How to use the Threat Hunting & Detection Engineering agent skill

What is an agent skill and what does this one make the agent do?

An agent skill is a folder containing a SKILL.md file with instructions that an AI agent reads when a task matches the skill's description. This skill's description says it is for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.

When the skill is active, the agent follows a fixed order: it confirms authorization and the data sources in scope, forms a hypothesis about likely attacker behaviour, designs baseline and anomaly queries against logs such as Sysmon or Windows Security events, then turns findings into detection rules and validates them. The skill also reminds the agent to note false-positive exposure and data-source field mappings in every rule.

• Confirm blue-team or hunting authorization and the SIEM or EDR data scope first
• State a hypothesis before running queries, to avoid blindly chasing alerts
• Build baseline queries (normal admin hours and hosts) and anomaly queries (new services, encoded PowerShell, unusual outbound traffic)
• Turn findings into rules and validate them, including replaying historical logs to check recall
• Each hunt round records whether the hypothesis is confirmed, rejected or inconclusive, with an Evidence ID

How do you install the threat-hunting skill?

Download the ZIP for this skill from our page and unzip it. For a personal install, place the unzipped skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder instead.

If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload

How do you trigger the skill with a natural request?

You do not need a special command. The agent decides to use the skill when your request matches its description, so describe the blue-team task in plain language and name the data you have. Mentioning the relevant tools (Sigma, YARA, Splunk, osquery) and the authorized scope helps the agent pick the right workflow.

Good requests state the goal, the data source and the authorization context. Vague requests such as 'find hackers' are less likely to produce a structured hunt.

• 'We are authorized to hunt in our lab Splunk. Hypothesis: lateral movement via living-off-the-land. Check Sysmon 1, 3 and 10 and Windows Security 4624 and 4648.'
• 'Write a Sigma rule for encoded PowerShell from Sysmon logs and list its false-positive exposure and field mappings.'
• 'Review our YARA rules for a dropped file family and tell me how to validate them against historical logs.'
• 'Our SIEM alerts for suspicious service creation fire rarely. Design a hunt to check whether they catch the behaviour in our authorized lab.'

What do you need before you start?

The skill assumes you already have legitimate access to the logs or endpoints you want to query. Its tool chain is optional depending on the task: you do not need every tool for every hunt.

• Access to a SIEM such as ELK or Splunk, or an EDR export containing relevant logs
• Sigma CLI or sigmac for converting Sigma rules
• YARA for file and memory rules
• osquery for endpoint hunting
• Atomic Red Team for validation in a lab (optional, depending on the task)

What safety limits does the skill enforce?

The skill tells the agent never to run attack simulations in a production environment without authorization, because they can cause outages or real harm. Atomic Red Team tests are described as being for authorized labs only. The skill's own notes say it does not perform complete incident response or malware reverse engineering; it hands those to other skills.

This skill runs no scripts and makes no network calls, according to its listing. It works through the agent's reasoning and the data you give it, so you remain responsible for running any queries or tests in your own systems.

• Do not use it to attack live production systems
• Only validate detections with Atomic Red Team in an authorized lab
• Confirmed intrusions are routed to a forensics skill; malicious samples are routed to a malware-analysis skill
• The skill runs no scripts and uses no network, per its listing

What tips make the output more useful?

Give the agent real field names from your environment, because the skill asks it to record data-source field mappings. Ask for false-positive notes with every rule, and ask for a replay of historical logs to measure whether the rule would have caught past activity.

The skill's reference material describes a loop: Hypothesis, Data, Query, Investigate, Detect or Dismiss, Tune, Document. Asking the agent to follow that loop keeps a hunt organised.

• Name your SIEM and log sources explicitly
• Ask for false-positive exposure in every rule
• Request a historical log replay to check recall
• Ask the agent to end with a verdict per hypothesis: confirmed, rejected or inconclusive