Threat Detection
This skill provides a structured methodology for proactive threat detection, including hypothesis-driven hunting, IOC analysis, and statistical anomaly detection. It includes a Python tool (threat_signal_analyzer.py) that supports hunt, IOC, and anomaly modes, and produces prioritized findings mapped to MITRE ATT&CK.
✨ What it does
- Hypothesis scoring with weighted factors (actor relevance, control gap, data availability).
- IOC sweep generation with staleness filtering (IPs, domains, hashes, URLs, mutexes).
- Z-score anomaly detection with configurable thresholds and baseline requirements.
- MITRE ATT&CK technique mapping and tactic coverage matrix.
- Deception and honeypot integration guidance.
- Workflows for quick hunts, full multi-day hunts, and continuous monitoring.
🎯 When to use it
- When you need to proactively hunt for threats that may have evaded automated security controls.
- When you have a new threat intelligence report or CVE alert and need to quickly check your environment for indicators.
- When you want to detect behavioral anomalies in telemetry that don't match known signatures.
- When you need to prioritize hunting hypotheses based on actor relevance, control gaps, and data availability.
🚀 How to use
Trigger the skill by asking to hunt for threats, analyze IOCs, or detect anomalies. Provide inputs such as a hypothesis, IOC file, or telemetry events file. Use the provided script with modes: hunt, ioc, anomaly. Example prompts:
Hunt for lateral movement via pass-the-hash using compromised service accounts.
Analyze these IOCs and generate sweep targets: [list IPs/domains/hashes].
Detect anomalies in DNS query volumes for the last 24 hours.
📄 Output: The skill produces prioritized findings, IOC sweep lists, anomaly alerts, and reports that can be escalated to incident response.
📦 Add this skill to Claude Code
# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills
# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/engineering-team/skills/threat-detection .claude/skills/threat-detectionSkill source: engineering-team/skills/threat-detection/SKILL.md
⚠️ Good to know
Requires read access to SIEM/EDR telemetry and fresh IOC feeds (within 30 days). Anomaly detection needs at least 14 days of baseline data. Hunting hypotheses must be scoped to the environment.
❓ FAQ
What is the difference between threat detection and incident response?
Threat detection is proactive hunting for hidden threats before alerts fire, while incident response is reactive handling of declared incidents.
How are IOCs filtered for staleness?
IOCs older than their staleness threshold (e.g., 30 days for IPs/domains) are flagged as stale and excluded from sweep generation to avoid false positives.
What does the exit code 2 from the threat_signal_analyzer.py mean?
Exit code 2 indicates high-priority confirmed findings, which should be escalated to a hunt analyst or incident response.
🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.