Conduct proactive, hypothesis-driven threat hunting. Use when performing advanced hunting based on threat intelligence, TTPs, or anomalies. For Tier 3 analysts or dedicated threat hunters. Supports iterative search, pivoting, and comprehensive documentation.
Conduct proactive, hypothesis-driven threat hunts based on threat intelligence, observed anomalies, or specific TTPs.
HUNT_HYPOTHESIS - Clear statement of the hunt objective (required)
RELEVANT_GTI_REPORTS - GTI Collection IDs or report namesTARGET_SCOPE_QUERY - UDM query to narrow initial scopeTIME_FRAME_HOURS - Lookback period (default: 168 = 7 days)HUNT_CASE_ID - case for tracking the huntClearly articulate:
Create or identify HUNT_CASE_ID for documentation.
For each relevant GTI report:
gti-mcp.get_collection_report(id=REPORT_ID)
gti-mcp.get_entities_related_to_a_collection(id=REPORT_ID, relationship_name="attack_techniques")
gti-mcp.get_collection_timeline_events(id=REPORT_ID)
gti-mcp.get_collection_mitre_tree(id=REPORT_ID)
Also:
gti-mcp.get_threat_intel(query="Details on specific TTPs")
Based on hypothesis and intelligence, formulate advanced queries:
SIEM queries:
secops-mcp.search_security_events(
text="Advanced UDM query targeting specific behaviors",
hours_back=TIME_FRAME_HOURS
)
BigQuery (for large-scale analysis):
bigquery.execute-query(query="Complex analytical query")
Hunt Loop:
Key questions at each iteration:
For each promising lead:
secops-mcp.lookup_entity(entity_value=LEAD)
GTI enrichment and pivoting:
gti-mcp.get_..._report(identifier=LEAD)
gti-mcp.get_entities_related_to_...(identifier=LEAD)
Check IOC matches:
secops-mcp.get_ioc_matches()
Document throughout in HUNT_CASE_ID:
Use /document-in-case for each significant finding.
Use /generate-report with REPORT_TYPE="hunt_summary":
Confirmed Threat Found: → Escalate to Incident Response immediately → Create incident case, hand over evidence
Suspicious Activity (not confirmed): → Recommend enhanced monitoring → Propose new detection rules to Security Engineering
Valuable Insights (no active threat): → Document for future reference → Propose detection improvements
Inconclusive: → Document process and limitations → Note areas for future investigation
After completing this skill, you MUST report these outputs:
| Output | Description |
|---|---|
HUNT_QUERIES | UDM queries executed during the hunt |
INITIAL_FINDINGS | Raw findings from SIEM searches |
FINDINGS_TYPE | Category: lateral_movement, credential_access, data_exfil, or generic |
DISCOVERED_IOCS | IOCs extracted from findings (IPs, domains, hashes) |
HIGH_CONFIDENCE_IOCS | IOCs confirmed malicious via GTI enrichment |
THREAT_CONFIRMED | Boolean: true if active threat confirmed, false otherwise |
TTP-Based:
"Hunt for [MITRE Technique] activity, specifically [observable behavior], targeting [scope] over [timeframe]."
Actor-Based:
"Hunt for [Threat Actor] TTPs including [specific techniques], focusing on [likely targets] based on [intelligence source]."
Anomaly-Based:
"Investigate anomalous [behavior type] observed in [data source], specifically [anomaly description], to determine if malicious."
DNS Tunneling:
metadata.event_type = "NETWORK_DNS" AND
network.dns.questions.name MATCHES ".*[a-z0-9]{30,}.*" AND
target.hostname NOT IN @known_cdn_domains
Suspicious PowerShell:
metadata.event_type = "PROCESS_LAUNCH" AND
target.process.file.full_path MATCHES ".*powershell.*" AND
target.process.command_line MATCHES ".*(encodedcommand|bypass|hidden).*"
Living-off-the-Land:
metadata.event_type = "PROCESS_LAUNCH" AND
target.process.file.full_path IN @lolbins_list AND
principal.user.userid NOT IN @authorized_admins