Individual skill
hunting-advanced-persistent-threats
Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when conducting scheduled threat hunting cycles, investigating anomalous behavior flagged by UEBA, or validating that known APT TTPs are not present in the environment. Activates for requests involving MITRE ATT&CK, Velociraptor, osquery, Zeek, or threat hunting playbooks.
skills/hunting-advanced-persistent-threats/SKILL.md
Source commit 54a798831d2266a3ca61ce68a7acb80b81160d57
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 35,926
- Repository last updated
- Aug 31, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai-agents Repository topic
- claude-code Repository topic
- cybersecurity Repository topic
- incident-response Repository topic
- mitre-attack Repository topic
- penetration-testing Repository topic
- red-team Repository topic
- security Repository topic
- cloud-security Repository topic
- malware-analysis Repository topic
- mitre-att&ck Declared skill tag
- threat-hunting Declared skill tag
- apt Declared skill tag
- velociraptor Declared skill tag
- osquery Declared skill tag
- zeek Declared skill tag
- ttp Declared skill tag
- nist-csf Declared skill tag
- edr Declared skill tag
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
LICENSEasset · 11,255 bytesSKILL.mdcore · 6,783 bytesSKILL.mdcore · 6,783 bytesSKILL.mdcore · 6,783 bytesreferences/api-reference.mddoc · 2,114 bytesscripts/agent.pyruns · 7,246 bytes
Read excerpt
# Hunting Advanced Persistent Threats
## When to Use
Use this skill when:
- Conducting proactive threat hunting sprints (typically 2–4 week cycles) based on newly published APT intelligence
- A UEBA alert or anomaly detection system flags behavioral deviations warranting deeper investigation
- A peer organization or ISAC sharing partner reports active APT compromise and you need to validate your own exposure
**Do not use** this skill as a substitute for incident response when a confirmed breach is in progress — escalate to IR procedures (NIST SP 800-61).
## Prerequisites
- EDR platform with telemetry retention (CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) covering 30+ days
- Access to MITRE ATT&CK Navigator for hypothesis development