SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
hunting-from-a-threat-intel-report
0
Operationalizes a threat intelligence report into hunts: extracting IOCs and TTPs, mapping behaviors to ATT&CK and available telemetry, prioritizing durable behavioral indicators over volatile atomic ones, and producing concrete hunt queries. Activates for requests to hunt from a threat report, operationalize CTI, or turn an intel report into detections.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Hunting from a Threat Intel Report ## When to Use - You received a CTI report (vendor writeup, ISAC bulletin, IR report) and must operationalize it. - You want to convert narrative TTPs and IOC lists into concrete hunts against your telemetry. - You need to prioritize which indicators are worth hunting given they age at different rates. **Do not use** an IOC blocklist as the whole engagement — atomic indicators (hashes, IPs) are trivially changed; durable value comes from hunting the behaviors (TTPs). ## Prerequisites - The report and a way to extract its IOCs and behavioral claims. - Knowledge of your telemetry coverage to judge which TTPs are huntable. ## Workflow ### Step 1: Extract IOCs and TTPs Pull atomic indicators (hashes, IPs, domains, URLs) and the behavioral TTPs (the report's "how"). Defang/normalize indicators for safe handling. ```bash python scripts/analyst.py extract report.txt ``` ### Step 2: Map to ATT&CK and the Pyramid of Pain Tag behaviors with techniques and rank indicators by the Pyramid of Pain — prioritize TTPs and tools over hashes/IPs because they cost the adversary more to change. ### Step 3: Check telemetry feasibility For each TTP, confirm you have the data source to hunt it; note gaps as detection-engineering work. ### Step 4: Build concrete hunts Translate the high-value TTPs into queries (Sysmon, DNS, proxy, EDR), and sweep atomic IOCs as a quick first pass for current presence. ### Step 5: Execute, document, and feed back Run the hunts, record findings/gaps/negatives, escalate hits to IR, and convert durable logic into detections (Sigma). ## Validation - Both atomic IOCs and behavioral TTPs are extracted, not just the indicator list. - Hunts target the highest-pain indicators feasible with your telemetry. - Each TTP maps to a real data source or is logged as a coverage gap. ## Pitfalls - Stopping at IOC sweeps; the adversary rotates them and you miss the campaign. - Hunting TTPs you have no telemetry for, producing false confidence. - Failing to defang indicators, risking accidental execution/clicks. ## References - See [`references/api-reference.md`](references/api-reference.md) for the IOC/TTP extractor. - MITRE ATT&CK and the Pyramid of Pain (linked in frontmatter).