skills.rest
yogiex
yogiexCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

offsec-th-200

Guides hypothesis-driven threat hunting using Splunk SPL, CrowdStrike CQL, and Suricata for OSTH exam preparation.

Updated Jun 5, 2026
Search Tags:#threat hunting#siem#splunk#suricata#mitre att&ck#crowdstrike#osth
One-click install
npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill offsec-th-200-yogiex
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offsec-th-200
Source: https://github.com/yogiex/opencode-cyber-security-skills/tree/main/skills/offsec-th-200
Command: npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill offsec-th-200-yogiex

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve? Preparing for the OffSec TH-200 (OSTH) threat hunting certification requires mastering proactive detection across Splunk, CrowdStrike Falcon, and Suricata, plus writing a professional hunt report worth 70 of 70 exam points. This Skill consolidates hunting methodologies, copy-paste queries, and a report template into one structured reference. ## Core Features & Use Cases - Query Libraries: Ready-to-use SPL queries for initial access, persistence, lateral movement, C2 beaconing, and exfiltration detection, plus CrowdStrike CQL queries for process and network hunting. - Hunting Frameworks: PEAK and SEARCH methodologies, hypothesis development guidance, MITRE ATT&CK mapping, and ransomware/APT case studies (LockBit, APT29, Lazarus). - Exam Report Template: A structured hunt narrative template with timeline, IOC table, ATT&CK mapping, and chain of custody sections. - Use Case: During an 8-hour OSTH exam simulation, load the Splunk hunting reference to run beaconing detection queries, correlate findings with CrowdStrike process trees, then fill the report template with timestamped evidence. ## Quick Start Ask the agent to help you hunt for C2 beaconing activity in proxy logs using Splunk SPL and map the findings to MITRE ATT&CK techniques.

Frequently Asked Questions about offsec-th-200

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect C2 beaconing with Splunk SPL?▼

Detect beaconing by aggregating proxy or network logs with stats count and distinct destination counts per source IP, then filtering for high connection counts to few destinations. The Skill provides copy-paste SPL queries using time bucketing and regularity scoring for beacon detection.

What is the difference between Splunk SPL and CrowdStrike CQL?▼

CQL syntax resembles SPL but differs in operators like IN and LIKE, and uses CamelCase field names such as FileName and CommandLine. CrowdStrike hunting centers on event types like ProcessRollup2 and NetworkConnectIP4 rather than Splunk indexes and sourcetypes.

Which Sysmon Event IDs matter most for threat hunting?▼

Key Sysmon Event IDs include 1 for process creation, 3 for network connections, 10 for LSASS access indicating credential dumping, 11 for file creation, and 22 for DNS queries. The endpoint hunting reference maps each Event ID to specific hunting use cases.

How do I integrate threat intelligence IOCs into Splunk searches?▼

Use inputlookup to load IOC CSV files containing IPs, domains, or hashes, then correlate them against network, DNS, or Sysmon logs with rename and stats commands. The Skill includes example queries for IP, domain, and hash IOC matching.

What should an OSTH hunt report include?▼

An OSTH hunt report needs an executive summary, hypothesis and methodology, a timestamped findings timeline, an IOC table, MITRE ATT&CK mapping, impact assessment, and recommendations. The assets folder provides a complete template including a chain of custody section.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

detecting-service-account-abuse

Detect service account abuse through anomalous logon types, Kerberoasting indicators, and lateral movement patterns.

Community
Intermediate
GhostPWNGhostPWN
4

Threat Hunting & IOC Analysis

Extract and normalize indicators of compromise from threat reports.

Official
Advanced
AxxxxxxaaannAxxxxxxaaann

analyzing-threat-actor-ttps-with-mitre-attack

Map threat actor techniques to MITRE ATT&CK and generate ATT&CK Navigator layers.

Community
Advanced
briiirussellbriiirussell
345

threat-hunting

Conduct hypothesis-driven threat hunts in SIEM/EDR logs using PEAK workflows.

Community
Advanced