skills.rest
copyleftdev
copyleftdevCOMMUNITY
Explore all skills by this author →
GitHub

rodriguez-threat-hunter-playbook

Implement Roberto Rodriguez's threat hunting methodology with Jupyter notebooks and ATT&CK mapping.

Updated Jan 24, 2026
Search Tags:#playbook#cybersecurity#detection#threat hunting#siem#mitre att&ck#attack
One-click install
npx skills add https://github.com/copyleftdev/sk1llz --skill rodriguez-threat-hunter-playbook
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: rodriguez-threat-hunter-playbook
Source: https://github.com/copyleftdev/sk1llz/tree/main/domains/security/threat-hunting/rodriguez
Command: npx skills add https://github.com/copyleftdev/sk1llz --skill rodriguez-threat-hunter-playbook

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a structured, reproducible methodology for threat hunting, enabling security teams to build effective hunting programs and develop detailed hunt playbooks based on real-world techniques.

Core Features & Use Cases

  • Reproducible Hunts: Utilizes Jupyter notebooks and documented methodologies for repeatable threat hunting.
  • ATT&CK Mapping: Aligns hunts with MITRE ATT&CK techniques for standardized threat understanding.
  • Open Source Infrastructure: Leverages tools like HELK and Mordor datasets for accessible and testable hunting.
  • Use Case: A security analyst needs to develop a new hunt for detecting credential dumping. They can use this Skill to find a documented playbook, adapt its queries and methodology, and test it against simulated attack data.

Quick Start

Use the rodriguez-threat-hunter-playbook skill to generate a Jupyter notebook for detecting credential dumping via LSASS memory access.

Frequently Asked Questions about rodriguez-threat-hunter-playbook

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a threat hunting playbook using MITRE ATT&CK mapping?▼

To build a threat hunting playbook, this Skill implements Roberto Rodriguez's methodology by mapping documented hunts to MITRE ATT&CK techniques. It provides structured, reproducible workflows using Jupyter notebooks to standardize threat understanding and detection strategies.

What is data-driven threat hunting and how does it work with SIEM data?▼

Data-driven threat hunting utilizes structured queries against SIEM data to find adversarial behaviors. This Skill operationalizes that process by applying the Threat Hunter Playbook methodology to validate hunts using Mordor datasets and HELK infrastructure.

Can I use Jupyter notebooks to detect credential dumping via LSASS memory access?▼

Yes, you can use Jupyter notebooks to detect credential dumping via LSASS memory access. The Skill generates reproducible notebooks that adapt documented queries and methodologies, allowing you to test detections against simulated attack data.

Does this threat hunting approach require open-source infrastructure like HELK?▼

This methodology leverages open-source infrastructure like HELK and Mordor datasets to ensure accessible and testable hunting. While it focuses on these platforms for reproducibility, the documented hunt queries can be adapted for other SIEM environments.

What's the best way to validate threat hunting queries against simulated attack data?▼

The best way to validate threat hunting queries is by using Mordor datasets within Jupyter notebooks. This Skill provides reproducible methodologies to test and refine your detections against simulated attack data before deploying them to production.

Why use reproducible Jupyter notebooks for developing hunt playbooks?▼

Reproducible Jupyter notebooks ensure that threat hunting methodologies are transparent, repeatable, and testable. This Skill uses them to document hunts aligned with MITRE ATT&CK, enabling security teams to build consistent and effective hunting programs.

Related Skills

Explore More Software Engineering Skills→
dandyedandye
120

hunt-credential-access

Hunt credential access techniques across SIEM telemetry using MITRE IDs and threat intel.

Community
Intermediate
coreymaypraycoreymaypray
1

threat-detection-engineer

Author Sigma detection rules with MITRE ATT&CK mapping for SIEM deployment.

Community
Advanced
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced