threat-hunting

Name: threat-hunting
Availability: InStock
Author: brucesongs

Convert hunt hypotheses into Sigma-based detections with MITRE ATT&CK mappings.

60|14|Updated Apr 27, 2026

Search Tags:#detection-engineering #detections #siem #threat-hunting #mitre-attack #sigma #purple-team

Ready to run

npx skills add https://github.com/brucesongs/kali-claw --skill threat-hunting-brucesongs

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: threat-hunting
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/threat-hunting
Command: npx skills add https://github.com/brucesongs/kali-claw --skill threat-hunting-brucesongs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat-hunting teams need a repeatable process to convert loosely formed suspicions into testable, ATT&CK-mapped detections that survive platform migrations.

Core Features & Use Cases

MITRE ATT&CK mapping and Sigma-driven detection engineering
SIEM translation across Splunk SPL, Microsoft Sentinel KQL, and Elastic Lucene
End-to-end hunt lifecycle: hypothesis, telemetry inventory, query authoring, triage, and documentation
Purple-team workflows: facilitate red-team emulation and detection validation

Quick Start

Review the Threat Hunting SKILL, then draft a testable hypothesis and implement a Sigma rule to detect it.

Frequently Asked Questions about threat-hunting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I convert threat hunting hypotheses into Sigma detections?▼

Threat hunting hypotheses are converted into Sigma detections by authoring ATT&CK-mapped Sigma rules and translating them into SIEM queries. This approach transforms loosely formed suspicions into testable, durable detections.

Can I translate Sigma rules into Splunk SPL, Sentinel KQL, and Elastic Lucene?▼

Sigma rules can be translated across Splunk SPL, Microsoft Sentinel KQL, and Elastic Lucene. Multi-SIEM translation allows detections to survive platform migrations and integrates directly into existing SOC workflows.

What data sources do I need for MITRE ATT&CK threat hunting?▼

MITRE ATT&CK threat hunting requires a data-rich environment with Sysmon, Zeek, and Windows logs. These telemetry sources provide the endpoint and network visibility needed to validate adversary tradecraft detections.

Does purple teaming help validate Sigma detection rules?▼

Purple teaming validates Sigma detection rules by facilitating red-team emulation and detection validation. This workflow tests the effectiveness of your SIEM queries against simulated adversary techniques before deployment.

What is the best way to tune false positives in SIEM detections?▼

False positives in SIEM detections are tuned using a CI pipeline to validate rule deployment. This automated process ensures ATT&CK-mapped detections are accurately triaged and refined before moving to production.

How does ATT&CK mapping improve SIEM query engineering?▼

ATT&CK mapping improves SIEM query engineering by linking adversary tradecraft to specific detection logic. This structured approach ensures threat hunts produce documented, testable detections rather than ad-hoc queries.