When to Use
- Proactively hunting for adversary activity in telemetry.
- Writing or validating detection rules mapped to ATT&CK techniques.
Use cases
- Threat hunting (hypothesis-driven)
- Sigma / YARA detection engineering
- Alert tuning, false positive analysis
- With
malware-analysis/: sample-side IOC → this skill enables detection - With
digital-forensics/: case artifacts → lateral hunting
Workflow
1. Build hypothesis
例：攻击者用 living-off-the-land 做横向
→ 数据源：Sysmon 1/3/10、Windows Security 4624/4648
→ 成功标准：发现异常父进程或罕见账户日志源
2. Query and stack
□ 基线：正常管理员行为时段与主机
□ 异常：新服务、编码 PowerShell、异常出站
□ 关联：同账号多主机短时登录
3. Rule-ify
# Sigma 骨架见 malware-analysis；本 skill 强调：
# - 误报面
# - 数据源字段映射
# - 响应 playbook 链接
4. Validate
□ 原子测试（Atomic Red Team）仅在授权实验室
□ 回放历史日志验证召回
Toolchain
| Tool | Purpose |
|---|---|
| Sigma CLI / sigmac | Rule conversion |
| YARA | File/memory |
| SIEM (ELK/Splunk etc.) | Query |
| osquery | Endpoint hunting |
| Atomic Red Team | Detection validation (lab) |
References
references/hunting-loop.md../malware-analysis/references/yara-sigma-rules.md../digital-forensics/
Routing context
Upstream: MASTER R27
Downstream: confirmed intrusion → forensics; malicious sample → malware-analysis
MUST NOT: run attack simulation in an unauthorized production environment
Task completion self-check
- Is there a clear hypothesis and conclusion?
- Do the rules note false positives and data sources?
- Checklist？
Limitations
- Hypothesis quality bounds results; weak telemetry yields weak hunts.
- Rule tuning is continuous; expect false positives initially.
Adapted from zhaoxuya520/reverse-skill (MIT).