Threat Hunting & Detection Engineering
Guides hypothesis-driven threat hunts, Sigma/YARA detection rules, and SIEM query design for blue teams.
- Repository
- zhaoxuya520/reverse-skill
- Stars
- 43,969
- Licence
- MIT
- Files
- 2 files
What it does
When installed, the agent follows a structured blue-team workflow: it confirms authorization and data sources, forms a hypothesis about likely attacker behaviour, designs baseline and anomaly queries against logs such as Sysmon or Windows Security events, then turns findings into detection rules and validates them. It also reminds the agent to note false-positive exposure and data-source field mappings, and to avoid running attack simulations in production without authorization. The skill is written in Chinese with English technical terms, and it refers to other skills for malware analysis and forensics.
Great for
- Security analysts running proactive threat hunts on SIEM or EDR data
- Detection engineers writing and tuning Sigma or YARA rules
- Teams validating whether existing alerts actually catch simulated attacks in a lab
Skip it if
- Attack simulation against live production systems, which the skill itself forbids without authorization because it can cause outages or real harm
- Users without authorized access to the logs or endpoints they want to query, since the skill assumes legitimate blue-team scope
- Complete incident response or malware reverse engineering, which the skill hands off to other skills rather than performing
Try asking
- “Build a threat hunt for lateral movement using living-off-the-land techniques across our Windows logs”
- “Turn this hypothesis about encoded PowerShell into a Sigma rule and note its false-positive sources”
- “Design Splunk queries to find one account logging into many hosts within a short window”
- “Plan an Atomic Red Team test in our lab to confirm our detection catches credential dumping”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the MIT licence and an attribution note.
threat-hunting.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip threat-hunting.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip threat-hunting.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- State your hypothesis, data sources, and authorization scope up front so the agent can design targeted queries rather than generic alert-chasing.
- Ask for false-positive analysis and field mapping with every rule, as the skill's checklist expects.
- Run validation tests only in an isolated lab environment, and review any generated queries before running them against production data.
What's inside
- references/hunting-loop.md
- SKILL.md
Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.