skills.rest
jaskaranhundal
jaskaranhundalCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

threat-hunting

Execute hypothesis-driven, IOC-driven, and anomaly-driven threat hunting across endpoint, network, and cloud telemetry.

3|3|Updated Mar 8, 2026
Search Tags:#cybersecurity#incident response#detection#threat hunting#ioc#telemetry analysis
One-click install
npx skills add https://github.com/jaskaranhundal/usap-skills --skill threat-hunting-jaskaranhundal
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-hunting
Source: https://github.com/jaskaranhundal/usap-skills/tree/main/detection/threat-hunting
Command: npx skills add https://github.com/jaskaranhundal/usap-skills --skill threat-hunting-jaskaranhundal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires threat-hunting_tool.py, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill proactively searches for advanced threats that have bypassed automated security controls, ensuring no adversary activity goes unnoticed.

Core Features & Use Cases

  • Hypothesis-Driven Hunts: Investigate specific threat actor TTPs or intelligence.
  • IOC Sweeps: Rapidly search for known malicious indicators across your environment.
  • Anomaly Detection: Identify unusual behaviors that may indicate novel attacks.
  • Use Case: A threat intelligence report details a new technique used by ransomware gangs. You use this Skill to hunt for any signs of that technique in your network logs from the past 30 days.

Quick Start

Use the threat-hunting skill to hunt for WMI lateral movement activity in the last 7 days.

Frequently Asked Questions about threat-hunting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I hunt for threats in network and endpoint telemetry?▼

Threat hunting in telemetry requires hypothesis-driven, IOC-driven, and anomaly-driven searches across endpoint, network, and cloud logs. You generate falsifiable hypotheses, execute structured playbooks, estimate dwell time, and escalate confirmed threats.

What logs do I need for comprehensive threat hunting?▼

Comprehensive threat hunting requires EDR, DNS, proxy, firewall, authentication, and cloud audit logs. These telemetry sources provide the visibility needed to detect adversary activity that has bypassed automated security controls.

How do I search for known malicious indicators across my environment?▼

IOC sweeps rapidly search for known malicious indicators across your environment. This Skill executes structured hunt playbooks against your telemetry to identify any matches with threat intelligence reports on active adversary infrastructure.

Can I hunt for specific ransomware TTPs using authentication and proxy logs?▼

Yes, hypothesis-driven hunts investigate specific threat actor TTPs or intelligence. You can use this Skill to hunt for signs of newly reported techniques in your network and authentication logs from a specified lookback period.

How does anomaly detection work for finding novel attacks?▼

Anomaly-driven threat hunting identifies unusual behaviors in telemetry that may indicate novel attacks. By analyzing DNS, firewall, and cloud audit logs, it surfaces deviations from baseline activity that bypass standard automated detection rules.

What is the best way to estimate attacker dwell time during incident response?▼

Estimating attacker dwell time during incident response involves analyzing telemetry across endpoint and network logs to determine the window between initial compromise and detection. This Skill calculates that timeframe to support active threat escalation.

Related Skills

Explore More Data & Analytics Skills→
lloydchanglloydchang
2

aggregate-observability

Aggregates metrics, logs, and traces from AWS, Azure, and GCP into unified monitoring views.

Community
Advanced
aviskaaraviskaar
6

incident-responder

Execute incident response for security events with triage, containment, and forensic investigation.

Official
Advanced
devCharuzudevCharuzu

threat-detection

Structure hunting hypotheses, IOC sweeps, and anomaly detection across telemetry.

Community
Advanced
EojEdredEojEdred

security-dev01

Monitor validators and analyze SSH logs for security threats.

Community
Intermediate