agentsclimarketplace
Sign in

Hunting from a threat intel report

Skill meltedinhex/analyst-ai-pack/skills/hunting-from-a-threat-intel-report

Operationalizes a threat intelligence report into hunts: extracting IOCs and TTPs, mapping behaviors to ATT&CK and available telemetry, prioritizing durable behavioral indicators over volatile atomic ones, and producing concrete hunt queries. Activates for requests to hunt from a threat report, operationalize CTI, or turn an intel report into detections.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-from-a-threat-intel-report

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.1 KB, 528 tokens by cl100k_base, as published. Nobody here has run it

Hunting from a Threat Intel Report

When to Use

  • You received a CTI report (vendor writeup, ISAC bulletin, IR report) and must operationalize it.
  • You want to convert narrative TTPs and IOC lists into concrete hunts against your telemetry.
  • You need to prioritize which indicators are worth hunting given they age at different rates.

Do not use an IOC blocklist as the whole engagement — atomic indicators (hashes, IPs) are trivially changed; durable value comes from hunting the behaviors (TTPs).

Prerequisites

  • The report and a way to extract its IOCs and behavioral claims.
  • Knowledge of your telemetry coverage to judge which TTPs are huntable.

Workflow

Step 1: Extract IOCs and TTPs

Pull atomic indicators (hashes, IPs, domains, URLs) and the behavioral TTPs (the report's "how"). Defang/normalize indicators for safe handling.

python scripts/analyst.py extract report.txt

Step 2: Map to ATT&CK and the Pyramid of Pain

Tag behaviors with techniques and rank indicators by the Pyramid of Pain — prioritize TTPs and tools over hashes/IPs because they cost the adversary more to change.

Step 3: Check telemetry feasibility

For each TTP, confirm you have the data source to hunt it; note gaps as detection-engineering work.

Step 4: Build concrete hunts

Translate the high-value TTPs into queries (Sysmon, DNS, proxy, EDR), and sweep atomic IOCs as a quick first pass for current presence.

Step 5: Execute, document, and feed back

Run the hunts, record findings/gaps/negatives, escalate hits to IR, and convert durable logic into detections (Sigma).

Validation

  • Both atomic IOCs and behavioral TTPs are extracted, not just the indicator list.
  • Hunts target the highest-pain indicators feasible with your telemetry.
  • Each TTP maps to a real data source or is logged as a coverage gap.

Pitfalls

  • Stopping at IOC sweeps; the adversary rotates them and you miss the campaign.
  • Hunting TTPs you have no telemetry for, producing false confidence.
  • Failing to defang indicators, risking accidental execution/clicks.

References

What ships with it: 3 files

4.2 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 326,835. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.