skills.rest
briiirussell
briiirussellCOMMUNITY
Explore all skills by this author →
GitHub

threat-hunting

Conduct hypothesis-driven threat hunts in SIEM/EDR logs using PEAK workflows.

345|47|Updated Mar 13, 2026
Search Tags:#threat hunting#siem#edr#mitre att&ck#detection engineering#hypothesis driven#incident escalation
One-click install
npx skills add https://github.com/briiirussell/cybersecurity-skills --skill threat-hunting-briiirussell
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-hunting
Source: https://github.com/briiirussell/cybersecurity-skills/tree/main/skills/threat-hunting
Command: npx skills add https://github.com/briiirussell/cybersecurity-skills --skill threat-hunting-briiirussell

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat-hunting helps you proactively identify adversary activity that has evaded existing detections, so you can confirm or rule out suspected compromise before it turns into an incident.

Core Features & Use Cases

  • Hypothesis-driven hunting: Build a specific, testable, bounded hunt hypothesis tied to an ATT&CK technique and expected evidence rather than “browse the logs.”
  • PEAK methodology execution: Prepare the hypothesis, execute using pivot/anomaly patterns, act on hits, and capture knowledge as artifacts (rules, documented results, or coverage gaps).
  • High-yield hunt catalogs: Run targeted ideas across persistence, defense evasion, credential access, discovery, lateral movement, staging/exfiltration, plus cloud and identity-provider-specific scenarios.

Quick Start

Use the threat-hunting skill to run a PEAK-based hunt hypothesis for “T1059.001 (PowerShell) with -EncodedCommand launched by Office processes” within the last 30 days and produce a hunt report with findings, conclusion, and recommended detection or next steps.

Frequently Asked Questions about threat-hunting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is hypothesis-driven threat hunting in SIEM and EDR environments?▼

Threat hunting helps proactively identify adversary activity that has evaded existing detections, allowing you to confirm or rule out suspected compromise before it turns into an incident. It targets persistence, evasion, credential access, lateral movement, and exfiltration behaviors.

How do I run a threat hunt using the MITRE ATT&CK framework?▼

Threat hunting in SIEM and EDR environments requires authorized access to log data sources. You need to define a bounded time and scope hypothesis tied to MITRE ATT&CK techniques, then execute using technique-based pivots, indicator pivots, and anomaly baselining.

Can I use this approach to detect PowerShell execution with EncodedCommand launched by Office processes?▼

You can run a PEAK-based hunt hypothesis for T1059.001 (PowerShell) with -EncodedCommand launched by Office processes within the last 30 days. This produces a hunt report with findings, conclusion, and recommended detection or next steps.

What's the best way to find stealthy adversaries before alerts fire in my SIEM?▼

Threat hunting using the PEAK methodology helps you proactively identify adversary activity that has evaded existing detections. It executes pivot and anomaly patterns across SIEM and EDR logs to capture knowledge as artifacts, rules, or documented coverage gaps.

What output should a threat hunting engagement produce?▼

Threat hunting produces structured outputs following the PEAK workflow. You get detection artifacts, documented hunt outcomes, and identified coverage gaps, which confirm or rule out suspected compromise before it escalates into an incident.

Does threat hunting replace automated SIEM or EDR alerting?▼

Threat hunting supplements automated SIEM and EDR alerting by discovering adversary behavior that has not triggered current alerts. It applies proactive detection using technique-based pivots, indicator pivots, and anomaly baselining rather than reactive alert triage.

Related Skills

Explore More Legal & Compliance Skills→
devCharuzudevCharuzu

threat-detection

Structure hunting hypotheses, IOC sweeps, and anomaly detection across telemetry.

Community
Advanced
daemon-blockint-techdaemon-blockint-tech
7

threat-hunter

Validate adversary hypotheses across enterprise telemetry using MITRE ATT&CK mapping.

Community
Advanced
MHaggisMHaggis
471

PR Extension Workflow

Analyze pull requests for security detection coverage gaps and recommend extensions.

Community
Advanced
tekgrunttekgrunt

threat-hunter

Guide hypothesis-driven threat hunts and convert findings into LimaCharlie D&R rules.

Community
Advanced