skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-threat-hunting-with-elastic-siem

Hunts threats in Elastic Security SIEM using KQL, EQL queries, and Timeline investigations.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#detection rules#KQL#SoC#mitre att&ck#eql#elastic siem
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-threat-hunting-with-elastic-siem
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-threat-hunting-with-elastic-siem
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/soc-operations/performing-threat-hunting-with-elastic-siem
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-threat-hunting-with-elastic-siem

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automated detection rules miss novel attacker techniques, leaving SOC teams blind to threats hiding in their telemetry. This Skill provides a structured, hypothesis-driven workflow for proactively hunting threats in Elastic Security SIEM before they cause damage.

Core Features & Use Cases

  • KQL and EQL Hunting Queries: Ready-to-adapt queries for detecting LOLBin abuse, credential dumping, process injection, and lateral movement mapped to MITRE ATT&CK techniques.
  • Timeline Investigation: Guidance for building collaborative Elastic Security Timelines to correlate and annotate suspicious events across hosts.
  • Detection Rule Conversion: Steps to convert validated hunting queries into production Elastic detection rules deployable via the Kibana API.
  • Use Case: A threat intel report warns of certutil.exe being used for payload downloads (T1105). Use this Skill to hunt the last 30 days of endpoint telemetry, identify three compromised hosts, and deploy a new detection rule closing the coverage gap.

Quick Start

Hunt my Elastic Security environment for certutil.exe being used with download flags over the past 30 days and summarize any suspicious hosts.

Frequently Asked Questions about performing-threat-hunting-with-elastic-siem

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I hunt for threats in Elastic Security SIEM?▼

Start with a hypothesis based on a MITRE ATT&CK technique, then query endpoint telemetry in Kibana Discover using KQL filters on fields like process.name and process.args. Use EQL sequence queries for multi-step attack patterns and pin findings to a Security Timeline.

What is the difference between KQL and EQL in Elasticsearch?▼

KQL is a filter-based query language for searching documents in Kibana Discover and dashboards. EQL is a sequence-aware language that correlates ordered events, making it suited for detecting multi-step attacks like process injection or lateral movement.

How do I detect certutil.exe abuse with KQL?▼

Query process.name: "certutil.exe" combined with process.args containing flags like -urlcache, -split, or -decode. Exclude known legitimate parents such as ccmexec.exe and the SYSTEM account to reduce false positives from SCCM activity.

What data sources are required for Elastic threat hunting?▼

You need Elastic Security 8.x with data ingested via Elastic Agent (Endpoint Security integration) or Beats such as Winlogbeat and Packetbeat. All data must be normalized to Elastic Common Schema field mappings for cross-source correlation.

Can hunting queries be converted into Elastic detection rules?▼

Yes, validated hunting queries can be converted into detection rules with severity, risk score, and MITRE ATT&CK mappings. Deploy them programmatically by posting the rule JSON to the Kibana detection engine API endpoint.

When should I not use threat hunting in Elastic SIEM?▼

Do not use hypothesis-driven hunting for real-time alert triage, which belongs in the Elastic Security Alerts queue with automated detection rules. Hunting is for proactively finding threats that evade existing detections over historical data.

Related Skills

Explore More Software Engineering Skills→
elasticelastic
546

security-generate-security-sample-data

Generate ECS-compliant security events and synthetic alerts for Elastic Security.

Official
Advanced
sjinkssjinks

security-review-owasp-vulnerability-disclosure

Identify vulnerability disclosure control gaps in code, configuration, and workflows.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

analyzing-threat-actor-ttps-with-mitre-attack

Map threat actor techniques to MITRE ATT&CK and generate ATT&CK Navigator layers.

Community
Advanced
woohyun212woohyun212
21

siem-rule

Convert threat objectives into Sigma rules and cross-platform SIEM detection queries.

Community
Advanced