Cyber Threat Hunting
Conducts hypothesis-driven, evidence-preserving threat hunts with bounded negative...
Install
npx skills add HoangNguyen0403/agent-skills-standard --skill cyber-threat-hunting -g -a claude-code -y- Repository
- HoangNguyen0403/agent-skills-standard582
- Category
- Security
- Updated
- 3d ago
- License
- MIT
- Context cost
- Lightabout 416 tokens
- Runs scripts
- No, instructions only
What it does
Conducts hypothesis-driven, evidence-preserving threat hunts with bounded negative conclusions and telemetry-gap handling. Use for hunt hypotheses, scoped offline analysis, or analytic follow-up; not unscoped scanning, malware execution, or generic intelligence summaries.
Cyber Threat Hunting
Priority: P0 (CRITICAL)
Preserve provenance and bound every conclusion to authorized evidence.
Structure
Input: falsifiable hypothesis, behavior, entities, scope, sources, window, expected signal, stop condition. Process: define positive/negative observations; normalize without overwriting originals; test narrowest evidence; correlate by entity/time; record gaps and alternatives. Output: status, cited evidence, bounded conclusion, limitations, owner.
Rules
- Active collection or network operations require
cyber-authorization, documented scope, and runtime-proven controls; unsupported or missing scope blocks execution. - Use controlled synthetic/offline fixtures. Preserve query/version, fixture provenance, retention, clock, identity, and source limitations.
- Status is
confirmed,suspected,false-positive,blocked, ornot-tested; only cited evidence supports a status. - “No evidence found in the examined dataset/time window” is bounded negative evidence, never proof of no compromise.
- Include engagement/scope reference; skill/version/source; observation time; status; evidence references; limitations; accountable owner. Reuse shared skill IDs.
Anti-Patterns
- Never call an empty or incomplete dataset clean.
- Never treat one ambiguous hit as confirmed compromise.
- Never collect live telemetry before authorization or invent hunt metrics.
References (lazy, primary)
- MITRE ATT&CK data sources: https://attack.mitre.org/datasources/
- NIST SP 800-86 evidence handling: https://doi.org/10.6028/NIST.SP.800-86
- Reuse
cyber-authorization,cyber-evidence,cyber-framework-mapping.
