Threat Hunting & IOC Analysis

What it does

• IOC extraction & normalization: pulls IPs, domains, URLs, MD5/SHA1/SHA256 hashes, CVEs, registry keys and file paths out of threat reports, .eml emails, PDFs and log snippets, and refangs hxxp://, [.], [at] notation.
• Categorization & confidence scoring: buckets indicators into Network/File/Host/Identity/Vulnerability with High/Medium/Low confidence, exporting to JSON, CSV or STIX 2.1.
• MITRE ATT&CK mapping: maps observed behavior to Tactic → Technique → Sub-technique (e.g. T1059 → T1059.001) and builds ATT&CK Navigator layer JSON.
• Hunt hypothesis generation: a reusable template with hypothesis statement, rationale, covered techniques, required data sources, and success criteria (found / not-found / inconclusive).
• Detection query library: worked examples in Splunk SPL, Microsoft Sentinel KQL, Elastic EQL and Sigma YAML for PowerShell download cradles, LSASS dumping, Run-key persistence, SMB lateral movement and brute force.
• Threat intel correlation: infrastructure clustering (registrar, certificate SANs), actor attribution pointers, and a Threat Assessment report format.

Who it's for

• SOC analysts, threat hunters and detection engineers
• Anyone with access to Splunk, Elastic, Sentinel or QRadar
• Teams that convert vendor/CISA threat intel into internal detections
• CTI newcomers who want structured ATT&CK mapping practice

Prerequisites: pip install requests pyyaml stix2 taxii2-client; optionally MISP, OpenCTI, Sigma CLI and SIEM access.

Examples

1. Advisory triage: paste a new ransomware advisory and ask "extract every IOC and give me STIX" → normalized indicator list plus STIX 2.1 JSON.
2. Phishing investigation: hand over an .eml file and ask for sender-infrastructure IOCs plus ATT&CK mapping → domains/URLs/hashes with techniques like T1566.001.
3. Intel to detection: "give me three hunt hypotheses for APT29 with Sentinel KQL" → filled hypothesis templates, runnable KQL, and a draft Sigma rule.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/Masriyan/Claude-Code-CyberSecurity-Skill/HEAD/skills/06-threat-hunting/SKILL.md

What I want: (describe your task here)

Install the skill I found on Claude Skill Mart.
Copy the skills/06-threat-hunting folder from the GitHub repo Masriyan/Claude-Code-CyberSecurity-Skill into my ~/.claude/skills/threat-hunting-ioc-analysis/.
When it's done, tell me in one line what this skill can do.