Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add zhaoxuya520/reverse-skill/skills/threat-huntingCompatible with
Supported agents
| name | threat-hunting |
| description | Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation. |
NOW: 确认蓝队/狩猎授权与数据源范围（SIEM、EDR 导出）NOW: 明确假说（hypothesis）再查数，避免无脑刷告警NEXT: 工具与数据接入方式ACT: 假说 → 查询 → 验证 → 规则化malware-analysis/：样本侧 IOC → 本 skill 落地检测digital-forensics/：案件伪影 → 横向狩猎例：攻击者用 living-off-the-land 做横向
→ 数据源：Sysmon 1/3/10、Windows Security 4624/4648
→ 成功标准：发现异常父进程或罕见账户日志源
□ 基线：正常管理员行为时段与主机
□ 异常：新服务、编码 PowerShell、异常出站
□ 关联：同账号多主机短时登录
# Sigma 骨架见 malware-analysis；本 skill 强调：
# - 误报面
# - 数据源字段映射
# - 响应 playbook 链接
□ 原子测试（Atomic Red Team）仅在授权实验室
□ 回放历史日志验证召回
| 工具 | 用途 |
|---|---|
| Sigma CLI / sigmac | 规则转换 |
| YARA | 文件/内存 |
| SIEM（ELK/Splunk 等） | 查询 |
| osquery | 端点狩猎 |
| Atomic Red Team | 检测验证（实验室） |
references/hunting-loop.md../malware-analysis/references/yara-sigma-rules.md../digital-forensics/上游: MASTER R27
下游: 确认入侵 → forensics；恶意样本 → malware-analysis
MUST NOT: 在无授权生产环境跑攻击模拟
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionthreat-huntingExecute the skills CLI command in your project's root directory to begin installation:
epx add zhaoxuya520/reverse-skill/skills/threat-huntingFetches threat-hunting from zhaoxuya520/reverse-skill and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/threat-hunting
Restart Cursor to activate threat-hunting. Access via /threat-huntingin your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
mobile-reverse
zhaoxuya520/reverse-skill · security · same repo
go-rust-reverse
zhaoxuya520/reverse-skill · security · same repo
ida-reverse
zhaoxuya520/reverse-skill · security · same repo
browser-extension-reverse
zhaoxuya520/reverse-skill · security · same repo
windows-ad
zhaoxuya520/reverse-skill · security · same repo
edr-bypass-re
zhaoxuya520/reverse-skill · security · same repo
threat-hunting fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
threat-hunting is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
Keeps context tight: threat-hunting is the kind of skill you can hand to a new teammate without a long onboarding doc.
Solid pick for teams standardizing on skills: threat-hunting is focused, and the summary matches what you get after install.
We added threat-hunting from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
Solid pick for teams standardizing on skills: threat-hunting is focused, and the summary matches what you get after install.
threat-hunting has been reliable in day-to-day use. Documentation quality is above average for community skills.
Solid pick for teams standardizing on skills: threat-hunting is focused, and the summary matches what you get after install.
Keeps context tight: threat-hunting is the kind of skill you can hand to a new teammate without a long onboarding doc.
We added threat-hunting from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
showing 1-10 of 25