Agent skill

Threat Hunting

by sickn33 in sickn33/agentic-awesome-skills

Blue-team threat hunting: detection engineering with Sigma/YARA, SIEM query design, and validation of incident detections against known technique patterns.

MITAuto-check passedSecurity

Install Threat Hunting

skills CLI

$ npx skills add sickn33/agentic-awesome-skills --skill threat-hunting -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install sickn33/agentic-awesome-skills threat-hunting --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/threat-hunting .claude/skills/threat-hunting && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "threat-hunting" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/threat-hunting into .claude/skills/threat-hunting/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-hunting", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/threat-hunting

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add sickn33/agentic-awesome-skills --skill threat-hunting -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install sickn33/agentic-awesome-skills threat-hunting --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/threat-hunting .agents/skills/threat-hunting && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "threat-hunting" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/threat-hunting into .agents/skills/threat-hunting/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-hunting", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add sickn33/agentic-awesome-skills --skill threat-hunting -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install sickn33/agentic-awesome-skills threat-hunting --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/threat-hunting .cursor/skills/threat-hunting && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "threat-hunting" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/threat-hunting into .cursor/skills/threat-hunting/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-hunting", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/sickn33/agentic-awesome-skills.git --path skills/threat-hunting

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add sickn33/agentic-awesome-skills --skill threat-hunting -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install sickn33/agentic-awesome-skills threat-hunting --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/threat-hunting .gemini/skills/threat-hunting && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "threat-hunting" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/threat-hunting into .gemini/skills/threat-hunting/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-hunting", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install sickn33/agentic-awesome-skills threat-hunting

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add sickn33/agentic-awesome-skills --skill threat-hunting -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/threat-hunting .github/skills/threat-hunting && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "threat-hunting" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/threat-hunting into .github/skills/threat-hunting/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-hunting", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add sickn33/agentic-awesome-skills --skill threat-hunting -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install sickn33/agentic-awesome-skills threat-hunting --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/threat-hunting .opencode/skills/threat-hunting && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "threat-hunting" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/threat-hunting into .opencode/skills/threat-hunting/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "threat-hunting", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: threat-hunting
GitHub stars: 47k
Used in: 1 other repo
Token cost: ~474 tokens
SKILL.md length: 106 words
Files: 2 (incl. references)
Skills in repo: 1,497
Repo updated: Oct 9, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Blue-team threat hunting: detection engineering with Sigma/YARA, SIEM query design, and validation of incident detections against known technique patterns.

Works in 4 steps: 建假说 → 查询与堆叠 → 规则化 → …
Tasks that involve Security operations
SKILL.md covers When to Use, 适用场景, 工作流 and 工具链, plus 4 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Threat Hunting is an agent skill from sickn33/agentic-awesome-skills. Blue-team threat hunting: detection engineering with Sigma/YARA, SIEM query design, and validation of incident detections against known technique patterns.

Its SKILL.md is about 470 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/hunting-loop.md`).

It sits in Security, covering Security operations. The repository describes itself as: AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,400+ agentic skills. Includes… The licence is MIT.

When your agent uses it

Tasks that involve Security operations

Example prompts

“/threat-hunting”

Workflow steps

4 steps, taken from the step headings in SKILL.md.

建假说
查询与堆叠
规则化
验证

What it can do on your machine

Read from SKILL.md and the folder at commit b84d35a. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are yaml).
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
- github.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Threat Hunting loads about 474 tokens when it runs, and up to ~520 if it reads all its reference files. Until then it costs about 43 tokens; SKILL.md has 106 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~43
When it runs · the whole SKILL.md, loaded when a task matches: ~474
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~520

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from sickn33/agentic-awesome-skills at commit b84d35a, republished under its MIT licence (© sickn33). 106 words, ~474 tokens.

Download SKILL.mdSave it as .claude/skills/threat-hunting/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.

name: threat-hunting
description: Blue-team threat hunting: detection engineering with Sigma/YARA, SIEM query design, and validation of incident detections against known technique patterns.
risk: safe
source: https://github.com/zhaoxuya520/reverse-skill
source_repo: zhaoxuya520/reverse-skill
source_type: community
date_added: 2026-08-25
license: MIT
license_source: https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE

Threat Hunting & Detection Engineering

When to Use

Proactively hunting for adversary activity in telemetry.
Writing or validating detection rules mapped to ATT&CK techniques.

适用场景

威胁狩猎（hypothesis-driven）
Sigma / YARA 检测工程
告警调优、误报分析
与 malware-analysis/：样本侧 IOC → 本 skill 落地检测
与 digital-forensics/：案件伪影 → 横向狩猎

工作流

1. 建假说

text

例：攻击者用 living-off-the-land 做横向
→ 数据源：Sysmon 1/3/10、Windows Security 4624/4648
→ 成功标准：发现异常父进程或罕见账户日志源

2. 查询与堆叠

text

□ 基线：正常管理员行为时段与主机
□ 异常：新服务、编码 PowerShell、异常出站
□ 关联：同账号多主机短时登录

3. 规则化

yaml

# Sigma 骨架见 malware-analysis；本 skill 强调：
# - 误报面
# - 数据源字段映射
# - 响应 playbook 链接

4. 验证

text

□ 原子测试（Atomic Red Team）仅在授权实验室
□ 回放历史日志验证召回

工具链

工具	用途
Sigma CLI / sigmac	规则转换
YARA	文件/内存
SIEM（ELK/Splunk 等）	查询
osquery	端点狩猎
Atomic Red Team	检测验证（实验室）

参考

references/hunting-loop.md
../malware-analysis/references/yara-sigma-rules.md
../digital-forensics/

路由上下文

上游: MASTER R27
下游: 确认入侵 → forensics；恶意样本 → malware-analysis
MUST NOT: 在无授权生产环境跑攻击模拟

任务完成自检

是否有明确假说与结论？
规则是否注明误报与数据源？
Checklist？

Limitations

Hypothesis quality bounds results; weak telemetry yields weak hunts.
Rule tuning is continuous; expect false positives initially.

Adapted from zhaoxuya520/reverse-skill (MIT).

Files

SKILL.md and 1 other file (references) in skills/threat-hunting of sickn33/agentic-awesome-skills.

SKILL.md
references/hunting-loop.md

Open the folder on GitHubat commit b84d35a

Used in 1 other repository

We found 5 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in sickn33/agentic-awesome-skills, which our catalogue first saw on October 7, 2026.

lingxling/awesome-skills-cnantigravity-awesome-skills/skills/threat-hunting antigravity-awesome-skills/plugins/agentic-awesome-skills/skills/threat-hunting+1 more

Compare with similar skills

Threat Hunting next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Threat Hunting compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Threat Hunting this skillsickn33/agentic-awesome-skills	47k	1 repos	~474	Automated safety check: Pass	MIT	2 days ago
Security Alert Triageelastic/agent-skills	592	1 repos	~3.5k	Automated safety check: Notes	Apache-2.0	3 days ago
Kubernetes Network Security Auditkubeshark/kubeshark	12k	—	~7.3k	Automated safety check: Notes	Apache-2.0	yesterday
Security Detection Rule Managementelastic/agent-skills	592	1 repos	~3.9k	Automated safety check: Notes	Apache-2.0	3 days ago
Chaitin CLIchaitin/chaitin-cli	115	—	~15k	Automated safety check: Notes	GPL-3.0	12 days ago
GatesNebulock-Inc/agentic-threat-hunting-framework	388	—	~12k	Automated safety check: Pass	MIT	2 days ago

Similar skills

Security Alert Triage
elastic/agent-skills
Official
Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.
592 GitHub starsUsed in 1 repo~3.5k tokens
SecurityAuto-check: notes
Kubernetes Network Security Audit
kubeshark/kubeshark
Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.
12k GitHub stars~7.3k tokensUpdated yesterday
SecurityAuto-check: notes
Security Detection Rule Management
elastic/agent-skills
Official
Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint).
592 GitHub starsUsed in 1 repo~3.9k tokens
SecurityAuto-check: notes
Chaitin CLI
chaitin/chaitin-cli
A skill your agent uses when running chaitin-cli commands to manage Chaitin security products: SafeLine WAF (site management, IP blocking, ACL, policy rules, attack logs), X-Ray vulnerability…
115 GitHub stars~15k tokensUpdated 12 days ago
SecurityAuto-check: notes
Gates
Nebulock-Inc/agentic-threat-hunting-framework
GATES method validation for hunt-derived detections. An agent skill from Nebulock-Inc/agentic-threat-hunting-framework.
388 GitHub stars~12k tokensUpdated 2 days ago
SecurityAuto-check passed
Elasticsearch Audit
aspectrr/deer
Enable, configure, and query Elasticsearch security audit logs.
405 GitHub stars~1.7k tokensUpdated 5 mo ago
SecurityAuto-check passed

Questions about Threat Hunting

What does Threat Hunting do?

Blue-team threat hunting: detection engineering with Sigma/YARA, SIEM query design, and validation of incident detections against known technique patterns. Threat Hunting is an agent skill from sickn33/agentic-awesome-skills. Blue-team threat hunting: detection engineering with Sigma/YARA, SIEM query design, and validation of incident detections against known technique patterns.

When should I use Threat Hunting?

Threat Hunting fits situations like: tasks that involve Security operations.

How do I install Threat Hunting in Claude Code?

Run `npx skills add sickn33/agentic-awesome-skills --skill threat-hunting -a claude-code`. Or copy the skill folder (skills/threat-hunting in sickn33/agentic-awesome-skills) into .claude/skills/threat-hunting in your project. Claude Code loads it when a task matches its description.

How do I install Threat Hunting in Codex?

Run `npx skills add sickn33/agentic-awesome-skills --skill threat-hunting -a codex`. Or copy the skill folder (skills/threat-hunting in sickn33/agentic-awesome-skills) into .agents/skills/threat-hunting in your project. Codex loads it when a task matches its description.

Can I use Threat Hunting in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add sickn33/agentic-awesome-skills --skill threat-hunting -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/threat-hunting, .gemini/skills/threat-hunting, .github/skills/threat-hunting and .opencode/skills/threat-hunting in your project.

What does Threat Hunting need to run?

SKILL.md names no scripts, command-line tools or credentials: Threat Hunting is instructions for the agent only.

Does Threat Hunting access the network?

SKILL.md names 1 domain. As links in the text: github.com. This is read from the text; nothing was executed.

Is Threat Hunting safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Threat Hunting use?

Threat Hunting is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Threat Hunting use?

About 474 tokens (SKILL.md is roughly 1.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 46 tokens, read only when the agent opens those files.

What are the alternatives to Threat Hunting?

Skills that share tags, products or a category with Threat Hunting: Security Alert Triage (elastic/agent-skills, 592 stars), Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars), Security Detection Rule Management (elastic/agent-skills, 592 stars) and Chaitin CLI (chaitin/chaitin-cli, 115 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Threat Hunting?

sickn33 (a GitHub user) maintains it in sickn33/agentic-awesome-skills, which has 47,405 GitHub stars. The repository holds 1,497 skills in this directory. The repository was last updated on October 9, 2026.

Source: sickn33/agentic-awesome-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Threat Hunting

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Threat Hunting & Detection Engineering

When to Use

适用场景

工作流

1. 建假说

2. 查询与堆叠

3. 规则化

4. 验证

工具链

参考

路由上下文

任务完成自检

Limitations

Files

Used in 1 other repository

Compare with similar skills

Similar skills

More from sickn33/agentic-awesome-skills

Related

Questions about Threat Hunting