skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-spearphishing-indicators

Detect spearphishing campaigns by hunting indicators across email logs, endpoint telemetry, and network data.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#siem#edr#email security#mitre attack#t1566#spearphishing
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-spearphishing-indicators
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-spearphishing-indicators
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-spearphishing-indicators
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-spearphishing-indicators

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Targeted spearphishing attacks (MITRE ATT&CK T1566) often bypass email gateways through HTML smuggling, container files, and credential-harvest links, leaving security teams without a reliable way to proactively find these intrusions before damage occurs.

Core Features & Use Cases

  • Hypothesis-Driven Hunting: A structured 7-step workflow from hypothesis formulation through query execution, validation, and reporting.
  • Multi-Source Detection Guidance: Concrete pivot points across Sysmon, EDR (CrowdStrike, MDE), and SIEM (Splunk, Elastic) telemetry, including parent-child process chains and MOTW checks.
  • Use Case: After threat intelligence reports an active T1566.001 campaign, hunt your environment for Office applications spawning PowerShell or mshta, validate with Atomic Red Team tests, and document findings in a standardized hunt report.

Quick Start

Hunt my environment for spearphishing indicators related to MITRE technique T1566.001 using Sysmon and EDR telemetry.

Frequently Asked Questions about hunting-for-spearphishing-indicators

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I hunt for spearphishing indicators in my environment?▼

Formulate a hypothesis based on threat intelligence, then query EDR and SIEM data for Office or Outlook processes spawning children like PowerShell, wscript, or mshta. Correlate with file writes of .iso, .lnk, or .hta files to temp folders and validate findings before reporting.

What tools are needed for spearphishing threat hunting?▼

You need an EDR platform such as CrowdStrike Falcon or Microsoft Defender for Endpoint, a SIEM like Splunk or Elastic Security, Sysmon with a comprehensive configuration, Windows Security Event Log forwarding, and threat intelligence feeds for IOC correlation.

Why do email gateways miss some spearphishing attachments?▼

Gateways miss HTML smuggling where JavaScript builds the payload client-side, ISO/IMG/VHD containers that strip Mark-of-the-Web, password-protected ZIPs that cannot be inspected, QR-code phishing in PDFs, and OneNote attachments.

Can EDR detect credential harvesting phishing links?▼

No, pure-link credential harvesting leaves no endpoint artifact, so EDR cannot see it. You need proxy and URL logs from network data sources to detect users following malicious links.

How do I validate spearphishing detections and reduce false positives?▼

Run Atomic Red Team test T1566.001 to confirm your parent-to-child process detection chain fires. Reduce false positives by baselining legitimate Office automation, add-ins, and known mail-merge senders before alerting.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

hunting-for-unusual-network-connections

Analyze EDR, SIEM, and Sysmon logs for unusual network connections.

Official
Advanced
dreadnodedreadnode
11

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

Official
Advanced
Liberty91LTDLiberty91LTD
15

threat-actor-profiling

Organize threat actor intelligence into update-ready profiles with MITRE ATT&CK mappings.

Official
Advanced
bomberoxenviosdosruedasbomberoxenviosdosruedas

agency-threat-detection-engineer

Develop and deploy SIEM detection rules mapped to MITRE ATT&CK.

Community
Advanced