How do I install the Defense Threat Hunting skill?

Run npx skillmds@latest add noorqureshi/defense-threat-hunting in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Defense Threat Hunting skill do?

Hunt for intrusions no alert fired on — hypothesis-driven, ATT&CK-guided searching across EDR and logs. Load for "threat hunt", "are we compromised", "hunt for ", proactive blue-team work, or turning threat intel into a hunt. Complements detection engineering: hunts find the gaps, then become detections. It is listed under Security on SkillMD.

Is Defense Threat Hunting safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Defense Threat Hunting?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Defense Threat Hunting free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Defense Threat Hunting?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Defense Threat Hunting by noorqureshi

Name: Defense Threat Hunting
Author: NoorQureshi

Defense Threat Hunting

Hunt for intrusions no alert fired on — hypothesis-driven, ATT&CK-guided searching across EDR and logs. Load for "threat hunt", "are we compromised", "hunt for <technique>", proactive blue-team work, or turning threat intel into a hunt. Complements detection engineering: hunts find the gaps, then become detections.

NoorQureshi Updated Sep 17, 2026

File contents

Threat hunting

When it applies

You suspect activity that evaded detections, or you want to proactively look for a specific technique/actor. Hunting assumes breach and searches telemetry for evidence, rather than waiting for an alert.

Why it works

Detections encode what you already anticipated; hunting finds what you didn't. Framing a falsifiable hypothesis around an ATT&CK technique focuses the search on data that would prove or disprove compromise, and every confirmed pattern becomes a new detection — so coverage grows.

Method

Form a hypothesis: specific and testable — "an adversary is using WMI for lateral movement (T1047)", not "find bad stuff".
Pick the telemetry: which data source records it (process create, network, auth, cloud audit), and confirm it's actually being collected.
Search with technique, not IOC: behavioural queries — rare parent/child process pairs, regsvr32/rundll32 with network egress, service installs, anomalous logon patterns.
Reduce with stack-counting/frequency analysis: sort by rarity — outliers surface fast in a sea of normal (long-tail analysis).
Pivot on hits: from a suspicious process → its network, parent, the host's auth history; build the timeline. Escalate to defense-incident-response if confirmed.
Operationalise: turn every true finding into a detection (defense-detection-engineering), and record the hunt (hypothesis, data, result) even when negative.

Gotchas

A negative hunt is only meaningful if the telemetry existed — "found nothing" with no logs is not "clean".
IOC-only hunting rots as infrastructure rotates; hunt behaviour.
Hunting in production EDR can tip off an active adversary — coordinate with IR.

Verify success

Each hunt has a stated hypothesis, the data it examined, and an outcome (found / not found / no telemetry), and true findings produced both an IR handoff and a new detection.

References

MITRE ATT&CK; the PEAK / TaHiTI hunting frameworks; Sqrrl hunting maturity model.

---name: defense-threat-huntingdescription: Hunt for intrusions no alert fired on — hypothesis-driven, ATT&CK-guided searching across EDR and logs. Load for "threat hunt", "are we compromised", "hunt for <technique>", proactive blue-team work, or turning threat intel into a hunt. Complements detection engineering: hunts find the gaps, then become detections.---# Threat hunting## When it appliesYou suspect activity that evaded detections, or you want to proactively look for a specifictechnique/actor. Hunting assumes breach and searches telemetry for evidence, rather than waiting foran alert.## Why it worksDetections encode what you already anticipated; hunting finds what you didn't. Framing a falsifiablehypothesis around an ATT&CK technique focuses the search on data that would prove or disprovecompromise, and every confirmed pattern becomes a new detection — so coverage grows.## Method1. **Form a hypothesis**: specific and testable — "an adversary is using WMI for lateral movement (T1047)", not "find bad stuff".2. **Pick the telemetry**: which data source records it (process create, network, auth, cloud audit), and confirm it's actually being collected.3. **Search with technique, not IOC**: behavioural queries — rare parent/child process pairs, `regsvr32`/`rundll32` with network egress, service installs, anomalous logon patterns.4. **Reduce with stack-counting/frequency analysis**: sort by rarity — outliers surface fast in a sea of normal (long-tail analysis).5. **Pivot on hits**: from a suspicious process → its network, parent, the host's auth history; build the timeline. Escalate to `defense-incident-response` if confirmed.6. **Operationalise**: turn every true finding into a detection (`defense-detection-engineering`), and record the hunt (hypothesis, data, result) even when negative.## Gotchas- A negative hunt is only meaningful if the telemetry existed — "found nothing" with no logs is not "clean".- IOC-only hunting rots as infrastructure rotates; hunt behaviour.- Hunting in production EDR can tip off an active adversary — coordinate with IR.## Verify successEach hunt has a stated hypothesis, the data it examined, and an outcome (found / not found / notelemetry), and true findings produced both an IR handoff and a new detection.## ReferencesMITRE ATT&CK; the PEAK / TaHiTI hunting frameworks; Sqrrl hunting maturity model.

Frequently asked questions