How do I install the Router Reverse Skill Router Threat Hunting skill?

Run npx skillmds@latest add netvar1337/router-reverse-skill-router-threat-hunting in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Router Reverse Skill Router Threat Hunting safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Router Reverse Skill Router Threat Hunting?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Router Reverse Skill Router Threat Hunting free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Router Reverse Skill Router Threat Hunting?

netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Router Reverse Skill Router Threat Hunting by netvar1337

Name: Router Reverse Skill Router Threat Hunting
Author: netvar1337

File contents

Threat Hunting & Detection Engineering

ACTION REQUIRED (execute immediately after reading)

NOW: Confirm blue-team/hunting authorization and the data source scope (SIEM, EDR exports)
NOW: Form a hypothesis before querying data; avoid blindly grinding through alerts
NEXT: Tools and data onboarding approach
ACT: Hypothesis → query → validate → turn into rules

Applicable Scenarios

Threat hunting (hypothesis-driven)
Sigma / YARA detection engineering
Alert tuning, false-positive analysis
With malware-analysis/: sample-side IOCs → this skill lands them as detections
With digital-forensics/: case artifacts → lateral hunting

Workflow

1. Form a hypothesis

Example: attackers use living-off-the-land for lateral movement
→ Data sources: Sysmon 1/3/10, Windows Security 4624/4648
→ Success criteria: find anomalous parent processes or rare account log sources

2. Query and stacking

□ Baseline: normal administrator behavior time windows and hosts
□ Anomalies: new services, encoded PowerShell, unusual egress
□ Correlation: the same account logging into many hosts in a short window

3. Turn into rules

# Sigma skeletons are in malware-analysis; this skill emphasizes:
# - False-positive surface
# - Data source field mapping
# - Response playbook linkage

4. Validation

□ Atomic tests (Atomic Red Team) only in an authorized lab
□ Replay historical logs to verify recall

Toolchain

Tool	Purpose
Sigma CLI / sigmac	Rule conversion
YARA	Files/memory
SIEM (ELK/Splunk etc.)	Querying
osquery	Endpoint hunting
Atomic Red Team	Detection validation (lab)

References

references/hunting-loop.md
../malware-analysis/references/yara-sigma-rules.md
../digital-forensics/

Routing Context

Upstream: MASTER R27
Downstream: confirmed intrusion → forensics; malicious sample → malware-analysis
MUST NOT: run attack simulations in unauthorized production environments

Task Completion Self-Check

Is there a clear hypothesis and conclusion?
Do the rules document false positives and data sources?
Checklist?

---name: router-reverse-skill-router-threat-huntingdescription: Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.---# Threat Hunting & Detection Engineering## ACTION REQUIRED (execute immediately after reading)1. `NOW`: Confirm blue-team/hunting authorization and the data source scope (SIEM, EDR exports)2. `NOW`: Form a hypothesis before querying data; avoid blindly grinding through alerts3. `NEXT`: Tools and data onboarding approach4. `ACT`: Hypothesis → query → validate → turn into rules## Applicable Scenarios- Threat hunting (hypothesis-driven)- Sigma / YARA detection engineering- Alert tuning, false-positive analysis- With `malware-analysis/`: sample-side IOCs → this skill lands them as detections- With `digital-forensics/`: case artifacts → lateral hunting## Workflow### 1. Form a hypothesis```textExample: attackers use living-off-the-land for lateral movement→ Data sources: Sysmon 1/3/10, Windows Security 4624/4648→ Success criteria: find anomalous parent processes or rare account log sources```### 2. Query and stacking```text□ Baseline: normal administrator behavior time windows and hosts□ Anomalies: new services, encoded PowerShell, unusual egress□ Correlation: the same account logging into many hosts in a short window```### 3. Turn into rules```yaml# Sigma skeletons are in malware-analysis; this skill emphasizes:# - False-positive surface# - Data source field mapping# - Response playbook linkage```### 4. Validation```text□ Atomic tests (Atomic Red Team) only in an authorized lab□ Replay historical logs to verify recall```## Toolchain| Tool | Purpose ||------|------|| Sigma CLI / sigmac | Rule conversion || YARA | Files/memory || SIEM (ELK/Splunk etc.) | Querying || osquery | Endpoint hunting || Atomic Red Team | Detection validation (lab) |## References- `references/hunting-loop.md`- `../malware-analysis/references/yara-sigma-rules.md`- `../digital-forensics/`## Routing Context**Upstream**: MASTER R27 **Downstream**: confirmed intrusion → forensics; malicious sample → malware-analysis **MUST NOT**: run attack simulations in unauthorized production environments## Task Completion Self-Check- [ ] Is there a clear hypothesis and conclusion?- [ ] Do the rules document false positives and data sources?- [ ] Checklist?

Frequently asked questions

Router Reverse Skill Router Threat Hunting