE \| `CVE-2024-XXXXX` \|
60	\| ATT&CK ID \| `T1059.001`, `TA0001` \|
61	\| Registry Key \| `HKCU\Software\...` \|
62	\| File path \| `C:\Windows\Temp\...`, `/tmp/...` \|
63	\| Mutex \| Named mutex patterns \|
64
65	2. Defang extracted indicators — refang before use:
66	- `hxxp://` → `http://`
67	- `[.]` → `.`
68	- `[at]` → `@`
69	- `[:]` → `:`
70
71	3. Categorize by type: Network / File / Host / Identity / Vulnerability
72
73	4. Score by confidence: High (specific, sourced), Medium (inferred), Low (generic)
74
75	5. Output in multiple formats:
76
77	```bash
78	python scripts/ioc_extractor.py --input threat_report.txt --output iocs.json
79	python scripts/ioc_extractor.py --input report.pdf --format stix --output iocs.stix.json
80	python scripts/ioc_extractor.py --input email.eml --defang --output iocs.csv
81	```
82
83	STIX 2.1 output template:
84	```json
85	{
86	"type": "indicator",
87	"id": "indicator--[uuid]",
88	"created": "2025-05-28T00:00:00.000Z",
89	"name": "Malicious IP — C2 Infrastructure",
90	"pattern": "[ipv4-addr:value = '192.0.2.10']",
91	"pattern_type": "stix",
92	"valid_from": "2025-05-28T00:00:00Z",
93	"labels": ["malicious-activity", "c2"],
94	"confidence": 85
95	}
96	```
97
98	### 2. MITRE ATT&CK Mapping
99
100	When the user provides TTPs, behaviors, or a malware report:
101
102	```bash
103	python scripts/mitre_mapper.py --input techniques.txt --output attack_map.json
104	python scripts/mitre_mapper.py --technique T1059.001 --detection-query splunk
105	```
106
107	Mapping process:
108
109	1. Analyze each behavior against ATT&CK technique descriptions
110	2. Map to specific Tactic → Technique → Sub-technique (T1059 → T1059.001)
111	3. Assign confidence level based on evidence quality
112
113	ATT&CK Tactics Reference:
114	\| Tactic \| ID \| Description \|
115	\|--------\|----\|-------------\|
116	\| Reconnaissance \| TA0043 \| Pre-attack information gathering \|
117	\| Resource Development \| TA0042 \| Establishing attack resources \|
118	\| Initial Access \| TA0001 \| Entry into target environment \|
119	\| Execution \| TA0002 \| Running malicious code \|
120	\| Persistence \| TA0003 \| Maintaining foothold \|
121	\| Privilege Escalation \| TA0004 \| Gaining higher permissions \|
122	\| Defense Evasion \| TA0005 \| Avoiding detection \|
123	\| Credential Access \| TA0006 \| Stealing credentials \|
124	\| Discovery \| TA0007 \| Understanding environment \|
125	\| Lateral Movement \| TA0008 \| Moving through network \|
126	\| Collection \| TA0009 \| Gathering data of interest \|
127	\| Command & Control \| TA0011 \| Communicating with compromised hosts \|
128	\| Exfiltration \| TA0010 \| Stealing data \|
129	\| Impact \| TA0040 \| Disrupting/destroying systems \|
130
131	ATT&CK Navigator Layer format (JSON for visualization):
132	```json
133	{
134	"name": "Threat Hunt Layer — [Threat Actor/Campaign]",
135	"versions": {"attack": "14", "navigator": "4.9"},
136	"domain": "enterprise-attack",
137	"techniques": [
138	{
139	"techniqueID": "T1059.001",
140	"color": "#ff6666",
141	"comment": "Observed PowerShell download cradle",

People who liked this also viewed

6 picks

Type