threat-hunting

ljchg12-hue's avatarfrom ljchg12-hue

Proactive threat detection using Sigma rules, IOCs, and behavioral analytics

⭐0stars🔀0forks📁View on GitHub🕐Updated Jan 6, 2026
[Security Operations]

When & Why to Use This Skill

This Claude skill enables proactive threat detection and cybersecurity investigation by leveraging Sigma rules, Indicators of Compromise (IOCs), and behavioral analytics. It assists security teams in identifying anomalies, analyzing system logs, and mapping threats to the MITRE ATT&CK framework to enhance an organization's overall security posture and defensive readiness.

Use Cases

  • Automated Threat Detection: Utilize Sigma rules to scan PowerShell logs and system events for suspicious patterns like script-block execution or unauthorized downloads.
  • IOC Investigation & Validation: Rapidly cross-reference network traffic and file hashes against known malicious indicators to identify potential breaches.
  • Behavioral Anomaly Analysis: Detect sophisticated threats by identifying deviations from system baselines and analyzing temporal patterns in user activity.
  • Incident Timeline Reconstruction: Parse and correlate diverse security logs to build a comprehensive chronological map of events during a forensic investigation.
namethreat-hunting
descriptionProactive threat detection using Sigma rules, IOCs, and behavioral analytics

Threat Hunting Skill

Proactive threat detection and investigation using detection rules, IOCs, and behavioral analytics.

When to Use

  • Threat hunting activities
  • Suspicious behavior detection
  • Security log analysis, IOC analysis
  • Keywords: "threat", "hunt", "detection", "suspicious", "malware"

Core Capabilities

1. Sigma Rule Analysis

  • Rule interpretation/execution
  • Custom rule creation
  • False positive reduction

2. IOC Detection

  • IP/domain reputation
  • File hash lookups
  • Process behavior monitoring

3. Behavioral Analytics

  • Anomaly detection
  • Baseline deviation
  • Temporal pattern analysis

4. Log Analysis

  • System log parsing
  • Event correlation
  • Timeline reconstruction

Sigma Rule Example

title: Suspicious PowerShell Download
logsource:
    product: windows
    service: powershell
detection:
    selection:
        EventID: 4104
        ScriptBlockText|contains:
            - 'DownloadString'
            - 'DownloadFile'
    condition: selection
level: medium

Hunting Workflow

  1. Hypothesis: Identify threats from intel, incidents, trends
  2. Data Collection: Log sources, time range, normalization
  3. Analysis: Apply rules, search IOCs, find anomalies
  4. Investigation: Validate, eliminate false positives
  5. Response: Escalate, remediate, update rules

IOC Types

Type Examples
Network C2 IPs, malicious domains, unusual ports
File Malware hashes, suspicious paths
Process Bad process names, unusual parent-child
Registry Persistence keys, malware artifacts

Quick Commands

# Log search
grep -i "suspicious_pattern" /var/log/auth.log

# Check connections
netstat -antp | grep ESTABLISHED

# Process analysis
ps aux | lsof -i -n -P

MITRE ATT&CK Mapping

  • Initial Access → Execution → Persistence
  • Privilege Escalation → Defense Evasion
  • Credential Access → Lateral Movement
  • Collection → Exfiltration

Best Practices

  • ✅ Hypothesis-driven hunting
  • ✅ Combine multiple data sources
  • ✅ Document all findings
  • ❌ Don't rely on single indicator
  • ❌ Don't skip validation

Integration

  • digital-forensics: Evidence collection
  • log-analysis: Advanced parsing