skills.rest
4lerman
4lermanCOMMUNITY
Explore all skills by this author →
GitHub

threat-detection

Score hunting hypotheses against MITRE ATT&CK techniques and IOC data.

Updated Apr 2, 2026
Search Tags:#anomaly detection#threat hunting#MITRE ATT&CK#deception#automated workflows#IOC analysis#proactive defense
One-click install
npx skills add https://github.com/4lerman/text_evaluator --skill threat-detection-4lerman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-detection
Source: https://github.com/4lerman/text_evaluator/tree/main/.agents/skills/engineering-skills/threat-detection
Command: npx skills add https://github.com/4lerman/text_evaluator --skill threat-detection-4lerman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python, pandas, numpy, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill addresses the challenge of proactive threat detection and hunting, allowing for the identification of attacker activity before alerts fire.

Core Features & Use Cases

  • Hypothesis-Driven Threat Hunting: Scores hunting hypotheses against MITRE ATT&CK techniques and data availability to prioritize investigation.
  • Indicator of Compromise (IOC) Analysis: Maps IOCs to required sweep targets, filters stale data, and prioritizes MITRE ATT&CK-mapped signals.
  • Anomaly Detection: Detects statistical outliers in telemetry events for behavior deviations from established baselines.
  • MITRE ATT&CK Signal Prioritization: Prioritizes hunting hypotheses by ATT&CK techniques with multiple confirmed signals.
  • Deception and Honeypot Integration: Utilizes deception assets for high-fidelity alerts on any interaction with a honeypot.
  • Automated Workflows: Implements automated workflows for continuous monitoring and response.
  • Use Case: For an organization looking to enhance its proactive defense, this Skill can help identify and prioritize threats, reducing the window of opportunity for adversaries.

Quick Start

Analyze a threat hunting hypothesis using the threat_signal_analyzer.py script with the following command:

python3 scripts/threat_signal_analyzer.py --mode hunt --hypothesis "APT using WMI for lateral movement" --json

Frequently Asked Questions about threat-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I start hypothesis-driven threat hunting using MITRE ATT&CK techniques?▼

Hypothesis-driven threat hunting starts by scoring your investigation hypotheses against MITRE ATT&CK techniques and data availability. You can analyze a hunting hypothesis, such as APT lateral movement, using the threat_signal_analyzer.py script to prioritize threats.

What is IOC analysis and how does it filter stale threat intelligence data?▼

IOC analysis maps Indicators of Compromise to required sweep targets while filtering stale data. It prioritizes MITRE ATT&CK-mapped signals to help identify attacker activity before alerts fire, reducing the window of opportunity for adversaries.

How do I detect anomalies in telemetry logs for proactive defense?▼

Anomaly detection identifies statistical outliers in telemetry events to find behavior deviations from established baselines. This proactive defense mechanism helps surface hidden attacker activity by analyzing logs and threat intelligence data.

Can I use Python with pandas and numpy for threat signal analysis?▼

Yes, this threat signal analysis requires Python, pandas, and numpy as dependencies to process telemetry data and execute anomaly detection scripts. You run the threat_signal_analyzer.py script via command line with your hunting parameters.

Does deception and honeypot integration improve threat detection fidelity?▼

Deception and honeypot integration improves threat detection fidelity by generating high-fidelity alerts on any interaction with a deception asset. This allows proactive defenders to immediately identify and respond to adversary engagement.

What is the best way to automate continuous monitoring for threat hunting?▼

The best way to automate continuous monitoring is by implementing automated workflows for threat detection. This approach continuously analyzes IOCs and anomalies against established baselines, enabling immediate response to identified threats.

Related Skills

Explore More Software Engineering Skills→
julianobarbosajulianobarbosa
7

Azure Integration

Manage Cloudflare DNS records for Azure-hosted applications via REST API.

Community
Advanced
AgentSecOpsAgentSecOps
183

ir-velociraptor

Analyze endpoint telemetry and artifacts for incident response with Velociraptor VQL workflows.

Official
Advanced
AdawoduAdawodu

engineering-threat-detection-engineer

Automate Sigma SIEM rule creation, MITRE ATT&CK mapping, and detection-as-code pipelines.

Community
Advanced
ConsiliencyConsiliency
8

library-detection

Detect project technology stacks by analyzing package manifests and configuration files.

Official
Basic