/hunt-apt

type: Skill
name: hunt-apt
description: "Hunt for a specific APT/threat actor in your environment. Use when you have a threat actor name or GTI collection ID and want to search for their TTPs and IOCs. Gathers intelligence from GTI, searches SIEM for IOCs and TTP-based indicators, and documents findings."
required_roles:
  chronicle: roles/chronicle.editor
  gti: GTI Enterprise+
personas: [threat-hunter, tier3-analyst]
generated:
  by: human:dandye
  at: 2026-02-04T06:10:49-05:00

APT Threat Hunt Skill

Proactively hunt for TTPs and IOCs associated with a specific Advanced Persistent Threat (APT) group based on threat intelligence.

Inputs

• `THREAT_ACTOR_ID` - GTI Collection ID or name of the target APT group
• `HUNT_TIMEFRAME_HOURS` - Lookback period (default: 168 = 7 days)
• *(Optional)* `TARGET_SCOPE_QUERY` - UDM query to narrow scope
• *(Optional)* `HUNT_HYPOTHESIS` - Specific hypothesis guiding the hunt
• *(Optional)* `HUNT_CASE_ID` - SOAR case for tracking

Workflow

Step 1: Identify Actor & Gather Intelligence

If starting with a name:

gti-mcp.search_threat_actors(query="APT_NAME")

Then gather comprehensive intelligence:

gti-mcp.get_collection_report(id=THREAT_ACTOR_ID)
gti-mcp.get_collection_mitre_tree(id=THREAT_ACTOR_ID)
gti-mcp.get_collection_timeline_events(id=THREAT_ACTOR_ID)

Extract associated IOCs:

gti-mcp.get_entities_related_to_a_collection(id=THREAT_ACTOR_ID, relationship_name="files")
gti-mcp.get_entities_related_to_a_collection(id=THREAT_ACTOR_ID, relationship_name="domains")
gti-mcp.get_entities_related_to_a_collection(id=THREAT_ACTOR_ID, relationship_name="urls")

Store as `GTI_IOC_LIST`.

Step 2: Check SIEM IOC Matches

secops-mcp.get_ioc_matches(hours_back=HUNT_TIMEFRAME_HOURS)

Correlate results with `GTI_IOC_LIST`.

Step 3: IOC-Based SIEM Search

For each IOC type in `GTI_IOC_LIST`, construct and execute UDM queries:

secops-mcp.search_security_events(
    text="UDM query for IOC",
    hours_back=HUNT_TIMEFRAME_HOURS
)

Document both positive and negative results → `IOC_SEARCH_FINDINGS`.

Step 4: TTP-Based SIEM Search

Based on MITRE techniques from Step 1:

• Use `gti-mcp.get_threat_intel(query="MITRE technique details")` for detection ideas
• Formulate TTP-specific UDM queries
• Execute searches over the timeframe
• Combine with `TARGET_SCOPE_QUERY` if provided

Document results → `TTP_SEARCH_FINDINGS`.

Step 5: Enrich Findings

If hits found (`IOC_SEARCH_FINDINGS` or `TTP_SEARCH_FINDINGS`):

For each found IOC or entity:

secops-mcp.lookup_entity(entity_value=FOUND_ITEM)
gti-mcp.get_..._report(identifier=FOUND_ITEM)

Step 6: Check Related Cases

Use `/find-relevant-case` with found IOCs and entities.

Step 7: Document & Report

Use `/document-in-case` (if HUNT_CASE_ID provided).

Use `/generate-report` with `REPORT_TYPE="apt_hunt"`:

• Hunt objective and hypothesis
• Threat actor summary
• TTPs investigated
• IOCs searched
• SIEM queries used
• Findings (positive AND negative)
• Recommendations

Step 8: Escalate or Conclude

**Confirmed threat found:** → Escalate to Incident Response → Create incident case

**No threat found:** → Document negative findings → Conclude hunt

Required Outputs

**After completing this skill, you MUST report these outputs:**

| Output | Description | |--------|-------------| | `ACTOR_IOCS` | IOCs associated with threat actor from GTI | | `ACTOR_TTPS` | TTPs from threat actor profile (MITRE techniques) | | `HUNT_RESULTS` | SIEM search results for actor indicators | | `DISCOVERED_INDICATORS` | IOCs found in environment matching actor profile | | `CONFIRMED_IOCS` | IOCs confirmed malicious via GTI enrichment |

Key Intelligence Sources

| Source | Tool | |--------|------| | Actor Profile | `get_collection_report` | | TTPs | `get_collection_mitre_tree` | | Timeline | `get_collection_timeline_events` | | Related IOCs | `get_entities_related_to_a_collection` | | Technique Details | `get_threat_intel` |

Critical Requirements

• Document ALL queries used (for reproducibility)
• Report negative findings (no hits is valuable intel)
• Don't report false positives as confirmed threats