skills.rest
GhostPWN
GhostPWNOFFICIAL
Explore all skills by this author →
GitHub

Threat Hunting & IOC Analysis

Extract and normalize indicators of compromise from threat reports.

4|Updated Mar 10, 2026
Search Tags:#siem#threat-hunting#threat-intelligence#mitre-attack#sigma#ioc-extraction
One-click install
npx skills add https://github.com/GhostPWN/ghostpwn --skill threat-hunting-ioc-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Threat Hunting & IOC Analysis
Source: https://github.com/GhostPWN/ghostpwn/tree/main/src/skills/06-threat-hunting
Command: npx skills add https://github.com/GhostPWN/ghostpwn --skill threat-hunting-ioc-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill removes the manual overhead of turning threat reports, advisories, and logs into usable hunting intelligence, so analysts can move faster from raw evidence to actionable defense.

Core Features & Use Cases

  • IOC Extraction and Normalization: Pulls indicators such as IPs, domains, hashes, URLs, emails, and file paths from text and normalizes or defangs them for safe sharing.
  • MITRE ATT&CK Mapping: Converts observed behaviors and techniques into ATT&CK tactics, techniques, sub-techniques, and Navigator layers for consistent analysis.
  • Detection and Hunt Engineering: Produces hunt hypotheses, SIEM queries, and Sigma-style detection logic for platforms such as Splunk, Elastic, and Microsoft Sentinel.
  • Use Case: A threat hunter can feed in a security advisory, extract indicators, map the attacker behavior, and generate a focused hunt plan with measurable outcomes.

Quick Start

Ask the skill to analyze a threat report, extract the indicators of compromise, map the behaviors to MITRE ATT&CK, and draft a hunt hypothesis with detection logic.

Frequently Asked Questions about Threat Hunting & IOC Analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract IOCs from threat reports and map them to MITRE ATT&CK?▼

IOC extraction parses indicators like IPs, domains, and hashes from text using regex, then normalizes and defangs them. It maps observed behaviors to ATT&CK tactics and techniques to generate actionable hunting intelligence and consistent analysis.

Can I generate Sigma detection rules and SIEM queries from raw threat intelligence?▼

Yes, Sigma-style detection logic and SIEM queries can be generated for platforms like Splunk and Elastic. It transforms extracted indicators and mapped behaviors into hunt hypotheses with measurable outcomes and ready-to-deploy detection rules.

What output formats are supported for sharing normalized threat intelligence and ATT&CK layers?▼

Supported outputs include JSON, CSV, STIX, Splunk, Elastic, and MITRE ATT&CK Navigator layers. This allows analysts to export defanged, deduplicated indicators and mapped behaviors for safe sharing and direct platform integration.

Does this IOC extraction approach work with unstructured sources like security advisories and emails?▼

Yes, IOC extraction and normalization processes unstructured text from security advisories, emails, reports, and logs. Regex-based parsing pulls indicators directly from these sources to build hunt-ready detections without requiring preformatted input.

Why do I need to defang and deduplicate IOCs during threat hunting analysis?▼

Defanging and deduplication prevent accidental detonation of malicious indicators and remove redundant data. Normalizing extracted IPs, domains, hashes, and URLs ensures safe sharing and accurate threat intelligence mapping for downstream hunting.

What is the best way to turn threat intel into hunt-ready detections for SIEM platforms?▼

The best way is to extract and normalize IOCs, map behaviors to MITRE ATT&CK, and generate hunt hypotheses. This produces Sigma-style detection logic and SIEM queries for Splunk and Elastic, moving analysts from raw evidence to actionable defense.

Related Skills

Explore More Data & Analytics Skills→
SherifEldeebSherifEldeeb
5

threat-intelligence

Extract, normalize, and report cyber threat intelligence from unstructured text.

Community
Intermediate
MHaggisMHaggis
471

detection-yaml-engineer

Generate and validate security detection rules for Splunk, Sigma, Elastic, and KQL.

Community
Intermediate
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
YukiIto1999YukiIto1999

extracting-iocs-from-malware-samples

Extract IOCs from malware samples and export STIX 2.1 and CSV artifacts.

Community
Advanced