skills.rest
chengzongcai
chengzongcaiCOMMUNITY
Explore all skills by this author →
GitHub

threat-hunting

Guides hypothesis-driven threat hunting and detection engineering with Sigma, YARA, and SIEM queries.

21|8|Updated Aug 3, 2026
Search Tags:#threat hunting#blue team#siem#sigma#yara#detection engineering#incident detection
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill threat-hunting-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-hunting
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/skills/threat-hunting
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill threat-hunting-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Blue-team analysts often query SIEM and EDR data without a clear hypothesis, producing noisy alerts and missed intrusions. This Skill enforces a structured hunt loop—hypothesis, query, validation, and rule conversion—so detections are grounded in evidence rather than guesswork. ## Core Features & Use Cases - Hypothesis-Driven Hunting: Defines hunt hypotheses with target data sources (Sysmon, Windows Security logs) and explicit success criteria before querying. - Detection Engineering: Converts hunt findings into Sigma and YARA rules with documented false-positive surfaces and data-source field mappings. - Detection Validation: Replays historical logs and runs Atomic Red Team tests in authorized labs to verify rule recall. - Use Case: An analyst suspects living-off-the-land lateral movement. The Skill guides them to baseline normal admin behavior, stack anomalies like encoded PowerShell and unusual outbound connections, then codify the finding as a Sigma rule linked to a response playbook. ## Quick Start Use the threat-hunting skill to build a hypothesis-driven hunt for suspicious PowerShell activity across our Sysmon logs and turn the findings into a Sigma rule.

Frequently Asked Questions about threat-hunting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I start a hypothesis-driven threat hunt?▼

Begin by writing a specific hypothesis, such as attackers using living-off-the-land techniques for lateral movement, then map it to data sources like Sysmon events 1/3/10 and Windows Security 4624/4648. Define success criteria before running any queries to avoid aimless alert review.

How to convert threat hunting findings into Sigma rules?▼

Document the detected behavior, its data-source field mappings, and the expected false-positive surface, then write the Sigma rule skeleton and convert it with Sigma CLI or sigmac. Link each rule to a response playbook so alerts are actionable.

What tools are used for threat hunting and detection engineering?▼

The workflow uses Sigma CLI or sigmac for rule conversion, YARA for file and memory matching, SIEM platforms like ELK or Splunk for querying, osquery for endpoint hunting, and Atomic Red Team for detection validation in labs.

Can I run Atomic Red Team tests in a production environment?▼

No. Attack simulation with Atomic Red Team must only run in an authorized lab environment. Production validation should rely on replaying historical logs to measure rule recall instead of executing attack techniques.

How does threat hunting relate to malware analysis and digital forensics?▼

Indicators of compromise from malware analysis feed into hunts as detection content, while artifacts from forensic cases drive lateral hunting across the environment. Confirmed intrusions route back to forensics for full investigation.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

building-threat-hunt-hypothesis-framework

Builds testable threat hunt hypotheses from threat intelligence, ATT&CK techniques, and telemetry data sources.

Community
Intermediate
dreadnodedreadnode
11

yara-memory-hunting

Run YARA rules against full memory dumps or individual processes via Volatility.

Official
Intermediate
YukiIto1999YukiIto1999

dfir

Analyzes Windows event logs, PCAPs, and filesystem artifacts to detect security incidents.

Community
Advanced
briiirussellbriiirussell
345

threat-hunting

Conduct hypothesis-driven threat hunts in SIEM/EDR logs using PEAK workflows.

Community
Advanced