agentsclimarketplace

Hunt security indicators

Skill gaelic-ghost/socket/skills/hunt-security-indicators

The Source for macOS Agent Workflows

Install
npx -y skills add gaelic-ghost/socket --skill hunt-security-indicators

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Hunt scoped systems and telemetry for supplied security indicators or behaviors. Use for hashes, paths, domains, addresses, certificates, accounts, processes, commands, persistence, ATT&CK behaviors, cloud or application events, or incident expansion when data sources, time window, query logic, coverage, false positives, privacy, and follow-up validation must be explicit.

SKILL.md

2.1 KB, 334 tokens by cl100k_base, as published. Nobody here has run it

Hunt Security Indicators

Overview

Turn validated evidence into bounded queries across known data sources, then validate matches in context. Absence of matches means only that the indicator was not observed in the recorded coverage.

Read references/hunt-record.md for query and coverage fields.

Workflow

  1. Define the hunt question and scope.
    • Record incident/finding, assets, identities, environments, time window, data owners, privacy constraints, and expected decision.
  2. Normalize indicators and behaviors.
    • Preserve type, value, source, confidence, first/last seen, expected context, variants, and expiration.
    • Prefer behavior chains over one mutable hash/domain when telemetry supports them.
  3. Inventory data sources.
    • Record endpoint/process/file, identity, DNS/network/proxy, application, cloud, email, vulnerability, and backup evidence plus retention, collection delay, and gaps.
  4. Write reproducible queries.
    • Record platform/tool/version, exact query, normalization/timezone, filters, exclusions, and expected benign matches.
  5. Validate matches.
    • Correlate asset/user/time/process/parent/path/signer/network or application context; preserve false-positive rationale.
  6. Expand deliberately.
    • Pivot only from validated relations and update scope, indicators, and confidence.
  7. Report coverage.
    • State searched/failed sources, earliest/latest available data, assets not covered, matches, negative results, and next response/detection action.

Output

Return hypothesis, indicators/behaviors, data coverage, queries, validated matches, false positives, gaps, pivots, and response recommendations.

What ships with it: 2 files

865 B alongside SKILL.md

agents/

references/

Keep looking

Skills are one crate of 327,069. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.