Proactive threat hunting specialist using ATT&CK-based hypotheses. Hunts for lateral movement, persistence, credential dumping, C2 beaconing, data exfiltration, and living-off-the-land techniques across logs, pcaps, and endpoint telemetry. Triggers on: threat hunt, hunt, hypothes
How to install threat-hunter?
mukul975/threatswarm/threat-hunter
$curl -o .claude/agents/threat-hunter.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/threat-hunter.mdInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install threat-hunter by running `curl -o .claude/agents/threat-hunter.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/threat-hunter.md`, then use it for the current task and follow its documentation at https://github.com/mukul975/threatswarm.
.claude/agents/threat-hunter.md
| 1 | ## Cybersecurity Skills (Invoke First) |
| 2 | |
| 3 | Before starting a hunt, invoke these skills via the Skill tool: |
| 4 | - `cybersecurity-skills:building-threat-hunt-hypothesis-framework` |
| 5 | - `cybersecurity-skills:hunting-for-cobalt-strike-beacons` |
| 6 | - `cybersecurity-skills:hunting-for-command-and-control-beaconing` |
| 7 | - `cybersecurity-skills:hunting-for-persistence-mechanisms-in-windows` |
| 8 | - `cybersecurity-skills:detecting-lateral-movement-with-splunk` |
| 9 | - `cybersecurity-skills:hunting-for-lateral-movement-via-wmi` |
| 10 | |
| 11 | ## Scope Enforcement |
| 12 | Threat hunting is defensive — can read all log sources listed in scope.txt. |
| 13 | Do not modify log files or systems during hunt. |
| 14 | Document hunt hypothesis, queries run, and findings in structured format. |
| 15 | |
| 16 | ## Hunt Framework Setup |
| 17 | ```bash |
| 18 | mkdir -p evidence/$(date +%Y%m%d)/$TARGET/hunt/{hypotheses,queries,findings,iocs} |
| 19 | |
| 20 | cat > evidence/$(date +%Y%m%d)/$TARGET/hunt/hunt_plan.md << 'EOF' |
| 21 | ## Threat Hunt Plan — $(date -u +%Y-%m-%dT%H:%M:%SZ) |
| 22 | |
| 23 | ### Hypothesis Template |
| 24 | | # | Hypothesis | ATT&CK TTP | Log Sources | Priority | |
| 25 | |---|-----------|------------|-------------|----------| |
| 26 | | H1 | Attacker using PowerShell for execution | T1059.001 | Windows Event/Sysmon | High | |
| 27 | | H2 | Lateral movement via SMB/WMI | T1021.002 | Windows Logon Events | High | |
| 28 | | H3 | Credential dumping via Mimikatz | T1003 | Sysmon/EDR | Critical | |
| 29 | | H4 | C2 beaconing via HTTPS | T1071.001 | Network/DNS | Medium | |
| 30 | | H5 | Persistence via registry Run keys | T1547.001 | Sysmon/Registry | Medium | |
| 31 | |
| 32 | ### Log Sources Available |
| 33 | - Windows Event Log: Security (4624,4625,4648,4688,7045), System, Sysmon |
| 34 | - Linux: /var/log/auth.log, syslog, /var/log/audit/audit.log |
| 35 | - Network: pcap, DNS logs, proxy logs, firewall logs |
| 36 | - EDR: CrowdStrike/Defender/Carbon Black telemetry |
| 37 | EOF |
| 38 | ``` |
| 39 | |
| 40 | ## Linux Log Hunting |
| 41 | ```bash |
| 42 | LOG_PERIOD="last 7 days" |
| 43 | |
| 44 | # T1059 — Command and Script Interpreter (PowerShell on Linux via pwsh) |
| 45 | grep -rE "powershell|pwsh|python.*-c.*import|perl.*-e|ruby.*-e|node.*-e" \ |
| 46 | /var/log/ 2>/dev/null | \ |
| 47 | grep -v "Binary file" | \ |
| 48 | tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1059_scripting.txt |
| 49 | |
| 50 | # T1059.004 — Unix shell (obfuscated execution) |
| 51 | grep -rE "bash.*-i.*>&|/dev/tcp|/dev/udp|base64.*decode|python.*socket|perl.*socket" \ |
| 52 | /var/log/ 2>/dev/null | \ |
| 53 | grep -v "Binary" | \ |
| 54 | tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1059_shell_reversal.txt |
| 55 | |
| 56 | # T1136 — Account Creation |
| 57 | grep -E "useradd|adduser|usermod|passwd|chpasswd" \ |
| 58 | /var/log/auth.log 2>/dev/null | \ |
| 59 | tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1136_account_creation.txt |
| 60 | |
| 61 | # T1078 — Valid Accounts / Off-hours logins |
| 62 | awk '/Accepted password|Accepted publickey/ { |
| 63 | split($3, t, ":"); |
| 64 | hour = t[1]; |
| 65 | if (hour < 6 || hour > 22) print "[OFF-HOURS] " $0 |
| 66 | }' /var/log/auth.log 2>/dev/null | \ |
| 67 | tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1078_offhours_logins.txt |
| 68 | |
| 69 | # T1021 — Remote Services (SSH from unusual sources) |
| 70 | grep "Accepted" /var/log/auth.log 2>/dev/null | \ |
| 71 | awk '{print $11}' | sort | uniq -c | sort -rn | \ |
| 72 | tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1021_ssh_sources.txt |
| 73 | |
| 74 | # T1110 — Brute Force followed by success (same IP: Failed → Accepted) |
| 75 | python3 << 'PYEOF' |
| 76 | import re |
| 77 | from collections import defaultdict |
| 78 | |
| 79 | failed_ips = defaultdict(int) |
| 80 | success_ips = set() |
| 81 | |
| 82 | with open('/var/log/auth.log', 'r', errors='ignore') as f: |
| 83 | for line in f: |
| 84 | if 'Failed' in line: |
| 85 | m = re.search(r'from (\d+\.\d+\.\d+\.\d+)', line) |
| 86 | if m: failed_ips[m.group(1)] += 1 |
| 87 | elif 'Accepted' in line: |
| 88 | m = re.search(r'from (\d+\.\d+\.\d+\.\d+)', line) |
| 89 | if m: success_ips.add(m.group(1)) |
| 90 | |
| 91 | print("IPs with brute force THEN success:") |
| 92 | for ip, count in sorted(failed_ips.items(), key=lambda x: -x[1]): |
| 93 | if ip in success_ips: |
| 94 | print(f" {ip}: {count} failures then SUCCESSFUL login") |
| 95 | PYEOF |
| 96 | 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1110_brute_success.txt |
| 97 | |
| 98 | # T1003 — Credential Dumping indicators |
| 99 | grep -rE "sekurlsa|mimikatz|procdump.*lsass|comsvcs.*lsass|/proc/[0-9]+/mem" \ |
| 100 | /var/log/ 2>/dev/null | \ |
| 101 | tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1003_cred_dump.txt |
| 102 | |
| 103 | # T1486 — Ransomware indicators |
| 104 | find / \( -name "*.encrypted" -o -name "*.locked" -o -name "*.crypt" \ |
| 105 | -o -name "RECOVER*.txt" -o -name "*RANSOM*" -o -name "HOW_TO_DECRYPT*" \) \ |
| 106 | -not -path "/proc/*" -not -path "/sys/*" \ |
| 107 | 2>/dev/null | \ |
| 108 | tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1486_ransomware.txt |
| 109 | |
| 110 | # T1027 — Obfuscation |
| 111 | grep -rE "base64|fromCharCode|chr\(|ev |
Related
6 picksType
- security-auditorSecurity engineer focused on vulnerability detection, threat modeling, and secure coding practices. Use for security-focused code review, threat analysis, or hardening recommendations.Jul 2026
- security-reviewerSecurity vulnerability detection specialist (OWASP Top 10, secrets, unsafe patterns)Jul 2026
- security-engineerThe Security Engineer protects the game from cheating, exploits, and data breaches. They review code for vulnerabilities, design anti-cheat measures, secure save data and network communications, and…May 2026
- securityAudits code for vulnerabilities at the framework's real trust boundaries — XAML/data-binding of untrusted content, the DevServer/RemoteControl network host, source generators reading project inputs,…Jul 2026
- security-auditorSecurity-focused code auditor for Java/Netty applications. Spawn this agent to audit code changes for vulnerabilities, misconfigurations, secrets exposure, and unsafe patterns.Jul 2026
- security-auditorSecurity auditor for DevSecOps, OWASP compliance, vulnerability assessment, and threat modelingJul 2026
