Skip to content
cccskills
FreePublished on GitHub

apt-hunting-detection

Advanced Persistent Threat (APT) hunting and threat detection. Focuses on identifying stealthy intruders using TTP mapping, IoC analysis, and behavioral anomalies.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5 stars(GitHub 5 + cccskills 0)

Run score Not tested

See how to install

Files included (1)

  • SKILL.md1.3 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

APT Hunting & Threat Detection

This skill focuses on finding the "unfindable" intruders.

Hunting Methodologies

  • Indicator-Based Hunting: Searching for known hashes, IPs, and domains (IoCs).
  • Behavioral Hunting: Identifying anomalous patterns (e.g., unusual PowerShell usage, unexpected outbound traffic to rare TLDs).
  • TTP Mapping: Aligning observed behaviors to the MITRE ATT&CK framework to predict the attacker's next move.

Detection Focus Areas

  • Persistence: Hunting for unusual scheduled tasks, registry keys, or WMI event consumers.
  • Lateral Movement: Monitoring for abnormal SMB/RPC traffic or credential dumping (LSASS access).
  • Exfiltration: Detecting high-volume data transfers or "heartbeat" patterns in DoH/DNS traffic.

The Hunting Loop

  1. Hypothesis: "I believe an attacker is using [TTP] to maintain persistence."
  2. Data Collection: Gather logs (Event Logs, Sysmon, Network PCAPs).
  3. Analysis: Filter noise and look for the hypothesis pattern.
  4. Verification: Confirm the finding is malicious and not a system fluke.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

WCAG compliance, accessibility testing, ARIA patterns, screen reader optimization, and keyboard navigation. Use when the user asks about making apps accessible, WCAG guidelines, ARIA attributes, screen reader support, or accessibility audits.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5Updated Sep 4, 2026

Generate AI music using ACE-Step 1.5 via ACE Music's free API. Use when the user asks to create, generate, or compose music, songs, beats, instrumentals, or audio tracks. Supports lyrics, style prompts, covers, and repainting. Free API, no cost.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5Updated Sep 4, 2026

A continuously adaptive skill suite that empowers Clawdbot to act as a versatile coder, business analyst, project manager, web developer, data analyst, and NAS metadata scraper. It intelligently discovers free resources, adapts to user context, and ensures reliable, proven guidance across multiple domains.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5Updated Sep 4, 2026

High-fidelity intelligence gathering and data assimilation. Focuses on synthesizing fragmented data into a comprehensive target operational picture.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5Updated Sep 4, 2026

Use when Codex needs proactive task queues, heartbeat routines, scheduled follow-up, or continuous work loops instead of waiting for prompts.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5Updated Sep 4, 2026

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.

The English summary is being prepared. Showing the original description.

ProjectZeroDays/FreeAI_AI_Inference_Workstation5Updated Sep 4, 2026

See all skills by ProjectZeroDays

Report a problem with this skill