threat-hunting – Security skill for AI agents
Blue-team threat hunting: detection engineering with Sigma/YARA, SIEM query design, and validation of incident detections against known technique patterns.
Install the threat-hunting skill with one command
Pick the tool you use, copy the command and paste it in your terminal. The skill lands in that tool's skills folder and is ready in your next session.
Claude Code
mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/threat-hunting-1bd2e.tgz | tar xz -C ~/.claude/skills
Call it in Claude Code: /threat-hunting – then describe the task you want done.
Codex
mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/threat-hunting-1bd2e.tgz | tar xz -C ~/.codex/skills
Call it in Codex: $threat-hunting – then describe the task you want done.
Hermes Agent
mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/threat-hunting-1bd2e.tgz | tar xz -C ~/.hermes/skills
Call it in Hermes Agent: /threat-hunting – then describe the task you want done.
DeepSeek
mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/threat-hunting-1bd2e.tgz | tar xz -C ~/.deepcode/skills
Call it in DeepSeek: /threat-hunting – then describe the task you want done.
SKILL.md content
Threat Hunting & Detection Engineering
When to Use
- Proactively hunting for adversary activity in telemetry.
- Writing or validating detection rules mapped to ATT&CK techniques.
适用场景
- 威胁狩猎（hypothesis-driven）
- Sigma / YARA 检测工程
- 告警调优、误报分析
- 与
malware-analysis/：样本侧 IOC → 本 skill 落地检测 - 与
digital-forensics/：案件伪影 → 横向狩猎
工作流
1. 建假说
例：攻击者用 living-off-the-land 做横向
→ 数据源：Sysmon 1/3/10、Windows Security 4624/4648
→ 成功标准：发现异常父进程或罕见账户日志源2. 查询与堆叠
□ 基线：正常管理员行为时段与主机
□ 异常：新服务、编码 PowerShell、异常出站
□ 关联：同账号多主机短时登录3. 规则化
# Sigma 骨架见 malware-analysis；本 skill 强调：
# - 误报面
# - 数据源字段映射
# - 响应 playbook 链接4. 验证
□ 原子测试（Atomic Red Team）仅在授权实验室
□ 回放历史日志验证召回工具链
| 工具 | 用途 |
|------|------|
| Sigma CLI / sigmac | 规则转换 |
| YARA | 文件/内存 |
| SIEM（ELK/Splunk 等） | 查询 |
| osquery | 端点狩猎 |
| Atomic Red Team | 检测验证（实验室） |
参考
references/hunting-loop.md../malware-analysis/references/yara-sigma-rules.md../digital-forensics/
路由上下文
上游: MASTER R27
下游: 确认入侵 → forensics；恶意样本 → malware-analysis
MUST NOT: 在无授权生产环境跑攻击模拟
任务完成自检
- [ ] 是否有明确假说与结论？
- [ ] 规则是否注明误报与数据源？
- [ ] Checklist？
Limitations
- Hypothesis quality bounds results; weak telemetry yields weak hunts.
- Rule tuning is continuous; expect false positives initially.
> Adapted from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (MIT).
Related skills
- threat-intelligence – Authorized OSINT and cyber threat intelligence: enriching IOCs, campaigns…
- threat-mitigation-mapping – Map identified threats to appropriate security controls and mitigations. Use when…
- threat-modeling – Conduct threat modeling using STRIDE methodology. Identify threats, assess risks, and…
- threat-modeling-expert – Expert in threat modeling methodologies, security architecture review, and risk…
- top-web-vulnerabilities – Provide an illustrative, overlapping reference for common web application vulnerability…
- usage-engineer – Cut wasted tokens in coding-agent sessions: compact long logs, stop identical retries…
- vendor-management – Implement vendor risk management programs. Assess third-party security and maintain…
- vercel-optimize – Audit deployed Vercel apps for cost and performance issues using metrics, project…