Threat Detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.
Before & after
Same prompt, same agent — the only difference is the skill.
Security incident investigation can go in a lot of directions depending on what data you have. You'll want to look for indicators of compromise, unusual patterns in logs, maybe check against known threat signatures. I'd recommend starting with some basic threat hunting questions to narrow down where to look. The challenge is correlating data from different sources and not missing anything obvious. What specific system or logs are you investigating?
THREAT ANALYSIS WORKFLOW HYPOTHESIS-DRIVEN HUNTING Initial theory: Lateral movement via compromised service account Key signals: Failed login patterns, privilege escalation, data access spikes IOC SWEEP RESULTS Indicators of Compromise extracted: • IP addresses: 3 suspicious external IPs connecting to internal systems • Domains: 2 C2-pattern domains in DNS queries • File hashes: 4 executables matching known malware signatures • User accounts: 1 service account with 47 failed logins in 2 hours ANOMALY DETECTION Z-score flags (deviation from baseline): • Data exfiltration: 12.3 std dev above normal (critical) • After-hours access: 8.7 std dev (high) • Service restarts: 6.1 std dev (medium) MITRE ATT&CK MAPPING T1078 - Valid Accounts (service account abuse) T1567 - Exfiltration Over Web (suspicious DNS + network flow) T1070 - Indicator Removal (log clearing detected) PRIORITY ACTIONS 1. Isolate compromised service account immediately 2. Revoke credentials for 3 flagged IPs 3. Forward suspicious domains to threat intel
About this skill
name: threat-detection description: Use when Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.
Threat Detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers hypothesis-driven threat hunting, IOC sweep generation, z-score anomaly detection, and MITRE ATT&CK-mapped signal prioritization.
What you get
- Public GitHub repo (alirezarezvani/claude-skills)
- the threat-detection skill folder with SKILL.md. Part of a 337-skill / 30-agent / 70-command install.
Customize your output
- Fork the repo and adapt the skill's instructions and references to your workflow.
Example output
Activates automatically when your request matches Threat Detection; chains with the other skills, agents, and commands in the collection.
Best for
Creators, builders, and teams using Claude Code.
SKILL.md preview
---
name: threat-detection
description: Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.
version: 1.0.0
category: Development / Engineering
author: AgentVolt
license: proprietary
tags:
- development
- engineering
---
# Threat Detection
Runs hypothesis-driven threat hunts across telemetry — IOC sweeps, anomaly checks, and a MITRE ATT&CK-mapped prioritization of what needs escalation.
## When to use
… (sign up to view the full skill)More development skills
View all Development skills →Generate
Scaffold code, tests, and boilerplate from a short spec.
Performance Profiler
Systematic performance profiling for Node.js, Python, and Go applications.
Agent Harness
Turns a domain folder of skills into a bounded agentic loop: compile a goal into a task plan, execute with the domain's tools, verify every task, retry within a budget.
Feature Flags Architect
Use when adding, retiring, or auditing feature flags.