Threat Hunting

This is a solid foundation for security analysts doing proactive threat detection. You get MITRE ATT&CK mapping tables covering the full kill chain, ready-to-use Splunk and KQL queries for hunting credential dumping and lateral movement, and Sigma rule templates for building detections. The correlation query examples are specific enough to adapt (DCSync detection, Kerberoasting, LSASS access patterns). What stands out is the hunting hypothesis framework and the behavioral baseline guidance, which helps structure investigations beyond just running queries. The Sysmon event ID reference is handy when you're staring at logs at 2am. Best for analysts who already know their SIEM but need structured hunting methodologies and a quick reference for technique-to-detection mapping.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill threat-hunting --agent claude-code

Installs into .claude/skills of the current project.

Files

Threat Hunting & Detection Engineering

When to Activate

Hypothesis-driven hunting across endpoint, network, cloud, and identity telemetry
Writing & shipping detections (Sigma + correlation) as version-controlled code in CI
Mapping & measuring coverage against MITRE ATT&CK v18 (Detection Strategies / Analytics)
Hunting Windows post-exploitation: ETW/AMSI tampering, LSASS dumping, LOLBins, injection
Hunting C2 in encrypted traffic: JA4+/JA4X fingerprints, beaconing, DNS tunneling
Hunting cloud-identity attacks: Entra device-code/OAuth phishing, PRT theft, CloudTrail abuse
Purple-team validation: emulate ATT&CK with Atomic Red Team/Caldera, find detection gaps
Triaging EVTX/Zeek/CloudTrail offline during IR without a SIEM