threat-hunting

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Threat Hunting & Detection Engineering

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED（Execute immediately after reading）

```
NOW
```
: 确认蓝队/狩猎授权与数据源范围（SIEM、EDR 导出）
```
NOW
```
: 明确假说（hypothesis）再查数，避免无脑刷告警
```
NEXT
```
: 工具与数据接入方式
```
ACT
```
: 假说 → 查询 → 验证 → 规则化

```
NOW
```
: Confirm blue team/threat hunting authorization and data source scope (SIEM, EDR exports)
```
NOW
```
: Define a hypothesis before querying data to avoid mindless alert browsing
```
NEXT
```
: Tool and data access methods
```
ACT
```
: Hypothesis → Query → Validation → Rule formalization

适用场景

Application Scenarios

威胁狩猎（hypothesis-driven）
Sigma / YARA 检测工程
告警调优、误报分析
与
```
malware-analysis/
```
：样本侧 IOC → 本 skill 落地检测
与
```
digital-forensics/
```
：案件伪影 → 横向狩猎

Hypothesis-driven threat hunting
Sigma/YARA detection engineering
Alert tuning, false positive analysis
With
```
malware-analysis/
```
: Sample-side IOC → Implementation of detection with this skill
With
```
digital-forensics/
```
: Case artifacts → Lateral threat hunting

工作流

Workflow

1. 建假说

1. Develop a Hypothesis

text

例：攻击者用 living-off-the-land 做横向
→ 数据源：Sysmon 1/3/10、Windows Security 4624/4648
→ 成功标准：发现异常父进程或罕见账户日志源

text

Example: Adversaries use living-off-the-land techniques for lateral movement
→ Data sources: Sysmon 1/3/10, Windows Security 4624/4648
→ Success criteria: Detect abnormal parent processes or rare account log sources

2. 查询与堆叠

2. Query and Stacking

text

□ 基线：正常管理员行为时段与主机
□ 异常：新服务、编码 PowerShell、异常出站
□ 关联：同账号多主机短时登录

text

□ Baseline: Normal administrator behavior time periods and hosts
□ Anomalies: New services, encoded PowerShell, abnormal outbound traffic
□ Correlation: Short-time logins of the same account across multiple hosts

3. 规则化

3. Rule Formalization

yaml

undefined

yaml

undefined

Sigma 骨架见 malware-analysis；本 skill 强调：

See malware-analysis for Sigma skeleton; this skill emphasizes:

- 误报面

- False positive scope

- 数据源字段映射

- Data source field mapping

- 响应 playbook 链接

- Response playbook links

undefined

undefined

4. 验证

4. Validation

text

□ 原子测试（Atomic Red Team）仅在授权实验室
□ 回放历史日志验证召回

text

□ Atomic Red Team tests are only allowed in authorized laboratories
□ Replay historical logs to verify recall rate

工具链

Toolchain

工具	用途
Sigma CLI / sigmac	规则转换
YARA	文件/内存
SIEM（ELK/Splunk 等）	查询
osquery	端点狩猎
Atomic Red Team	检测验证（实验室）

Tool	Purpose
Sigma CLI / sigmac	Rule conversion
YARA	File/memory scanning
SIEM (ELK/Splunk, etc.)	Querying
osquery	Endpoint threat hunting
Atomic Red Team	Detection validation (laboratory)

参考

References

```
references/hunting-loop.md
```

../malware-analysis/references/yara-sigma-rules.md

```
../digital-forensics/
```

```
references/hunting-loop.md
```

../malware-analysis/references/yara-sigma-rules.md

```
../digital-forensics/
```

路由上下文

Routing Context

上游: MASTER R27
下游: 确认入侵 → forensics；恶意样本 → malware-analysis
MUST NOT: 在无授权生产环境跑攻击模拟

Upstream: MASTER R27
Downstream: Confirm intrusion → forensics; Malicious samples → malware-analysis
MUST NOT: Run attack simulations in unauthorized production environments

任务完成自检

Task Completion Self-Check

是否有明确假说与结论？
规则是否注明误报与数据源？
Checklist？

Is there a clear hypothesis and conclusion?
Does the rule note false positives and data sources?
Completed checklist?