skills.rest
hypnguyen1209
hypnguyen1209COMMUNITY
Explore all skills by this author →
Website𝕏@meulody_GitHub

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

338|59|Updated May 19, 2026
Search Tags:#detection#log-analysis#incident-response#threat-hunting#mitre-attack#ioc#sigma
One-click install
npx skills add https://github.com/hypnguyen1209/offensive-claude --skill threat-hunting-hypnguyen1209
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-hunting
Source: https://github.com/hypnguyen1209/offensive-claude/tree/main/skills/threat-hunting
Command: npx skills add https://github.com/hypnguyen1209/offensive-claude --skill threat-hunting-hypnguyen1209

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Proactively hunts for threats across the infrastructure, extracts IOC data, and aligns findings with MITRE ATT&CK to speed investigations.

Core Features & Use Cases

  • Proactive threat hunting across logs, endpoints, and network telemetry
  • IOC extraction, mapping to MITRE ATT&CK, and anomaly correlation
  • Detection rule authoring and incident response triage support

Quick Start

Activate threat-hunting to start a proactive search across logs for indicators of compromise and map findings to MITRE ATT&CK.

Frequently Asked Questions about threat-hunting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I hunt for threats across enterprise logs and network telemetry?▼

Threat hunting across enterprise logs and network telemetry is performed by proactively searching for anomalies, correlating events, and extracting indicators of compromise to detect hidden threats.

What is MITRE ATT&CK mapping for incident response?▼

MITRE ATT&CK mapping for incident response is the process of correlating detected anomalies and extracted IOCs with known adversary techniques to speed up investigations and support triage.

How do I extract IOCs from endpoint logs for threat detection?▼

IOC extraction from endpoint logs for threat detection is achieved by analyzing telemetry to identify indicators of compromise, mapping them to MITRE ATT&CK, and generating detection reports.

Can I use Sigma rules for log analysis and anomaly baselining?▼

Sigma rules for log analysis and anomaly baselining are supported through detection rule authoring, allowing you to establish baselines and proactively hunt for threats across infrastructure logs.

What's the best way to map detected anomalies to MITRE ATT&CK techniques?▼

Mapping detected anomalies to MITRE ATT&CK techniques is best handled by correlating events across logs and endpoints, extracting IOC data, and aligning findings to speed investigations.

Does threat hunting support incident response triage and detection reports?▼

Threat hunting supports incident response triage and detection reports by extracting IOC data, mapping techniques to MITRE ATT&CK, and generating reports to guide investigation workflows.

Related Skills

Explore More Data & Analytics Skills→
jaskaranhundaljaskaranhundal
3

threat-hunting

Execute hypothesis-driven, IOC-driven, and anomaly-driven threat hunting across endpoint, network, and cloud telemetry.

Community
Advanced
riparinoriparino
1

defensive-keylogger-detection

Detect keylogger activity using YARA rules and API hook detection.

Community
Advanced
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
skywatch-bskyskywatch-bsky
6

scanning-the-network

Coordinate parallel subagent investigations to generate consolidated network threat reports.

Official
Advanced