threat-hunting
Threat Hunting equips you to conduct hypothesis-driven threat investigations across Windows endpoints, network traffic, and cloud identity using Sigma-based detection rules, MITRE ATT&CK mapping, and offline triage tools. Execute C2 hunting via JA4 fingerprinting and beaconing analysis, detect post-exploitation techniques like LSASS dumping and LOLBin abuse, and validate detection coverage with purple-team emulation.
Threat Hunting helps you hunt threats and engineer detections across endpoints, networks, and cloud using ATT&CK, Sigma rules, and telemetry.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/threat-hunting · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/threat-hunting ~/.claude/skills/threat-huntingnpx skillfed install hypnguyen1209/offensive-claude/threat-huntingFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is threat-hunting and what does it cover?
Threat-hunting is a skill for conducting hypothesis-driven threat investigations across Windows endpoints, network traffic, and cloud identity. It equips you with Sigma-based detection rules, MITRE ATT&CK mapping, and offline triage tools to hunt threats, engineer detections, and validate coverage gaps using purple-team emulation.
How does threat-hunting help detect Windows post-exploitation?
Threat-hunting provides detection strategies for Windows post-exploitation techniques including LSASS dumping, ETW/AMSI tampering, LOLBin abuse, and process injection. You'll learn to use Sysmon telemetry, EVTX triage tools like Hayabusa and Chainsaw, and process tree anomaly detection to identify these attacks.
What sigma rules and windows endpoint detection methods does threat-hunting teach?
Threat-hunting teaches you to build and deploy Sigma rules for Windows endpoint detection, map them to MITRE ATT&CK techniques, and integrate them into detection-as-code CI pipelines. You'll learn to triage EVTX logs and correlate endpoint telemetry with network signals for comprehensive threat visibility.
How can threat-hunting detect C2 beaconing in encrypted traffic?
Threat-hunting covers C2 hunting via JA4 fingerprinting for malware identification, beaconing detection using tools like RITA, and DNS tunneling analysis. These techniques let you hunt command-and-control activity even in encrypted network traffic without decryption.
Does threat-hunting address cloud identity attack hunting?
Yes. Threat-hunting includes cloud identity attack hunting focused on device-code phishing, PRT token theft, and CloudTrail abuse detection. You'll learn to identify Entra ID compromise patterns and validate detections across hybrid cloud-identity environments.
How does threat-hunting validate detection coverage?
Threat-hunting teaches purple-team validation using atomic red team emulation to measure ATT&CK coverage gaps. You'll map detections to the coverage matrix via ATT&CK Navigator and refine your detection engineering based on real adversary behavior simulation.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: threat-hunting description: Use when hunting threats or engineering detections — ATT&CK Detection-Strategies, Sigma + correlation with Detection-as-Code CI, Windows endpoint hunting (Sysmon/ETW/LSASS/LOLBins), network C2 hunting (JA4+, beaconing, DNS tunneling), cloud-identity hunting, Atomic Red Team purple-team validation metadata: type: defensive phase: detection tools: sigma-cli, pysigma, hayabusa, chainsaw, velociraptor, sysmon, zeek, rita, ja4, atomic-red-team, caldera, splunk, sentinel, defender, kql mitre: TA0043 kill_chain: phase: [report] step: [8] attck_tactics: [TA0043, TA0042, TA0011, TA0006, TA0005] attck_techniques: [T1059.001, T1003.001, T1562.001, T1562.002, T1218, T1105, T1071, T1071.001, T1071.004, T1571, T1572, T1528, T1550.001, T1078.004, T1098, T1543.003, T1070.001, T1558.003, T1003.006] depends_on: [red-team-ops, incident-response] feeds_into: [] inputs: [finding_records, log_data, ioc_list, evtx, zeek_logs, cloudtrail, sigin_logs] outputs: [sigma_rules, correlation_rules, attck_navigator_export, coverage_matrix, detection_report, hunt_findings] references: - references/methodology-hunt-loop.md -
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 15 files
skills/threat-hunting/SKILL.md
skills/threat-hunting/references/cloud-identity-hunting.md
skills/threat-hunting/references/methodology-hunt-loop.md
skills/threat-hunting/references/network-c2-hunting.md
skills/threat-hunting/references/purple-team-validation.md
skills/threat-hunting/references/sigma-rule-engineering.md
skills/threat-hunting/references/windows-endpoint-hunting.md
skills/threat-hunting/scripts/beacon_hunter.py
skills/threat-hunting/scripts/cloudtrail_hunt.py
skills/threat-hunting/scripts/coverage_matrix.py
skills/threat-hunting/scripts/dac_validate.py
skills/threat-hunting/scripts/entra_hunt.kql
skills/threat-hunting/scripts/evtx_hunt.py
skills/threat-hunting/scripts/sigma_pipeline.sh
skills/threat-hunting/scripts/sysmon_config_2025.xml