Agent skill
threat-hunting
Proactive threat detection using Sigma rules, IOCs, and behavioral analytics
Install this agent skill to your Project
npx add-skill https://github.com/ljchg12-hue/dotfiles/tree/main/skills/threat-hunting
SKILL.md
Threat Hunting Skill
Proactive threat detection and investigation using detection rules, IOCs, and behavioral analytics.
When to Use
- Threat hunting activities
- Suspicious behavior detection
- Security log analysis, IOC analysis
- Keywords: "threat", "hunt", "detection", "suspicious", "malware"
Core Capabilities
1. Sigma Rule Analysis
- Rule interpretation/execution
- Custom rule creation
- False positive reduction
2. IOC Detection
- IP/domain reputation
- File hash lookups
- Process behavior monitoring
3. Behavioral Analytics
- Anomaly detection
- Baseline deviation
- Temporal pattern analysis
4. Log Analysis
- System log parsing
- Event correlation
- Timeline reconstruction
Sigma Rule Example
title: Suspicious PowerShell Download
logsource:
product: windows
service: powershell
detection:
selection:
EventID: 4104
ScriptBlockText|contains:
- 'DownloadString'
- 'DownloadFile'
condition: selection
level: medium
Hunting Workflow
- Hypothesis: Identify threats from intel, incidents, trends
- Data Collection: Log sources, time range, normalization
- Analysis: Apply rules, search IOCs, find anomalies
- Investigation: Validate, eliminate false positives
- Response: Escalate, remediate, update rules
IOC Types
| Type | Examples |
|---|---|
| Network | C2 IPs, malicious domains, unusual ports |
| File | Malware hashes, suspicious paths |
| Process | Bad process names, unusual parent-child |
| Registry | Persistence keys, malware artifacts |
Quick Commands
# Log search
grep -i "suspicious_pattern" /var/log/auth.log
# Check connections
netstat -antp | grep ESTABLISHED
# Process analysis
ps aux | lsof -i -n -P
MITRE ATT&CK Mapping
- Initial Access → Execution → Persistence
- Privilege Escalation → Defense Evasion
- Credential Access → Lateral Movement
- Collection → Exfiltration
Best Practices
- ✅ Hypothesis-driven hunting
- ✅ Combine multiple data sources
- ✅ Document all findings
- ❌ Don't rely on single indicator
- ❌ Don't skip validation
Integration
- digital-forensics: Evidence collection
- log-analysis: Advanced parsing
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
ljchg12-hue/dotfiles
random-selection
Randomly select items from lists using various algorithms for fair and unbiased selection
ljchg12-hue/dotfiles
auth-implementation-patterns
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.
ljchg12-hue/dotfiles
debugging-strategies
Master systematic debugging techniques, profiling tools, and root cause analysis to efficiently track down bugs across any codebase or technology stack. Use when investigating bugs, performance issues, or unexpected behavior.
ljchg12-hue/dotfiles
sql-optimization-patterns
Master SQL query optimization, indexing strategies, and EXPLAIN analysis to dramatically improve database performance and eliminate slow queries. Use when debugging slow queries, designing database schemas, or optimizing application performance.
ljchg12-hue/dotfiles
monorepo-management
Master monorepo management with Turborepo, Nx, and pnpm workspaces to build efficient, scalable multi-package repositories with optimized builds and dependency management. Use when setting up monorepos, optimizing builds, or managing shared dependencies.
ljchg12-hue/dotfiles
git-advanced-workflows
Master advanced Git workflows including rebasing, cherry-picking, bisect, worktrees, and reflog to maintain clean history and recover from any situation. Use when managing complex Git histories, collaborating on feature branches, or troubleshooting repository issues.
Didn't find tool you were looking for?