threat-hunting
Threat Hunting equips you to conduct hypothesis-driven threat investigations across Windows endpoints, network traffic, and cloud identity using Sigma-based detection rules, MITRE ATT&CK mapping, and offline triage tools. Execute C2 hunting via JA4 fingerprinting and beaconing analysis, detect post-exploitation techniques like LSASS dumping and LOLBin abuse, and validate detection coverage with purple-team emulation.
Threat Hunting helps you hunt threats and engineer detections across endpoints, networks, and cloud using ATT&CK, Sigma rules, and telemetry.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
Threat Hunting helps you hunt threats and engineer detections across endpoints, networks, and cloud using ATT&CK, Sigma rules, and telemetry. Threat Hunting equips you to conduct hypothesis-driven threat investigations across Windows endpoints, network traffic, and cloud identity using Sigma-based detection rules, MITRE ATT&CK mapping, and offline triage tools. Execute C2 hunting via JA4 fingerprinting and beaconing analysis, detect post-exploitation techniques like LSASS dumping and LOLBin abuse, and validate detection coverage with purple-team emulation.
Use it when
- Threat-hunting provides detection strategies for Windows post-exploitation techniques including LSASS dumping, ETW/AMSI tampering.
- Threat-hunting teaches you to build and deploy Sigma rules for Windows endpoint detection, map them to MITRE ATT&CK techniques.
Verify before relying
Read SKILL.md below before installing (15 files). Open directory: indexed for reading, not audited.
Install
hypnguyen1209/offensive-claude/threat-hunting · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is threat-hunting and what does it cover?
Threat-hunting is a skill for conducting hypothesis-driven threat investigations across Windows endpoints, network traffic, and cloud identity. It equips you with Sigma-based detection rules, MITRE ATT&CK mapping, and offline triage tools to hunt threats, engineer detections, and validate coverage gaps using purple-team emulation.
How does threat-hunting help detect Windows post-exploitation?
Threat-hunting provides detection strategies for Windows post-exploitation techniques including LSASS dumping, ETW/AMSI tampering, LOLBin abuse, and process injection. You'll learn to use Sysmon telemetry, EVTX triage tools like Hayabusa and Chainsaw, and process tree anomaly detection to identify these attacks.
What sigma rules and windows endpoint detection methods does threat-hunting teach?
Threat-hunting teaches you to build and deploy Sigma rules for Windows endpoint detection, map them to MITRE ATT&CK techniques, and integrate them into detection-as-code CI pipelines. You'll learn to triage EVTX logs and correlate endpoint telemetry with network signals for comprehensive threat visibility.
How can threat-hunting detect C2 beaconing in encrypted traffic?
Threat-hunting covers C2 hunting via JA4 fingerprinting for malware identification, beaconing detection using tools like RITA, and DNS tunneling analysis. These techniques let you hunt command-and-control activity even in encrypted network traffic without decryption.
Does threat-hunting address cloud identity attack hunting?
Yes. Threat-hunting includes cloud identity attack hunting focused on device-code phishing, PRT token theft, and CloudTrail abuse detection. You'll learn to identify Entra ID compromise patterns and validate detections across hybrid cloud-identity environments.
How does threat-hunting validate detection coverage?
Threat-hunting teaches purple-team validation using atomic red team emulation to measure ATT&CK coverage gaps. You'll map detections to the coverage matrix via ATT&CK Navigator and refine your detection engineering based on real adversary behavior simulation.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
name: threat-hunting description: Use when hunting threats or engineering detections — ATT&CK Detection-Strategies, Sigma + correlation with Detection-as-Code CI, Windows endpoint hunting (Sysmon/ETW/LSASS/LOLBins), network C2 hunting (JA4+, beaconing, DNS tunneling), cloud-identity hunting, Atomic Red Team purple-team validation metadata: type: defensive phase: detection tools: sigma-cli, pysigma, hayabusa, chainsaw, velociraptor, sysmon, zeek, rita, ja4, atomic-red-team, caldera, splunk, sentinel, defender, kql mitre: TA0043 kill_chain: phase: [report] step: [8] attck_tactics: [TA0043, TA0042, TA0011, TA0006, TA0005] attck_techniques: [T1059.001, T1003.001, T1562.001, T1562.002, T1218, T1105, T1071, T1071.001, T1071.004, T1571, T1572, T1528, T1550.001, T1078.004, T1098, T1543.003, T1070.001, T1558.003, T1003.006] depends_on: [red-team-ops, incident-response] feeds_into: [] inputs: [finding_records, log_data, ioc_list, evtx, zeek_logs, cloudtrail, sigin_logs] outputs: [sigma_rules, correlation_rules, attck_navigator_export, coverage_matrix, detection_report, hunt_findings] references: - references/methodology-hunt-loop.md -
(truncated - see the full file via the links below)
File tree — 15 files
skills/threat-hunting/SKILL.md
skills/threat-hunting/references/cloud-identity-hunting.md
skills/threat-hunting/references/methodology-hunt-loop.md
skills/threat-hunting/references/network-c2-hunting.md
skills/threat-hunting/references/purple-team-validation.md
skills/threat-hunting/references/sigma-rule-engineering.md
skills/threat-hunting/references/windows-endpoint-hunting.md
skills/threat-hunting/scripts/beacon_hunter.py
skills/threat-hunting/scripts/cloudtrail_hunt.py
skills/threat-hunting/scripts/coverage_matrix.py
skills/threat-hunting/scripts/dac_validate.py
skills/threat-hunting/scripts/entra_hunt.kql
skills/threat-hunting/scripts/evtx_hunt.py
skills/threat-hunting/scripts/sigma_pipeline.sh
skills/threat-hunting/scripts/sysmon_config_2025.xml
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Hunt threats and engineer detections using ATT&CK, Sigma rules, and endpoint/network telemetry”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Incident Response guides evidence collection and analysis during active security breaches across endpoints, memory, logs, and cloud environments. It covers triage acquisition with Velociraptor and KAPE, memory forensics via Volatility 3, Windows event-log timelining with Chainsaw and Hayabusa, anti-forensics detection including timestomping, cloud identity-plane attacks, and ransomware or ESXi hypervisor response.
Malware Analysis guides you through identifying unknown binaries, unpacking obfuscated loaders, and safely detonating samples to recover fileless artifacts and in-memory payloads. Extract C2 configurations, detect beacon traffic patterns, and author low-false-positive detection rules from your findings.
This skill maps techniques for defeating Windows exploit mitigations—memory protections like ASLR, DEP, CFG, and CET—alongside platform security controls including WDAC, ASR, AMSI, ETW, and PPL. It pairs each bypass method with detection signatures and operational security notes to support both offensive testing and defensive hardening. Includes reconnaissance scripts, gadget finders, and a quick-start workflow for fingerprinting a target's mitigation landscape before weaponizing an exploit.
Windows Boundaries equips you with techniques and tools to cross Windows security boundaries—from kernel/user mode transitions via win32k/dxgkrnl exploits and BYOVD drivers, to UAC elevation, AppContainer/LPAC sandbox escapes, PPL circumvention, and RPC/ALPC-based token impersonation. Includes enumeration scripts, proof-of-concept exploits, and OPSEC guidance for each attack vector.
privesc-windows guides you through multiple privilege-escalation paths on Windows hosts, from token-impersonation attacks (GodPotato, SigmaPotato, PrintNotifyPotato) and UAC bypass techniques to service/DLL hijacking and kernel exploits. It covers enumeration, exploitation, and credential harvesting with tactical OPSEC guidance and detection evasion for each method.
Cloud Security targets identity and access control weaknesses across major cloud platforms. It covers IAM privilege escalation, credential harvesting via metadata SSRF, Entra device-code attacks, GCP service-account impersonation chains, Kubernetes container breakout, and CI/CD federation trust abuse. Includes scripts and references for reconnaissance, exploitation, and lateral movement within cloud environments.
More skills network-attack (MIT) · windows-av-evasion (MIT)