skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-advanced-persistent-threats

Hunts for APT activity using hypothesis-driven queries across endpoint telemetry, network logs, and memory artifacts.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#siem#osquery#sigma#mitre att&ck#Velociraptor#APT
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-advanced-persistent-threats
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-advanced-persistent-threats
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/hunting-advanced-persistent-threats
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-advanced-persistent-threats

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams often lack a structured method to proactively search for Advanced Persistent Threats that evade signature-based detection, leaving long-dwell intrusions undiscovered until damage occurs.

Core Features & Use Cases

  • Hypothesis-Driven Hunting: Builds testable hunt hypotheses from MITRE ATT&CK group TTPs and maps each technique to required data sources like Sysmon, Zeek, and EDR telemetry.
  • Multi-Platform Query Execution: Provides ready-to-adapt Velociraptor VQL, osquery SQL, and Splunk SPL queries for detecting encoded PowerShell, scheduled-task persistence, and PsExec lateral movement.
  • Findings Operationalization: Structures results with the Diamond Model, validates hits across multiple data sources, and converts low-false-positive queries into portable Sigma detection rules.
  • Use Case: After an ISAC partner reports APT29 activity in your sector, use this Skill to test for spearphishing ISO attachments and living-off-the-land binaries across your fleet, then document coverage gaps where telemetry retention is insufficient.

Quick Start

Hunt my environment for APT29-style living-off-the-land activity using Velociraptor and osquery, and report any confirmed findings with their ATT&CK technique mappings.

Frequently Asked Questions about hunting-advanced-persistent-threats

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I start a threat hunt for APT activity?▼

Start by selecting a threat actor relevant to your sector from MITRE ATT&CK Groups and reviewing their known TTPs. Form a testable hypothesis, map each technique to required data sources like Sysmon Event ID 1 or Zeek conn.log, then execute queries with Velociraptor, osquery, or Splunk.

What tools are used for threat hunting queries?▼

The workflow uses Velociraptor VQL for endpoint hunting at scale, osquery SQL for real-time fleet queries, Splunk SPL for SIEM searches, and Zeek for network traffic analysis. Confirmed queries are converted to Sigma rules for portability across SIEM platforms.

How much log retention is needed for APT hunting?▼

APT hunting typically requires 90 or more days of log history because low-and-slow techniques like C2 beaconing and scheduled-task persistence unfold over long dwell times. Default 30-day retention is often insufficient and should be documented as a coverage gap.

When should I not use threat hunting procedures?▼

Do not use threat hunting when a confirmed breach is already in progress; that situation requires incident response procedures under NIST SP 800-61. Hunting is a proactive, hypothesis-driven activity, not a substitute for active incident containment.

Why does a threat hunt find nothing suspicious?▼

A null result often reflects data-coverage gaps rather than a clean environment. Verify that required telemetry exists for each ATT&CK technique before concluding, and confirm you have a known-good baseline, since living-off-the-land binaries only stand out against documented normal behavior.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

hunting-for-unusual-network-connections

Analyze EDR, SIEM, and Sysmon logs for unusual network connections.

Official
Advanced
jassicsjassics
6

incident-response

Orchestrate security incident response using NIST SP 800-61 and SANS PICERL.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

analyzing-threat-actor-ttps-with-mitre-attack

Map threat actor techniques to MITRE ATT&CK and generate ATT&CK Navigator layers.

Community
Advanced
doanchienthangdevdoanchienthangdev
4

Model Monitoring

Detect data drift and track performance metrics in deployed machine learning models.

Community
Advanced