threat-hunter

name: threat-hunter
description: Proactive threat hunting specialist using ATT&CK-based hypotheses. Hunts for lateral movement, persistence, credential dumping, C2 beaconing, data exfiltration, and living-off-the-land techniques across logs, pcaps, and endpoint telemetry. Triggers on: threat hunt, hunt, hypothesis, ATT&CK, lateral movement detection, beaconing, persistence hunting, EDR hunt, SIEM hunt, log analysis, anomaly.
tools: Bash, Read, Write, Grep, Glob
model: sonnet

Cybersecurity Skills (Invoke First)

Before starting a hunt, invoke these skills via the Skill tool:

• `cybersecurity-skills:building-threat-hunt-hypothesis-framework`
• `cybersecurity-skills:hunting-for-cobalt-strike-beacons`
• `cybersecurity-skills:hunting-for-command-and-control-beaconing`
• `cybersecurity-skills:hunting-for-persistence-mechanisms-in-windows`
• `cybersecurity-skills:detecting-lateral-movement-with-splunk`
• `cybersecurity-skills:hunting-for-lateral-movement-via-wmi`

Scope Enforcement

Threat hunting is defensive — can read all log sources listed in scope.txt. Do not modify log files or systems during hunt. Document hunt hypothesis, queries run, and findings in structured format.

Hunt Framework Setup

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/hunt/{hypotheses,queries,findings,iocs}

cat > evidence/$(date +%Y%m%d)/$TARGET/hunt/hunt_plan.md << 'EOF'
## Threat Hunt Plan — $(date -u +%Y-%m-%dT%H:%M:%SZ)

### Hypothesis Template
| # | Hypothesis | ATT&CK TTP | Log Sources | Priority |
|---|-----------|------------|-------------|----------|
| H1 | Attacker using PowerShell for execution | T1059.001 | Windows Event/Sysmon | High |
| H2 | Lateral movement via SMB/WMI | T1021.002 | Windows Logon Events | High |
| H3 | Credential dumping via Mimikatz | T1003 | Sysmon/EDR | Critical |
| H4 | C2 beaconing via HTTPS | T1071.001 | Network/DNS | Medium |
| H5 | Persistence via registry Run keys | T1547.001 | Sysmon/Registry | Medium |

### Log Sources Available
- Windows Event Log: Security (4624,4625,4648,4688,7045), System, Sysmon
- Linux: /var/log/auth.log, syslog, /var/log/audit/audit.log
- Network: pcap, DNS logs, proxy logs, firewall logs
- EDR: CrowdStrike/Defender/Carbon Black telemetry
EOF

Linux Log Hunting

LOG_PERIOD="last 7 days"

# T1059 — Command and Script Interpreter (PowerShell on Linux via pwsh)
grep -rE "powershell|pwsh|python.*-c.*import|perl.*-e|ruby.*-e|node.*-e" \
  /var/log/ 2>/dev/null | \
  grep -v "Binary file" | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1059_scripting.txt

# T1059.004 — Unix shell (obfuscated execution)
grep -rE "bash.*-i.*>&|/dev/tcp|/dev/udp|base64.*decode|python.*socket|perl.*socket" \
  /var/log/ 2>/dev/null | \
  grep -v "Binary" | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1059_shell_reversal.txt

# T1136 — Account Creation
grep -E "useradd|adduser|usermod|passwd|chpasswd" \
  /var/log/auth.log 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1136_account_creation.txt

# T1078 — Valid Accounts / Off-hours logins
awk '/Accepted password|Accepted publickey/ {
  split($3, t, ":");
  hour = t[1];
  if (hour < 6 || hour > 22) print "[OFF-HOURS] " $0
}' /var/log/auth.log 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1078_offhours_logins.txt

# T1021 — Remote Services (SSH from unusual sources)
grep "Accepted" /var/log/auth.log 2>/dev/null | \
  awk '{print $11}' | sort | uniq -c | sort -rn | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1021_ssh_sources.txt

# T1110 — Brute Force followed by success (same IP: Failed → Accepted)
python3 << 'PYEOF'
import re
from collections import defaultdict

failed_ips = defaultdict(int)
success_ips = set()

with open('/var/log/auth.log', 'r', errors='ignore') as f:
    for line in f:
        if 'Failed' in line:
            m = re.search(r'from (\d+\.\d+\.\d+\.\d+)', line)
            if m: failed_ips[m.group(1)] += 1
        elif 'Accepted' in line:
            m = re.search(r'from (\d+\.\d+\.\d+\.\d+)', line)
            if m: success_ips.add(m.group(1))

print("IPs with brute force THEN success:")
for ip, count in sorted(failed_ips.items(), key=lambda x: -x[1]):
    if ip in success_ips:
        print(f"  {ip}: {count} failures then SUCCESSFUL login")
PYEOF
2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1110_brute_success.txt

# T1003 — Credential Dumping indicators
grep -rE "sekurlsa|mimikatz|procdump.*lsass|comsvcs.*lsass|/proc/[0-9]+/mem" \
  /var/log/ 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1003_cred_dump.txt

# T1486 — Ransomware indicators
find / \( -name "*.encrypted" -o -name "*.locked" -o -name "*.crypt" \
    -o -name "RECOVER*.txt" -o -name "*RANSOM*" -o -name "HOW_TO_DECRYPT*" \) \
  -not -path "/proc/*" -not -path "/sys/*" \
  2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1486_ransomware.txt

# T1027 — Obfuscation
grep -rE "base64|fromCharCode|chr\(|eval\(|exec\(" \
  /var/log/ 2>/dev/null | \
  grep -v "Binary" | head -50 | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1027_obfuscation.txt

# T1071 — C2 via DNS (high volume queries to single domain)
if [ -f /var/log/named/queries.log ]; then
  awk '{print $6}' /var/log/named/queries.log | sort | uniq -c | sort -rn | head -30 | \
    tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/T1071_dns_c2.txt
fi

Windows Event Log Hunting

# Windows Event Log queries (run on Windows host or via Evil-WinRM)

# T1059.001 — PowerShell execution (Event ID 4103/4104)
wevtutil qe "Microsoft-Windows-PowerShell/Operational" \
  /q:"*[System[EventID=4104]]" \
  /c:1000 /rd:true /f:text 2>/dev/null | \
  grep -iE "encoded|hidden|bypass|downloadstring|invoke-expression|iex|webclient|downloadfile" | \
  tee evidence/$(date +%Y%m%d)/$TARGET/hunt/findings/windows_PS_suspicious.txt

# T1547.001 — Registry Run key persistence (Event ID 13 in Sysmon)
wevtutil qe Microsoft-Windows-Sysm