skills.rest
brucesongs
brucesongsCOMMUNITY
Explore all skills by this author →
GitHub

threat-hunting

Convert hunt hypotheses into Sigma-based detections with MITRE ATT&CK mappings.

60|14|Updated Apr 27, 2026
Search Tags:#detection-engineering#detections#siem#threat-hunting#mitre-attack#sigma#purple-team
One-click install
npx skills add https://github.com/brucesongs/kali-claw --skill threat-hunting-brucesongs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-hunting
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/threat-hunting
Command: npx skills add https://github.com/brucesongs/kali-claw --skill threat-hunting-brucesongs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat-hunting teams need a repeatable process to convert loosely formed suspicions into testable, ATT&CK-mapped detections that survive platform migrations.

Core Features & Use Cases

  • MITRE ATT&CK mapping and Sigma-driven detection engineering
  • SIEM translation across Splunk SPL, Microsoft Sentinel KQL, and Elastic Lucene
  • End-to-end hunt lifecycle: hypothesis, telemetry inventory, query authoring, triage, and documentation
  • Purple-team workflows: facilitate red-team emulation and detection validation

Quick Start

Review the Threat Hunting SKILL, then draft a testable hypothesis and implement a Sigma rule to detect it.

Frequently Asked Questions about threat-hunting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I convert threat hunting hypotheses into Sigma detections?▼

Threat hunting hypotheses are converted into Sigma detections by authoring ATT&CK-mapped Sigma rules and translating them into SIEM queries. This approach transforms loosely formed suspicions into testable, durable detections.

Can I translate Sigma rules into Splunk SPL, Sentinel KQL, and Elastic Lucene?▼

Sigma rules can be translated across Splunk SPL, Microsoft Sentinel KQL, and Elastic Lucene. Multi-SIEM translation allows detections to survive platform migrations and integrates directly into existing SOC workflows.

What data sources do I need for MITRE ATT&CK threat hunting?▼

MITRE ATT&CK threat hunting requires a data-rich environment with Sysmon, Zeek, and Windows logs. These telemetry sources provide the endpoint and network visibility needed to validate adversary tradecraft detections.

Does purple teaming help validate Sigma detection rules?▼

Purple teaming validates Sigma detection rules by facilitating red-team emulation and detection validation. This workflow tests the effectiveness of your SIEM queries against simulated adversary techniques before deployment.

What is the best way to tune false positives in SIEM detections?▼

False positives in SIEM detections are tuned using a CI pipeline to validate rule deployment. This automated process ensures ATT&CK-mapped detections are accurately triaged and refined before moving to production.

How does ATT&CK mapping improve SIEM query engineering?▼

ATT&CK mapping improves SIEM query engineering by linking adversary tradecraft to specific detection logic. This structured approach ensures threat hunts produce documented, testable detections rather than ad-hoc queries.

Related Skills

Explore More Data & Analytics Skills→
xenitV1xenitV1
132

red-team-tactics

Model attacker techniques mapped to MITRE ATT&CK phases for defender simulations.

Community
Intermediate
notquenotque
415

opensearch-detection-engineer

Translate SIGMA rules into OpenSearch Security Analytics detectors with field validation.

Community
Advanced
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
woohyun212woohyun212
21

siem-rule

Convert threat objectives into Sigma rules and cross-platform SIEM detection queries.

Community
Advanced