Threat Hunt Hypothesis Framework
Guides the agent through building and testing threat-hunt hypotheses and writing hunt reports.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 7 files
What it does
This skill gives the agent a structured method for proactive threat hunting. Starting from threat intelligence or gaps in MITRE ATT&CK coverage, the agent drafts a testable hypothesis, lists the logs needed to check it, suggests detection queries for tools such as Splunk, Microsoft Defender, CrowdStrike, Elastic, Sysmon, Velociraptor and Sigma, and organises the results into a standard hunt report with a risk level and recommended action. It is a methodology and documentation aid rather than a detection engine on its own.
Great for
- Security analysts planning or running proactive threat hunts
- Incident responders scoping a compromise from an intel or anomaly lead
- Teams documenting hunts consistently for purple team or periodic assessments
Skip it if
- People without access to a SIEM or EDR platform, since the queries need real telemetry to be useful
- Automated blocking or production response decisions, because the bundled script only applies a basic keyword-based risk score and the skill is a framework without built-in detection patterns
Try asking
- “Build a threat hunt hypothesis for LSASS credential access based on this quarter's threat intel report”
- “Turn our ATT&CK coverage gaps for lateral movement into prioritised hunt hypotheses”
- “Draft a hunt report in the standard format for yesterday's suspicious PowerShell activity”
- “Plan the data sources and queries needed to test a persistence hypothesis via scheduled tasks”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.
building-threat-hunt-hypothesis-framework.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip building-threat-hunt-hypothesis-framework.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip building-threat-hunt-hypothesis-framework.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Give the agent specific intel or ATT&CK technique IDs so the hypothesis is grounded, and check the generated queries against your own log schema before running them.
- Treat the output as a draft: a human analyst should validate true versus false positives and decide on containment.
- Review scripts/process.py before running it, since its DETECTION_PATTERNS list is empty and it will flag nothing until you add patterns.
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.