Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Before & after
Same prompt, same agent — the only difference is the skill.
Security incident investigation can go in a lot of directions depending on what data you have. You'll want to look for indicators of compromise, unusual patterns in logs, maybe check against known threat signatures. I'd recommend starting with some basic threat hunting questions to narrow down where to look. The challenge is correlating data from different sources and not missing anything obvious. What specific system or logs are you investigating?
THREAT ANALYSIS WORKFLOW HYPOTHESIS-DRIVEN HUNTING Initial theory: Lateral movement via compromised service account Key signals: Failed login patterns, privilege escalation, data access spikes IOC SWEEP RESULTS Indicators of Compromise extracted: • IP addresses: 3 suspicious external IPs connecting to internal systems • Domains: 2 C2-pattern domains in DNS queries • File hashes: 4 executables matching known malware signatures • User accounts: 1 service account with 47 failed logins in 2 hours ANOMALY DETECTION Z-score flags (deviation from baseline): • Data exfiltration: 12.3 std dev above normal (critical) • After-hours access: 8.7 std dev (high) • Service restarts: 6.1 std dev (medium) MITRE ATT&CK MAPPING T1078 - Valid Accounts (service account abuse) T1567 - Exfiltration Over Web (suspicious DNS + network flow) T1070 - Indicator Removal (log clearing detected) PRIORITY ACTIONS 1. Isolate compromised service account immediately 2. Revoke credentials for 3 flagged IPs 3. Forward suspicious domains to threat intel
About this skill
Your IOC search returned nothing, but does that mean you're clear? Your anomaly detector flagged hundreds of hosts, but which deserve investigation? This skill turns those questions into scoped hunts with explicit coverage, reproducible queries, and findings tied to actual evidence.
What it does
- Translates threat reports into falsifiable hypotheses and the telemetry needed to investigate them.
- Builds IOC sweeps that respect indicator type, validity dates, shared infrastructure, and exact-match boundaries.
- Chooses peer groups and statistical baselines that account for seasonality, sparse data, and skewed distributions.
- Correlates endpoint, DNS, network, identity, and cloud events without treating alert counts as proof.
- Prioritizes findings by evidence strength, potential impact, and urgency, with defensible MITRE ATT&CK mappings.
- Explains what a negative search actually rules out and which visibility gaps remain.
What you get
A hunt brief or investigation report containing the hypothesis, coverage limits, queries or query specifications, evidence, disposition, and next investigative steps. Queries use your platform and schema when supplied; otherwise, field mappings and assumptions are explicit.
Best for
SOC analysts, detection engineers, incident responders, and security engineers investigating threat intelligence, suspicious behavior, or noisy alerts.
SKILL.md preview
---
name: threat-hunting-and-ioc-triage
description: Turns threat intelligence and security telemetry into falsifiable hunts, type-aware IOC sweeps, distribution-aware anomaly checks, and evidence-backed findings mapped to MITRE ATT&CK. Use when the user says "hunt for this technique", "check these IOCs", "are we affected by this report?", "my alerts keep flagging normal activity", "investigate this DNS spike", "prioritize these suspicious events", or "the IOC search found nothing, are we clear?".
---
# Threat Hunting and IOC Triage
… (sign up to view the full skill)More development skills
View all Development skills →Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.
LLM App and Agent Security Assessment
Threat-model an LLM app or agent: map injection paths, rate tool blast radius, and get architectural fixes plus canary tests.