skills.rest
yogiex
yogiexCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

threat-intelligence

Guides CTI lifecycle, IOC management, and threat hunting using STIX, MISP, and ATT&CK frameworks.

Updated Jun 5, 2026
Search Tags:#threat hunting#threat intelligence#ioc#stix#mitre att&ck#misp#cti
One-click install
npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill threat-intelligence-yogiex
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-intelligence
Source: https://github.com/yogiex/opencode-cyber-security-skills/tree/main/skills/threat-intelligence
Command: npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill threat-intelligence-yogiex

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security analysts often lack structured guidance when building a cyber threat intelligence program, managing indicators of compromise, or running hypothesis-driven threat hunts. This Skill provides the frameworks, standards, and tradecraft needed to perform intelligence-driven analysis without prior CTI experience. ## Core Features & Use Cases - CTI Lifecycle & Frameworks: Covers the 6-phase intelligence cycle, PIRs, Cyber Kill Chain, MITRE ATT&CK, Diamond Model, and Structured Analytic Techniques for bias mitigation. - IOC Management Standards: Explains STIX 2.1, TAXII 2.1, MISP event-attribute model, TLP 2.0 markings, YARA rules, and Sigma detection rules. - Threat Hunting Methodology: Details the PEAK framework, ABLE hypothesis model, Hunting Maturity Model, and ready-to-use query examples for Splunk, Elastic, and Sentinel. - Use Case: A SOC analyst needs to build a threat hunting program. The Skill guides them from defining PIRs, selecting data sources, writing KQL/SPL queries, to converting successful hunts into automated Sigma detection rules. ## Quick Start Ask the agent to explain how to build a hypothesis-driven threat hunt for Kerberoasting using the PEAK framework and ATT&CK mapping.

Frequently Asked Questions about threat-intelligence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I start a threat hunting program from scratch?▼

Start with the PEAK framework: Prepare by forming an ABLE hypothesis (Actor, Behavior, Location, Evidence), Execute with targeted SIEM queries, and Act by converting findings into detection rules. Prioritize TTP-based hunting over IOC-based hunting for longer-lasting detection value.

What is the difference between YARA, Sigma, and STIX?▼

YARA performs file and memory pattern matching for malware identification. Sigma defines SIEM-agnostic detection rules convertible to Splunk, KQL, or Elastic. STIX is a graph-based language for representing and exchanging threat intelligence, transported via TAXII.

MISP vs OpenCTI: which threat intelligence platform should I use?▼

MISP excels at IOC sharing with the largest community and 250+ modules, ideal for ISAC participation. OpenCTI offers native STIX 2.1 with a graph knowledge base for internal knowledge management. A mature architecture chains raw feeds through MISP into OpenCTI, then to SIEM/SOAR.

How does TLP 2.0 marking work for intelligence sharing?▼

TLP defines sharing boundaries: TLP:RED for recipients only, TLP:AMBER within the recipient's organization, TLP:GREEN within the community, and TLP:CLEAR for public release. TLP is a sharing boundary, not a confidentiality classification system.

Why is IOC-based threat hunting considered low value?▼

Atomic indicators like IPs and hashes expire within hours or days as adversaries rotate infrastructure. TTP-based hunting targets adversary techniques such as Kerberoasting, which remain relevant for years and produce more durable detections.

What are the limitations of threat intelligence platforms?▼

Platforms like MISP or OpenCTI without trained analysts become empty databases; tools enable analysts but do not replace them. Intelligence programs also fail without defined PIRs before collection and without closing the feedback loop to evaluate utility.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

hunting-for-spearphishing-indicators

Detect spearphishing campaigns by hunting indicators across email logs, endpoint telemetry, and network data.

Community
Intermediate
xalgordxalgord
954

collecting-indicators-of-compromise

Collects, enriches, and distributes indicators of compromise using STIX/TAXII and threat intelligence platforms.

Community
Advanced
xalgordxalgord
954

implementing-siem-use-cases-for-detection

Implements SIEM detection use cases with correlation rules mapped to MITRE ATT&CK techniques.

Community
Advanced
xalgordxalgord
954

building-threat-intelligence-platform

Deploy and integrate MISP, OpenCTI, TheHive, and Cortex into a unified threat intelligence platform.

Community
Advanced