Guide · Agent skill
How to use the Threat Hunt Hypothesis Framework agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the building-threat-hunt-hypothesis-framework agent skill, a methodology aid that helps an AI agent plan a proactive threat hunt from a threat intelligence report or a gap in MITRE ATT&CK coverage. It is written for security analysts and incident responders who may not have used agent skills before. By the end you will know how to install the skill, ask for a hunt in plain language, and what the agent produces.
Threat Hunt Hypothesis Frameworkmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Get the building-threat-hunt-hypothesis-framework ZIP from this page.
- 2Install the skill. Unzip it into ~/.claude/skills/ for all projects or into a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Confirm your data sources. Check that your EDR or SIEM is receiving Sysmon and Windows Security logs for the techniques you plan to hunt.
- 4Describe the hunt. Ask the agent for a proactive hunt from a specific intel report, ATT&CK gap or anomaly, naming your platform.
- 5Run the suggested queries. Execute the queries in your own SIEM or EDR and record the result counts in the hunt template.
- 6Validate and document. Separate true positives from false positives, then complete the Hunt ID, risk level, confidence and recommended action.
What the skill makes the agent do
The skill gives the agent a fixed workflow for threat hunting. It starts from threat intelligence or an ATT&CK coverage gap, drafts a testable hypothesis, lists the data sources needed to check it, suggests detection queries, and organises the results into a standard hunt report with a risk level and recommended action.
The skill is a methodology and documentation aid. It does not detect threats on its own; the queries only produce useful results when run against real telemetry in your EDR or SIEM.
- Formulate a testable hypothesis from intel or an ATT&CK gap
- Identify the logs needed to validate or refute it
- Suggest queries for CrowdStrike Falcon, Microsoft Defender for Endpoint, Splunk, Elastic, Sysmon, Velociraptor and Sigma
- Record findings in a hunt template with Hunt ID, evidence, risk level, confidence and recommended action
Install the skill
Download the ZIP from this page. To make it available in Claude Code for all your projects, unzip it into ~/.claude/skills/. To limit it to one project, unzip it into that project's .claude/skills/ folder.
In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
~/.claude/skills/building-threat-hunt-hypothesis-framework/Trigger the skill with a natural request
You do not need a special command. Describe the hunt you want in plain language and mention the situation: proactive hunt, intel-driven lead, or scoping a compromise. The skill is meant for those cases, so phrasing that includes them helps the agent pick it up.
Include the data you have access to, such as Splunk, Defender or Sysmon logs, so the suggested queries match your environment.
- Plan a proactive threat hunt for the techniques in this campaign report, we use Splunk and Sysmon
- We have no detections for lateral movement. Build a hunt hypothesis and the queries to test it
- Scope possible compromise from this unusual PowerShell activity on two hosts
What you get back
The agent's output follows the skill's hunt structure. The template includes a hypothesis statement with its basis (threat intel, ATT&CK gap, anomaly or incident follow-up), target techniques from the tactics TA0001, TA0003, TA0008 and TA0010, selected data sources, the queries executed with result counts, and the findings.
The standard report format records a Hunt ID, technique, host, user context, evidence, risk level, confidence and recommended action. Treat the risk score as a starting point for your analysts, not a verdict.
Hunt ID: TH-BUILDI-[DATE]-[SEQ]
Technique: TA0001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]What it needs
The skill assumes a working security stack. The queries need real telemetry, so the skill is of limited use without it.
- Python 3 to run the bundled scripts
- Optional requests library, used by scripts/agent.py
- EDR or SIEM access such as CrowdStrike Falcon, Microsoft Defender for Endpoint, Splunk or Elastic, to run the queries
- Sysmon and Windows Security event log forwarding for the data sources it references
Safety notes on scripts and network use
The skill runs scripts: scripts/agent.py and scripts/process.py are bundled. Review them before running. The skill does not use the network according to its metadata, though scripts/agent.py lists requests as an optional dependency.
The bundled script applies only a basic keyword-based risk score, and the skill has no built-in detection patterns. Do not use its output for automated blocking or production response decisions. Validate every finding with an analyst before acting.
- Read the scripts before running them in your environment
- Keep the hunt in your normal review process; do not automate containment from the risk score
Tips for better hunts
Write hypotheses that can fail. A hypothesis that the logs could disprove is more useful than a vague concern. Check your data sources first, because a hypothesis that needs Sysmon event 1 is pointless if process creation is not logged.
Use the template for every hunt so results can be compared across purple team exercises and periodic assessments.
- Confirm Sysmon and Windows Security logs are forwarded before you start
- Record negative results too; a hunt that finds nothing still documents coverage
- Update detection rules when a hunt finds something reusable
What people use it for
- Scoping a compromise from an unusual PowerShell or process activity lead
- Planning a proactive hunt from a threat intelligence campaign report
- Closing an ATT&CK coverage gap with a documented hypothesis
- Standardising hunt reports across purple team or periodic assessments
Frequently asked questions
How do I install the building-threat-hunt-hypothesis-framework skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder for one project. In the Claude apps, you can upload it under Settings → Capabilities → Skills.
What do I need to use this skill?
You need Python 3 to run the bundled scripts and access to an EDR or SIEM such as CrowdStrike Falcon, Microsoft Defender for Endpoint, Splunk or Elastic. Sysmon and Windows Security event log forwarding are referenced as data sources. The optional requests library is used by scripts/agent.py.
Is the skill free to use?
The skill is licensed under Apache-2.0, as listed on this page. Check the license file in the download for the full terms.
Does the skill detect threats automatically?
No. It is a framework and documentation aid. The bundled script applies only a basic keyword-based risk score, and the queries need real telemetry from your own platforms to produce useful results.
Can I use it without a SIEM or EDR?
The skill is not designed for that. Its suggested queries need access to real logs from a platform such as Splunk, Elastic, Microsoft Defender or CrowdStrike Falcon to be useful.
How does it compare with writing hunts manually?
The skill gives a consistent structure: hypothesis, data sources, queries, findings and a standard report. It does not replace analyst judgement or your own detection content, and it does not include built-in detection patterns.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security analysts and incident responders who already have EDR or SIEM access and want a consistent way to plan, run and document proactive hunts. It is a poor choice if you have no telemetry to query, or if you want automated blocking or production response driven by its output.
Download the skill