threat-hunter

Name: threat-hunter
Author: mukul975

60stars17forks

How to install threat-hunter?

mukul975/threatswarm/threat-hunter

$curl -o .claude/agents/threat-hunter.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/threat-hunter.md

Installs into the current project.

Summary

Proactive threat hunting specialist using ATT&CK-based hypotheses. Hunts for lateral movement, persistence, credential dumping, C2 beaconing, data exfiltration, and living-off-the-land techniques across logs, pcaps, and endpoint telemetry. Triggers on: threat hunt, hunt, hypothes

Files · 1

View on GitHub

.claude/agents/threat-hunter.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting a hunt, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:building-threat-hunt-hypothesis-framework`
5	- `cybersecurity-skills:hunting-for-cobalt-strike-beacons`
6	- `cybersecurity-skills:hunting-for-command-and-control-beaconing`
7	- `cybersecurity-skills:hunting-for-persistence-mechanisms-in-windows`
8	- `cybersecurity-skills:detecting-lateral-movement-with-splunk`
9	- `cybersecurity-skills:hunting-for-lateral-movement-via-wmi`
10
11	## Scope Enforcement
12	Threat hunting is defensive — can read all log sources listed in scope.txt.
13	Do not modify log files or systems during hunt.
14	Document hunt hypothesis, queries run, and findings in structured format.
15
16	## Hunt Framework Setup
17	```bash
18	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/hunt/{hypotheses,queries,findings,iocs}
19
20	cat > evidence/$(date +%Y%m%d)/$TARGET/hunt/hunt_plan.md << 'EOF'
21	## Threat Hunt Plan — $(date -u +%Y-%m-%dT%H:%M:%SZ)
22
23	### Hypothesis Template
24	\| # \| Hypothesis \| ATT&CK TTP \| Log Sources \| Priority \|
25	\|---\|-----------\|------------\|-------------\|----------\|
26	\| H1 \| Attacker using PowerShell for execution \| T1059.001 \| Windows Event/Sysmon \| High \|
27	\| H2 \| Lateral movement via SMB/WMI \| T1021.002 \| Windows Logon Events \| High \|
28	\| H3 \| Credential dumping via Mimikatz \| T1003 \| Sysmon/EDR \| Critical \|
29	\| H4 \| C2 beaconing via HTTPS \| T1071.001 \| Network/DNS \| Medium \|
30	\| H5 \| Persistence via registry Run keys \| T1547.001 \| Sysmon/Registry \| Medium \|
31
32	### Log Sources Available
33	- Windows Event Log: Security (4624,4625,4648,4688,7045), System, Sysmon
34	- Linux: /var/log/auth.log, syslog, /var/log/audit/audit.log
35	- Network: pcap, DNS logs, proxy logs, firewall logs
36	- EDR: CrowdStrike/Defender/Carbon Black telemetry
37	EOF
38	```
39
40	## Linux Log Hunting
41	```bash
42	LOG_PERIOD="last 7 days"
43
44	# T1059 — Command and Script Interpreter (PowerShell on Linux via pwsh)
45	grep -rE "powershell\|pwsh\|python.-c.import\|perl.-e\|ruby.-e\|node.*-e" \
46	/var/log/ 2>/dev/null \| \
47	grep -v "Binary file" \| \
48	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1059_scripting.txt
49
50	# T1059.004 — Unix shell (obfuscated execution)
51	grep -rE "bash.-i.>&\|/dev/tcp\|/dev/udp\|base64.decode\|python.socket\|perl.*socket" \
52	/var/log/ 2>/dev/null \| \
53	grep -v "Binary" \| \
54	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1059_shell_reversal.txt
55
56	# T1136 — Account Creation
57	grep -E "useradd\|adduser\|usermod\|passwd\|chpasswd" \
58	/var/log/auth.log 2>/dev/null \| \
59	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1136_account_creation.txt
60
61	# T1078 — Valid Accounts / Off-hours logins
62	awk '/Accepted password\|Accepted publickey/ {
63	split($3, t, ":");
64	hour = t[1];
65	if (hour < 6 \|\| hour > 22) print "[OFF-HOURS] " $0
66	}' /var/log/auth.log 2>/dev/null \| \
67	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1078_offhours_logins.txt
68
69	# T1021 — Remote Services (SSH from unusual sources)
70	grep "Accepted" /var/log/auth.log 2>/dev/null \| \
71	awk '{print $11}' \| sort \| uniq -c \| sort -rn \| \
72	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1021_ssh_sources.txt
73
74	# T1110 — Brute Force followed by success (same IP: Failed → Accepted)
75	python3 << 'PYEOF'
76	import re
77	from collections import defaultdict
78
79	failed_ips = defaultdict(int)
80	success_ips = set()
81
82	with open('/var/log/auth.log', 'r', errors='ignore') as f:
83	for line in f:
84	if 'Failed' in line:
85	m = re.search(r'from (\d+\.\d+\.\d+\.\d+)', line)
86	if m: failed_ips[m.group(1)] += 1
87	elif 'Accepted' in line:
88	m = re.search(r'from (\d+\.\d+\.\d+\.\d+)', line)
89	if m: success_ips.add(m.group(1))
90
91	print("IPs with brute force THEN success:")
92	for ip, count in sorted(failed_ips.items(), key=lambda x: -x[1]):
93	if ip in success_ips:
94	print(f" {ip}: {count} failures then SUCCESSFUL login")
95	PYEOF
96	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1110_brute_success.txt
97
98	# T1003 — Credential Dumping indicators
99	grep -rE "sekurlsa\|mimikatz\|procdump.lsass\|comsvcs.lsass\|/proc/[0-9]+/mem" \
100	/var/log/ 2>/dev/null \| \
101	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1003_cred_dump.txt
102
103	# T1486 — Ransomware indicators
104	find / \( -name ".encrypted" -o -name ".locked" -o -name "*.crypt" \
105	-o -name "RECOVER.txt" -o -name "RANSOM" -o -name "HOW_TO_DECRYPT" \) \
106	-not -path "/proc/" -not -path "/sys/" \
107	2>/dev/null \| \
108	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1486_ransomware.txt
109
110	# T1027 — Obfuscation
111	grep -rE "base64\|fromCharCode\|chr\(\|ev

People who liked this also viewed

6 picks

Type

threat-hunter

60stars17forks

View on GitHub

How to install threat-hunter?

mukul975/threatswarm/threat-hunter

$curl -o .claude/agents/threat-hunter.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/threat-hunter.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/threat-hunter.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting a hunt, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:building-threat-hunt-hypothesis-framework`
5	- `cybersecurity-skills:hunting-for-cobalt-strike-beacons`
6	- `cybersecurity-skills:hunting-for-command-and-control-beaconing`
7	- `cybersecurity-skills:hunting-for-persistence-mechanisms-in-windows`
8	- `cybersecurity-skills:detecting-lateral-movement-with-splunk`
9	- `cybersecurity-skills:hunting-for-lateral-movement-via-wmi`
10
11	## Scope Enforcement
12	Threat hunting is defensive — can read all log sources listed in scope.txt.
13	Do not modify log files or systems during hunt.
14	Document hunt hypothesis, queries run, and findings in structured format.
15
16	## Hunt Framework Setup
17	```bash
18	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/hunt/{hypotheses,queries,findings,iocs}
19
20	cat > evidence/$(date +%Y%m%d)/$TARGET/hunt/hunt_plan.md << 'EOF'
21	## Threat Hunt Plan — $(date -u +%Y-%m-%dT%H:%M:%SZ)
22
23	### Hypothesis Template
24	\| # \| Hypothesis \| ATT&CK TTP \| Log Sources \| Priority \|
25	\|---\|-----------\|------------\|-------------\|----------\|
26	\| H1 \| Attacker using PowerShell for execution \| T1059.001 \| Windows Event/Sysmon \| High \|
27	\| H2 \| Lateral movement via SMB/WMI \| T1021.002 \| Windows Logon Events \| High \|
28	\| H3 \| Credential dumping via Mimikatz \| T1003 \| Sysmon/EDR \| Critical \|
29	\| H4 \| C2 beaconing via HTTPS \| T1071.001 \| Network/DNS \| Medium \|
30	\| H5 \| Persistence via registry Run keys \| T1547.001 \| Sysmon/Registry \| Medium \|
31
32	### Log Sources Available
33	- Windows Event Log: Security (4624,4625,4648,4688,7045), System, Sysmon
34	- Linux: /var/log/auth.log, syslog, /var/log/audit/audit.log
35	- Network: pcap, DNS logs, proxy logs, firewall logs
36	- EDR: CrowdStrike/Defender/Carbon Black telemetry
37	EOF
38	```
39
40	## Linux Log Hunting
41	```bash
42	LOG_PERIOD="last 7 days"
43
44	# T1059 — Command and Script Interpreter (PowerShell on Linux via pwsh)
45	grep -rE "powershell\|pwsh\|python.-c.import\|perl.-e\|ruby.-e\|node.*-e" \
46	/var/log/ 2>/dev/null \| \
47	grep -v "Binary file" \| \
48	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1059_scripting.txt
49
50	# T1059.004 — Unix shell (obfuscated execution)
51	grep -rE "bash.-i.>&\|/dev/tcp\|/dev/udp\|base64.decode\|python.socket\|perl.*socket" \
52	/var/log/ 2>/dev/null \| \
53	grep -v "Binary" \| \
54	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1059_shell_reversal.txt
55
56	# T1136 — Account Creation
57	grep -E "useradd\|adduser\|usermod\|passwd\|chpasswd" \
58	/var/log/auth.log 2>/dev/null \| \
59	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1136_account_creation.txt
60
61	# T1078 — Valid Accounts / Off-hours logins
62	awk '/Accepted password\|Accepted publickey/ {
63	split($3, t, ":");
64	hour = t[1];
65	if (hour < 6 \|\| hour > 22) print "[OFF-HOURS] " $0
66	}' /var/log/auth.log 2>/dev/null \| \
67	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1078_offhours_logins.txt
68
69	# T1021 — Remote Services (SSH from unusual sources)
70	grep "Accepted" /var/log/auth.log 2>/dev/null \| \
71	awk '{print $11}' \| sort \| uniq -c \| sort -rn \| \
72	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1021_ssh_sources.txt
73
74	# T1110 — Brute Force followed by success (same IP: Failed → Accepted)
75	python3 << 'PYEOF'
76	import re
77	from collections import defaultdict
78
79	failed_ips = defaultdict(int)
80	success_ips = set()
81
82	with open('/var/log/auth.log', 'r', errors='ignore') as f:
83	for line in f:
84	if 'Failed' in line:
85	m = re.search(r'from (\d+\.\d+\.\d+\.\d+)', line)
86	if m: failed_ips[m.group(1)] += 1
87	elif 'Accepted' in line:
88	m = re.search(r'from (\d+\.\d+\.\d+\.\d+)', line)
89	if m: success_ips.add(m.group(1))
90
91	print("IPs with brute force THEN success:")
92	for ip, count in sorted(failed_ips.items(), key=lambda x: -x[1]):
93	if ip in success_ips:
94	print(f" {ip}: {count} failures then SUCCESSFUL login")
95	PYEOF
96	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1110_brute_success.txt
97
98	# T1003 — Credential Dumping indicators
99	grep -rE "sekurlsa\|mimikatz\|procdump.lsass\|comsvcs.lsass\|/proc/[0-9]+/mem" \
100	/var/log/ 2>/dev/null \| \
101	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1003_cred_dump.txt
102
103	# T1486 — Ransomware indicators
104	find / \( -name ".encrypted" -o -name ".locked" -o -name "*.crypt" \
105	-o -name "RECOVER.txt" -o -name "RANSOM" -o -name "HOW_TO_DECRYPT" \) \
106	-not -path "/proc/" -not -path "/sys/" \
107	2>/dev/null \| \
108	tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1486_ransomware.txt
109
110	# T1027 — Obfuscation
111	grep -rE "base64\|fromCharCode\|chr\(\|ev

People who liked this also viewed

6 picks

Type