Agent Skills
› backbay-labs/clawdstrike
› threat-hunt
threat-hunt
GitHub用于安全事件调查与威胁狩猎，支持时间线建立、日志查询过滤、多源事件关联分析、IOC 检查及报告生成。
Trigger Scenarios
调查安全事件或可疑活动
漏洞调查或应急响应
跨审计日志进行威胁狩猎
识别 IOC（如恶意 IP、域名）
关联多源安全事件
引用 MITRE ATT&CK 技术
出现安全拦截消息
Install
npx skills add backbay-labs/clawdstrike --skill threat-hunt -g -y
SKILL.md
Frontmatter
{
"name": "threat-hunt",
"description": "Threat hunting and security event investigation"
}
Threat Hunt
Investigation Workflow
Follow this structured approach when investigating security events:
1. Establish Timeline
Call clawdstrike_timeline to get a chronological view of recent events:
- Start with a broad time range, then narrow down
- Look for clusters of activity that indicate automated or coordinated actions
- Note any gaps that might indicate log tampering
2. Query and Filter
Use clawdstrike_query to drill into specific criteria:
- Filter by verdict (allow/deny/audit) to find blocked actions
- Filter by action_type (file/shell/egress/mcp_tool) to focus investigation
- Filter by guard name to see which security controls were triggered
- Search for specific paths, commands, or domains
3. Correlate Events
Run clawdstrike_correlate to detect patterns across events:
- Use built-in correlation rules to identify attack sequences
- Look for lateral movement patterns (multiple targets from one source)
- Detect privilege escalation attempts (sequence of increasingly sensitive operations)
- Identify data exfiltration patterns (sensitive file reads followed by egress)
4. Check IOCs
Use clawdstrike_ioc to check indicators against threat intelligence:
- Submit suspicious domains, IPs, file hashes, or paths
- Cross-reference with known threat actor TTPs
- Check if IOCs appear in multiple events (indicating persistence)
5. Generate Report
Call clawdstrike_report to produce a structured investigation summary:
- Include timeline of events, findings, and recommended actions
- Reference specific events by ID for traceability
- Map findings to MITRE ATT&CK techniques where applicable
MITRE ATT&CK Quick Reference
Common techniques to look for in agent security events:
| Technique | ID | Indicators |
|---|---|---|
| Command and Scripting Interpreter | T1059 | Shell commands with encoded payloads, eval/exec usage |
| File and Directory Discovery | T1083 | Enumeration of sensitive directories |
| Exfiltration Over Web Service | T1567 | Egress to uncommon domains after file reads |
| Credential Access | T1552 | Access to .env, .ssh, credential files |
| Defense Evasion | T1562 | Attempts to modify security config or disable guards |
| Persistence | T1546 | Modifications to shell profiles, cron, startup files |
| Privilege Escalation | T1548 | sudo/chmod/chown commands, setuid changes |
MITRE Technique to MCP Tool Mapping
Use this table to select the right investigation tool for each technique:
| MITRE Technique | ID | Primary MCP Tool | Investigation Approach |
|---|---|---|---|
| Command and Scripting Interpreter | T1059 | clawdstrike_query |
Filter by action_type=shell, look for encoded payloads or eval/exec |
| File and Directory Discovery | T1083 | clawdstrike_timeline |
Broad timeline scan for sequential file reads across sensitive dirs |
| Exfiltration Over Web Service | T1567 | clawdstrike_correlate |
Correlate file reads followed by egress to uncommon domains |
| Credential Access | T1552 | clawdstrike_query |
Filter by action_type=file targeting .env, .ssh, credential paths |
| Defense Evasion | T1562 | clawdstrike_query |
Filter for policy modification attempts or guard config changes |
| Persistence | T1546 | clawdstrike_ioc |
Check shell profile, cron, and startup file modifications |
| Privilege Escalation | T1548 | clawdstrike_query |
Filter by action_type=shell for sudo, chmod, chown, setuid |
Incident Classification
Classify incidents using these severity levels:
| Classification | Criteria | Response |
|---|---|---|
| P1 - Critical | Active exploitation, data exfiltration confirmed, credential compromise | Immediate remediation, revoke credentials, isolate affected sessions |
| P2 - High | Blocked exploit attempt, repeated policy violations, suspicious lateral movement | Investigate within current session, tighten policy, monitor for recurrence |
| P3 - Medium | Single denied action matching known TTP, anomalous but unconfirmed activity | Log for review, verify policy coverage, check for related events |
| P4 - Low | Informational anomaly, policy audit events, benign tool misuse | Document in report, no immediate action required |
Response Guidelines
When this skill is active:
- Present findings in order of severity and confidence
- Always provide specific event IDs and timestamps
- Recommend concrete remediation steps for each finding
- Distinguish between confirmed threats and suspicious activity requiring further investigation
Version History
- 666303e Current 2026-07-25 09:08
