How do I install the Hunt Ioc skill?

Run npx skillmds@latest add tomevault-io/hunt-ioc in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Hunt Ioc safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Hunt Ioc?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Hunt Ioc free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Hunt Ioc?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Hunt Ioc by tomevault-io — Agent Skill

Name: Hunt Ioc
Author: tomevault-io

Hunt Ioc

Hunt for specific IOCs across your environment. Use when you have a list of IPs, domains, hashes, or URLs from threat intel and want to check if they appear in your SIEM. Systematic searching with enrichment and documentation. Use when this capability is needed.

tomevault-io Updated Sep 17, 2026

File contents

IOC Threat Hunt Skill

Proactively hunt for specific Indicators of Compromise (IOCs) across the environment based on threat intelligence feeds, recent incidents, or emerging threats.

Inputs

IOC_LIST - Comma-separated list of IOC values to hunt
IOC_TYPES - Corresponding types (e.g., "IP Address, Domain, File Hash")
HUNT_TIMEFRAME_HOURS - Lookback period (default: 96)
(Optional) HUNT_CASE_ID - SOAR case for tracking
(Optional) REASON_FOR_HUNT - Why these IOCs are being hunted

Workflow

Step 1: Parse and Validate IOCs

Parse IOC_LIST and IOC_TYPES into structured list. Validate IOC formats (IP regex, hash length, etc.).

Step 2: Initial IOC Match Check

secops-mcp.get_ioc_matches(hours_back=HUNT_TIMEFRAME_HOURS)

Check if any IOCs appear in integrated threat feeds.

Step 3: Iterative SIEM Search

For each IOC, construct appropriate UDM query:

IP Address:

(principal.ip = "IOC" OR target.ip = "IOC" OR network.ip = "IOC")

Domain:

(principal.hostname = "IOC" OR target.hostname = "IOC" OR network.dns.questions.name = "IOC")

File Hash:

(target.file.sha256 = "IOC" OR target.file.md5 = "IOC" OR target.file.sha1 = "IOC")

URL:

target.url = "IOC"

Execute each search:

secops-mcp.search_security_events(text=query, hours_back=HUNT_TIMEFRAME_HOURS)

Step 4: Analyze Results

For each search result:

Identify affected hosts, users, processes
Note event types (login, network connection, file execution)
Assess if activity is suspicious or expected

Step 5: Enrich Hits

If hits found for an IOC:

Use /enrich-ioc for the IOC itself.

For involved entities (hosts, users):

secops-mcp.lookup_entity(entity_value=ENTITY)

Step 6: Document Hunt

Use /document-in-case (if HUNT_CASE_ID provided):

IOC Hunt Summary:
- IOCs Hunted: [list]
- Timeframe: [hours]
- Queries Used: [list with results summary]
- IOCs with Hits: [list with details]
- IOCs with No Hits: [list - confirms environment is clean]
- Enrichment: [for hits]
- Recommendations: [next steps]

Step 7: Escalate or Conclude

Confirmed malicious activity: → Create/update incident case → Trigger appropriate response runbook

No significant findings: → Document hunt completion → Note clean IOCs for future reference

Output Summary Template

# IOC Hunt Results

**Hunt Date:** [timestamp]
**Timeframe:** Last [X] hours
**Reason:** [REASON_FOR_HUNT]

## IOCs Searched
| IOC | Type | Result | Notes |
|-----|------|--------|-------|
| 198.51.100.10 | IP | NO HITS | Clean |
| evil.com | Domain | 3 HITS | DNS lookups from HOST1 |

## Hits Analysis
[Details for each IOC with hits]

## Recommendations
[Actions to take]

Required Outputs

After completing this skill, you MUST report these outputs:

Output	Description
`MATCHES`	IOCs found in SIEM (list of IOCs with hits)
`MATCH_CONTEXT`	Context for each match (events, assets, users affected)
`MATCHES_FOUND`	Boolean: `true` if any IOCs found in environment, `false` otherwise

Critical Requirements

Search ALL provided IOCs (don't skip any)
Use correct timeframe (not 1 hour instead of 72)
Document negative results (confirms environment is clean)
Don't declare "clean" if there were obvious hits

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: hunt-iocdescription: Hunt for specific IOCs across your environment. Use when you have a list of IPs, domains, hashes, or URLs from threat intel and want to check if they appear in your SIEM. Systematic searching with enrichment and documentation. Use when this capability is needed.---# IOC Threat Hunt SkillProactively hunt for specific Indicators of Compromise (IOCs) across the environment based on threat intelligence feeds, recent incidents, or emerging threats.## Inputs- `IOC_LIST` - Comma-separated list of IOC values to hunt- `IOC_TYPES` - Corresponding types (e.g., "IP Address, Domain, File Hash")- `HUNT_TIMEFRAME_HOURS` - Lookback period (default: 96)- *(Optional)* `HUNT_CASE_ID` - SOAR case for tracking- *(Optional)* `REASON_FOR_HUNT` - Why these IOCs are being hunted## Workflow### Step 1: Parse and Validate IOCsParse `IOC_LIST` and `IOC_TYPES` into structured list.Validate IOC formats (IP regex, hash length, etc.).### Step 2: Initial IOC Match Check```secops-mcp.get_ioc_matches(hours_back=HUNT_TIMEFRAME_HOURS)```Check if any IOCs appear in integrated threat feeds.### Step 3: Iterative SIEM SearchFor each IOC, construct appropriate UDM query:**IP Address:**```udm(principal.ip = "IOC" OR target.ip = "IOC" OR network.ip = "IOC")```**Domain:**```udm(principal.hostname = "IOC" OR target.hostname = "IOC" OR network.dns.questions.name = "IOC")```**File Hash:**```udm(target.file.sha256 = "IOC" OR target.file.md5 = "IOC" OR target.file.sha1 = "IOC")```**URL:**```udmtarget.url = "IOC"```Execute each search:```secops-mcp.search_security_events(text=query, hours_back=HUNT_TIMEFRAME_HOURS)```### Step 4: Analyze ResultsFor each search result:- Identify affected hosts, users, processes- Note event types (login, network connection, file execution)- Assess if activity is suspicious or expected### Step 5: Enrich HitsIf hits found for an IOC:Use `/enrich-ioc` for the IOC itself.For involved entities (hosts, users):```secops-mcp.lookup_entity(entity_value=ENTITY)```### Step 6: Document HuntUse `/document-in-case` (if HUNT_CASE_ID provided):```IOC Hunt Summary:- IOCs Hunted: [list]- Timeframe: [hours]- Queries Used: [list with results summary]- IOCs with Hits: [list with details]- IOCs with No Hits: [list - confirms environment is clean]- Enrichment: [for hits]- Recommendations: [next steps]```### Step 7: Escalate or Conclude**Confirmed malicious activity:**→ Create/update incident case→ Trigger appropriate response runbook**No significant findings:**→ Document hunt completion→ Note clean IOCs for future reference## Output Summary Template```markdown# IOC Hunt Results**Hunt Date:** [timestamp]**Timeframe:** Last [X] hours**Reason:** [REASON_FOR_HUNT]## IOCs Searched| IOC | Type | Result | Notes ||-----|------|--------|-------|| 198.51.100.10 | IP | NO HITS | Clean || evil.com | Domain | 3 HITS | DNS lookups from HOST1 |## Hits Analysis[Details for each IOC with hits]## Recommendations[Actions to take]```## Required Outputs**After completing this skill, you MUST report these outputs:**| Output | Description ||--------|-------------|| `MATCHES` | IOCs found in SIEM (list of IOCs with hits) || `MATCH_CONTEXT` | Context for each match (events, assets, users affected) || `MATCHES_FOUND` | Boolean: `true` if any IOCs found in environment, `false` otherwise |## Critical Requirements- Search ALL provided IOCs (don't skip any)- Use correct timeframe (not 1 hour instead of 72)- Document negative results (confirms environment is clean)- Don't declare "clean" if there were obvious hits---> Converted and distributed by [TomeVault](https://tomevault.io/claim/dandye) — claim your Tome and manage your conversions.

Frequently asked questions