Threat Hunt
Investigation Workflow
Follow this structured approach when investigating security events:
1. Establish Timeline
Call clawdstrike_timeline to get a chronological view of recent events:
- Start with a broad time range, then narrow down
- Look for clusters of activity that indicate automated or coordinated actions
- Note any gaps that might indicate log tampering
2. Query and Filter
Use clawdstrike_query to drill into specific criteria:
- Filter by verdict (allow/deny/audit) to find blocked actions
- Filter by action_type (file/shell/egress/mcp_tool) to focus investigation
- Filter by guard name to see which security controls were triggered
- Search for specific paths, commands, or domains
3. Correlate Events
Run clawdstrike_correlate to detect patterns across events:
- Use built-in correlation rules to identify attack sequences
- Look for lateral movement patterns (multiple targets from one source)
- Detect privilege escalation attempts (sequence of increasingly sensitive operations)
- Identify data exfiltration patterns (sensitive file reads followed by egress)
4. Check IOCs
Use clawdstrike_ioc to check indicators against threat intelligence:
- Submit suspicious domains, IPs, file hashes, or paths
- Cross-reference with known threat actor TTPs
- Check if IOCs appear in multiple events (indicating persistence)
5. Generate Report
Call clawdstrike_report to produce a structured investigation summary:
- Include timeline of events, findings, and recommended actions
- Reference specific events by ID for traceability
- Map findings to MITRE ATT&CK techniques where applicable
MITRE ATT&CK Quick Reference
Common techniques to look for in agent security events:
| Technique |
ID |
Indicators |
| Command and Scripting Interpreter |
T1059 |
Shell commands with encoded payloads, eval/exec usage |
| File and Directory Discovery |
T1083 |
Enumeration of sensitive directories |
| Exfiltration Over Web Service |
T1567 |
Egress to uncommon domains after file reads |
| Credential Access |
T1552 |
Access to .env, .ssh, credential files |
| Defense Evasion |
T1562 |
Attempts to modify security config or disable guards |
| Persistence |
T1546 |
Modifications to shell profiles, cron, startup files |
| Privilege Escalation |
T1548 |
sudo/chmod/chown commands, setuid changes |
MITRE Technique to MCP Tool Mapping
Use this table to select the right investigation tool for each technique:
| MITRE Technique |
ID |
Primary MCP Tool |
Investigation Approach |
| Command and Scripting Interpreter |
T1059 |
clawdstrike_query |
Filter by action_type=shell, look for encoded payloads or eval/exec |
| File and Directory Discovery |
T1083 |
clawdstrike_timeline |
Broad timeline scan for sequential file reads across sensitive dirs |
| Exfiltration Over Web Service |
T1567 |
clawdstrike_correlate |
Correlate file reads followed by egress to uncommon domains |
| Credential Access |
T1552 |
clawdstrike_query |
Filter by action_type=file targeting .env, .ssh, credential paths |
| Defense Evasion |
T1562 |
clawdstrike_query |
Filter for policy modification attempts or guard config changes |
| Persistence |
T1546 |
clawdstrike_ioc |
Check shell profile, cron, and startup file modifications |
| Privilege Escalation |
T1548 |
clawdstrike_query |
Filter by action_type=shell for sudo, chmod, chown, setuid |
Incident Classification
Classify incidents using these severity levels:
| Classification |
Criteria |
Response |
| P1 - Critical |
Active exploitation, data exfiltration confirmed, credential compromise |
Immediate remediation, revoke credentials, isolate affected sessions |
| P2 - High |
Blocked exploit attempt, repeated policy violations, suspicious lateral movement |
Investigate within current session, tighten policy, monitor for recurrence |
| P3 - Medium |
Single denied action matching known TTP, anomalous but unconfirmed activity |
Log for review, verify policy coverage, check for related events |
| P4 - Low |
Informational anomaly, policy audit events, benign tool misuse |
Document in report, no immediate action required |
Response Guidelines
When this skill is active:
- Present findings in order of severity and confidence
- Always provide specific event IDs and timestamps
- Recommend concrete remediation steps for each finding
- Distinguish between confirmed threats and suspicious activity requiring further investigation
1---2name: threat-hunt3description: Threat hunting and security event investigation4---56# Threat Hunt78<trigger>9This skill activates when the user or conversation involves:10- Investigating security events or suspicious activity11- Breach investigation or incident response12- Threat hunting across audit logs or event streams13- Indicators of Compromise (IOCs) such as suspicious IPs, domains, hashes, or file paths14- Correlating security events across multiple sources15- MITRE ATT&CK technique references16- "BLOCKED by Clawdstrike" or similar denial messages appearing in conversation output17- Repeated policy denials or unexpected security enforcement behavior18</trigger>1920## Investigation Workflow2122Follow this structured approach when investigating security events:2324### 1. Establish Timeline2526Call `clawdstrike_timeline` to get a chronological view of recent events:27- Start with a broad time range, then narrow down28- Look for clusters of activity that indicate automated or coordinated actions29- Note any gaps that might indicate log tampering3031### 2. Query and Filter3233Use `clawdstrike_query` to drill into specific criteria:34- Filter by verdict (allow/deny/audit) to find blocked actions35- Filter by action_type (file/shell/egress/mcp_tool) to focus investigation36- Filter by guard name to see which security controls were triggered37- Search for specific paths, commands, or domains3839### 3. Correlate Events4041Run `clawdstrike_correlate` to detect patterns across events:42- Use built-in correlation rules to identify attack sequences43- Look for lateral movement patterns (multiple targets from one source)44- Detect privilege escalation attempts (sequence of increasingly sensitive operations)45- Identify data exfiltration patterns (sensitive file reads followed by egress)4647### 4. Check IOCs4849Use `clawdstrike_ioc` to check indicators against threat intelligence:50- Submit suspicious domains, IPs, file hashes, or paths51- Cross-reference with known threat actor TTPs52- Check if IOCs appear in multiple events (indicating persistence)5354### 5. Generate Report5556Call `clawdstrike_report` to produce a structured investigation summary:57- Include timeline of events, findings, and recommended actions58- Reference specific events by ID for traceability59- Map findings to MITRE ATT&CK techniques where applicable6061## MITRE ATT&CK Quick Reference6263Common techniques to look for in agent security events:6465| Technique | ID | Indicators |66|-----------|------|------------|67| Command and Scripting Interpreter | T1059 | Shell commands with encoded payloads, eval/exec usage |68| File and Directory Discovery | T1083 | Enumeration of sensitive directories |69| Exfiltration Over Web Service | T1567 | Egress to uncommon domains after file reads |70| Credential Access | T1552 | Access to .env, .ssh, credential files |71| Defense Evasion | T1562 | Attempts to modify security config or disable guards |72| Persistence | T1546 | Modifications to shell profiles, cron, startup files |73| Privilege Escalation | T1548 | sudo/chmod/chown commands, setuid changes |7475## MITRE Technique to MCP Tool Mapping7677Use this table to select the right investigation tool for each technique:7879| MITRE Technique | ID | Primary MCP Tool | Investigation Approach |80|-----------------|----|------------------|----------------------|81| Command and Scripting Interpreter | T1059 | `clawdstrike_query` | Filter by `action_type=shell`, look for encoded payloads or eval/exec |82| File and Directory Discovery | T1083 | `clawdstrike_timeline` | Broad timeline scan for sequential file reads across sensitive dirs |83| Exfiltration Over Web Service | T1567 | `clawdstrike_correlate` | Correlate file reads followed by egress to uncommon domains |84| Credential Access | T1552 | `clawdstrike_query` | Filter by `action_type=file` targeting .env, .ssh, credential paths |85| Defense Evasion | T1562 | `clawdstrike_query` | Filter for policy modification attempts or guard config changes |86| Persistence | T1546 | `clawdstrike_ioc` | Check shell profile, cron, and startup file modifications |87| Privilege Escalation | T1548 | `clawdstrike_query` | Filter by `action_type=shell` for sudo, chmod, chown, setuid |8889## Incident Classification9091Classify incidents using these severity levels:9293| Classification | Criteria | Response |94|---------------|----------|----------|95| **P1 - Critical** | Active exploitation, data exfiltration confirmed, credential compromise | Immediate remediation, revoke credentials, isolate affected sessions |96| **P2 - High** | Blocked exploit attempt, repeated policy violations, suspicious lateral movement | Investigate within current session, tighten policy, monitor for recurrence |97| **P3 - Medium** | Single denied action matching known TTP, anomalous but unconfirmed activity | Log for review, verify policy coverage, check for related events |98| **P4 - Low** | Informational anomaly, policy audit events, benign tool misuse | Document in report, no immediate action required |99100## Response Guidelines101102When this skill is active:103- Present findings in order of severity and confidence104- Always provide specific event IDs and timestamps105- Recommend concrete remediation steps for each finding106- Distinguish between confirmed threats and suspicious activity requiring further investigation
gabrielmoreira