# Threat Hunting With Sigma Rules

> Build and refine Sigma-based detections to identify malicious behavior across logs and telemetry. Use when creating detections, mapping ATT&CK techniques, and improving SOC hunting coverage.

- Skill: `nikopj01/threat-hunting-with-sigma-rules` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add nikopj01/threat-hunting-with-sigma-rules`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nikopj01/threat-hunting-with-sigma-rules/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: nikopj01 (https://skillmd.com/u/nikopj01)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/nikopj01/threat-hunting-with-sigma-rules

---


# Threat Hunting with Sigma Rules

## Workflow
1. Define hunting hypothesis and required telemetry sources.
2. Select or create Sigma rules mapped to ATT&CK techniques.
3. Validate against benign and malicious samples to reduce false positives.
4. Tune filters, enrich context, and document response playbooks.
5. Track coverage gaps and schedule iterative rule improvements.