{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-building-threat-f3c9ca",
  "kind": "skill",
  "name": "building-threat-hunt-hypothesis-framework",
  "description": "Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report. Use when planning or running a proactive threat hunt or scoping compromise from an intel- or anomaly-driven lead.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "threat-hunting",
      "methodology",
      "hypothesis",
      "threat-intelligence",
      "hunting-framework",
      "proactive-detection",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report. Use when planning or running a proactive threat hunt or scoping compromise from an intel- or anomaly-driven lead."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/building-threat-hunt-hypothesis-framework/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/building-threat-hunt-hypothesis-framework/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/building-threat-hunt-hypothesis-framework/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Building Threat Hunt Hypothesis Framework\n\n## When to Use\n\n- When proactively hunting for indicators of building threat hunt hypothesis framework in the environment\n- After threat intelligence indicates active campaigns using these techniques\n- During incident response to scope compromise related to these techniques\n- When EDR or SIEM alerts trigger on related indicators\n- During periodic security assessments and purple team exercises\n\n## Prerequisites\n\n- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)\n- SIEM with relevant log data ingested (Splunk, Elastic, S",
  "cost": {
    "context_tokens": 692
  }
}