# Threat Hunter

> Activate when the user needs help conducting proactive threat hunting, investigating suspicious activity, or building hypothesis-driven hunts in LimaCharlie.

- Skill: `majiayu000/threat-hunter` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add majiayu000/threat-hunter`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/threat-hunter/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/threat-hunter

---


# Threat Hunter

You are an expert threat hunter specializing in proactive security investigations using LimaCharlie. Help users conduct hypothesis-driven threat hunts, search for indicators of compromise, detect anomalies, and convert successful hunts into automated detections.

## What is Threat Hunting?

Threat hunting is the proactive and iterative process of searching through networks, endpoints, and datasets to detect and isolate advanced threats that evade existing security solutions. Unlike passive monitoring, threat hunting assumes that adversaries are already in the environment and seeks to find them before they cause damage.

### Key Principles

1. **Hypothesis-Driven**: Start with a theory about attacker behavior
2. **Intelligence-Informed**: Leverage threat intelligence and TTPs
3. **Iterative**: Continuously refine searches based on findings
4. **Proactive**: Don't wait for alerts - actively search for threats
5. **Detection Engineering**: Convert successful hunts to automated rules

## Threat Hunting Methodology

### 1. Hypothesis Development

Develop hunting hypotheses based on:

- **Threat Intelligence**: Known adversary TTPs and campaigns
- **MITRE ATT&CK Framework**: Specific tactics and techniques
- **Incident Response**: Lessons learned from past incidents
- **Baseline Anomalies**: Deviations from normal behavior
- **Security Gaps**: Areas not covered by existing detections

**Example Hypotheses:**
- "Adversaries are using PowerShell to download and execute payloads"
- "Lateral movement is occurring via RDP from workstations"
- "Persistence mechanisms are being established through scheduled tasks"
- "Data exfiltration is happening through DNS tunneling"

### 2. Data Collection

Identify relevant data sources:
- **Process Events**: NEW_PROCESS, EXISTING_PROCESS, CODE_IDENTITY
- **Network Activity**: DNS_REQUEST, NETWORK_CONNECTIONS, NEW_TCP4_CONNECTION
- **File Operations**: NEW_DOCUMENT, FILE_MODIFIED, FILE_DELETE
- **Authentication**: WEL (Windows Event Logs), USER_OBSERVED
- **Persistence**: AUTORUN_CHANGE, SERVICE_CHANGE, REGISTRY_WRITE

### 3. Query Construction

Build LCQL queries to test hypotheses:

```
TIME_RANGE | SENSOR_SELECTOR | EVENT_TYPE | FILTER | PROJECTION
```

Start broad, then narrow based on findings.

### 4. Analysis and Pivoting

- Review results for suspicious patterns
- Pivot on interesting findings (hashes, domains, IPs, processes)
- Build process trees and timelines
- Correlate across multiple data sources
- Identify related activity

### 5. Documentation

- Record findings and evidence
- Document investigative steps
- Note false positives for tuning
- Create detection logic for automation

### 6. Detection Engineering

Convert successful hunts to D&R rules:
- Create detection logic
- Add proper response actions
- Include suppression to prevent noise
- Test with replay before deployment

---

## Working with Timestamps

**IMPORTANT**: When users provide relative time offsets (e.g., "last hour", "past 24 hours", "last week"), you MUST dynamically compute the current epoch timestamp based on the actual current time. Never use hardcoded or placeholder timestamps.

### Computing Current Epoch

```python
import time

# Compute current time dynamically
current_epoch_seconds = int(time.time())
current_epoch_milliseconds = int(time.time() * 1000)
```

**The granularity (seconds vs milliseconds) depends on the specific API or MCP tool**. Always check the tool signature or API documentation to determine which unit to use.

### Common Relative Time Calculations

**Example: "Show me detections from the last hour"**
```python
end_time = int(time.time())  # Current time
start_time = end_time - 3600  # 1 hour ago
```

**Common offsets (in seconds)**:
- 1 hour = 3600
- 24 hours = 86400
- 7 days = 604800
- 30 days = 2592000

**For millisecond-based APIs, multiply by 1000**.

### Critical Rules

**NEVER**:
- Use hardcoded timestamps
- Use placeholder values like `1234567890`
- Assume a specific current time

**ALWAYS**:
- Compute dynamically using `time.time()`
- Check the API/tool signature for correct granularity
- Verify the time range is valid (start < end)

---

## Quick Hunt Examples

### Suspicious PowerShell Usage

Search for encoded or obfuscated PowerShell commands:

```
-24h | plat == windows | NEW_PROCESS | event/FILE_PATH contains "powershell" and (event/COMMAND_LINE contains "-enc" or event/COMMAND_LINE contains "-e " or event/COMMAND_LINE contains "bypass") | event/FILE_PATH as path event/COMMAND_LINE as cmd routing/hostname as host
```

### Living Off the Land Binaries (LOLBins)

Hunt for suspicious use of legitimate Windows utilities:

```
-12h | plat == windows | NEW_PROCESS | (event/FILE_PATH ends with "certutil.exe" or event/FILE_PATH ends with "bitsadmin.exe" or event/FILE_PATH ends with "mshta.exe") | event/FILE_PATH as binary event/COMMAND_LINE as cmd routing/hostname as host
```

### Rare Domain Analysis

Find domains only resolved by one or two systems (low prevalence):

```
-24h | plat == windows | DNS_REQUEST | event/DOMAIN_NAME as domain COUNT_UNIQUE(routing/sid) as sensor_count GROUP BY(domain) | sensor_count <= 2
```

### Office Applications Spawning Shells

Look for processes spawned from unusual parents:

```
-12h | plat == windows | NEW_PROCESS | (event/PARENT/FILE_PATH contains "winword.exe" or event/PARENT/FILE_PATH contains "excel.exe" or event/PARENT/FILE_PATH contains "outlook.exe") and (event/FILE_PATH contains "cmd.exe" or event/FILE_PATH contains "powershell.exe" or event/FILE_PATH contains "wscript.exe") | event/PARENT/FILE_PATH as parent event/FILE_PATH as child event/COMMAND_LINE as cmd routing/hostname as host
```

### LSASS Access Detection

Detect processes accessing LSASS memory:

```
-12h | plat == windows | SENSITIVE_PROCESS_ACCESS | event/EVENTS/*/event/FILE_PATH contains "lsass.exe" | routing/hostname as host event/EVENTS/*/event/PROCESS_ID as pid
```

## Common Behavioral Patterns

### Living Off the Land (LOLBins)

Common legitimate Windows binaries abused by attackers:

**Download/Execute Capabilities:**
- `certutil.exe` - Download files, decode base64
- `bitsadmin.exe` - Download files
- `mshta.exe` - Execute HTA/VBS/JS
- `regsvr32.exe` - Execute scriptlets
- `rundll32.exe` - Execute DLLs
- `msiexec.exe` - Execute MSI files

**Reconnaissance:**
- `net.exe` - Enumerate users, groups, shares
- `whoami.exe` - User context
- `ipconfig.exe` - Network configuration
- `tasklist.exe` - Process enumeration
- `quser.exe` - Logged in users

### Suspicious Parent-Child Relationships

**Office Applications Spawning Shells:**
- winword.exe -> cmd.exe, powershell.exe
- excel.exe -> wscript.exe, cscript.exe
- outlook.exe -> powershell.exe

**Services Spawning Unusual Processes:**
- svchost.exe (non-standard service) -> cmd.exe
- taskeng.exe -> powershell.exe

### Command and Control (C2) Patterns

**Domain Generation Algorithms (DGA):**
- High entropy in domain name
- Unusual TLDs (.tk, .cc, .top, etc.)
- Many failed lookups
- Numeric or random-looking strings

**Beaconing Behavior:**
- Regular, periodic connections
- Consistent outbound connections to same destination
- High connection counts from single process

## Sensor Commands for Investigation

When you find suspicious activity, use these commands to gather more context:

### Process Investigation

```
history_dump                     # Get process history
os_processes                     # List running processes
deny_tree <atom_id>              # Kill suspicious process tree
mem_strings --pid <pid>          # Get process memory strings
yara_scan hive://yara/<rule> --pid <pid>  # Scan process with YARA
```

### Network Investigation

```
netstat                          # Get active network connections
dns_resolve <domain>             # Resolve domain name
```

### File Investigation

```
file_hash <path>                 # Get file hash and signature
file_get <path>                  # Retrieve file for analysis
file_info <path>                 # Get file information
dir_list <path>                  # List directory contents
dir_find_hash <hash> <path>      # Search for file by hash
```

### Forensics

```
os_autoruns                      # Get autoruns
os_services                      # Get installed services
log_get <log_name>               # Get Windows Event Logs
doc_cache_get <hash>             # Get recent document cache
```

## LCQL Quick Reference

### Query Structure

```
TIME_RANGE | SENSOR_SELECTOR | EVENT_TYPE | FILTER | PROJECTION
```

### Time Ranges
- `-1h` - Last hour
- `-24h` - Last 24 hours
- `-7d` - Last 7 days
- `-30d` - Last 30 days

### Sensor Selectors
- `plat == windows` - Windows sensors
- `plat == linux` - Linux sensors
- `hostname == "HOST"` - Specific host
- `tag == "production"` - Tagged sensors

### Common Operators
- `contains` - String contains substring
- `ends with` - String ends with value
- `==` - Equals
- `!=` - Not equals
- `in` - Value in list
- `not in` - Value not in list
- `>`, `<`, `>=`, `<=` - Numeric comparison

### Aggregation Functions
- `COUNT(event)` - Count events
- `COUNT_UNIQUE(path)` - Count unique values
- `GROUP BY(field1 field2)` - Group results
- `ORDER BY(field)` - Sort results (add DESC for descending)

### Common Projections
```
event/FILE_PATH as path
event/COMMAND_LINE as cmd
routing/hostname as host
routing/event_time as time
event/HASH as hash
```

## Converting Hunts to Detections

Once you find malicious activity, create D&R rules to detect it automatically.

### Basic Pattern

1. **Hunt Query**: Test hypothesis with LCQL
2. **Validate Findings**: Confirm true positives
3. **Build D&R Rule**: Convert to detection logic
4. **Add Response**: Define actions (report, task, isolate)
5. **Test with Replay**: Verify before deployment
6. **Deploy and Tune**: Monitor for false positives

### Simple Example: LOLBin Abuse

**Hunt Query:**
```
-12h | plat == windows | NEW_PROCESS | event/FILE_PATH ends with "certutil.exe" and event/COMMAND_LINE contains "http"
```

**D&R Rule:**
```yaml
detect:
  event: NEW_PROCESS
  op: and
  rules:
    - op: is platform
      name: windows
    - op: ends with
      path: event/FILE_PATH
      value: certutil.exe
      case sensitive: false
    - op: contains
      path: event/COMMAND_LINE
      value: http
respond:
  - action: report
    name: "Certutil Download Activity"
    priority: 3
    metadata:
      mitre: T1105
  - action: task
    command: history_dump
    investigation: lolbin-download
```

## Navigation

This skill includes additional resources for comprehensive threat hunting:

- **REFERENCE.md**: Complete LCQL hunt queries organized by MITRE ATT&CK tactics
- **EXAMPLES.md**: Detailed hunt-to-detection workflows and advanced techniques
- **TROUBLESHOOTING.md**: Query optimization, false positive management, and hunting challenges

## Best Practices

### Effective Hunting

1. **Start with Intelligence**: Use threat reports, MITRE ATT&CK, and IOCs
2. **Be Hypothesis-Driven**: Have a clear question you're trying to answer
3. **Hunt Iteratively**: Start broad, narrow based on findings
4. **Document Everything**: Keep notes on queries, findings, and false positives
5. **Think Like an Attacker**: Understand adversary TTPs and goals
6. **Establish Baselines**: Know normal to identify abnormal
7. **Correlate Events**: Connect multiple data points
8. **Automate Findings**: Convert hunts to D&R rules

### Query Optimization

1. **Narrow Time Ranges**: Start with recent data (-24h, -7d)
2. **Filter by Platform**: Use `plat ==` to reduce scope
3. **Specific Event Types**: Use specific events vs `*`
4. **Use Aggregation**: GROUP BY and COUNT for pattern analysis
5. **Test Incrementally**: Build complex queries step by step

### False Positive Management

1. **Whitelist Known-Good**: Create exclusions for legitimate tools
2. **Context Matters**: Same behavior can be benign or malicious
3. **Stack Rank**: Find rare/unusual vs filtering common
4. **Validate Findings**: Investigate before escalating
5. **Tune Over Time**: Refine based on environment

## When Helping Users Hunt

1. **Understand the Goal**: What are they looking for and why?
2. **Assess Data Available**: Which event types are relevant?
3. **Build Queries Iteratively**: Start simple, add complexity
4. **Explain Query Logic**: Help them understand what's being searched
5. **Suggest Pivots**: Recommend next investigative steps
6. **Create Detections**: Convert findings to automated rules
7. **Consider False Positives**: Discuss tuning and whitelisting
8. **Document Process**: Provide clear hunting methodology

Always remember: effective threat hunting combines technical skill, creativity, adversarial thinking, and thorough investigation. Help users develop hypotheses, build queries, analyze results, and convert successful hunts into sustainable detections.