Threat Detection

Detects hidden attacker activity through hypothesis-driven threat hunting, IOC analysis, and statistical anomaly detection on SIEM/EDR telemetry. Use when proactively searching for threats that may have evaded automated controls, before incident response is needed.

skills.sh installs: 649
GitHub stars: 29.5K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add alirezarezvani/claude-skills --skill threat-detection --agent claude-code

Installs into .claude/skills of the current project.

Files

Threat Detection

Threat detection skill for proactive discovery of attacker activity through hypothesis-driven hunting, IOC analysis, and behavioral anomaly detection. This is NOT incident response (see incident-response) or red team operations (see red-team) — this is about finding threats that have evaded automated controls.

Overview
Threat Signal Analyzer
Threat Hunting Methodology
IOC Analysis
Anomaly Detection
MITRE ATT&CK Signal Prioritization
Deception and Honeypot Integration
Workflows
Anti-Patterns
Cross-References

Overview

What This Skill Does

This skill provides the methodology and tooling for proactive threat detection — finding attacker activity through structured hunting hypotheses, IOC analysis, and statistical anomaly detection before alerts fire.