From mas-hunt
Use when performing comprehensive threat hunting with Elasticsearch + VirusTotal enrichment. Index skill linking to evidence ingestion, ES hunting, VT enrichment, and hunt reporting.
How this skill is triggered — by the user, by Claude, or both
Slash command
/mas-hunt:threat-huntThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Index skill for systematic threat hunting. Detailed knowledge lives in focused sub-skills.
elk-companies.mdelk-naive-spawn-templates.mdelk-spawn-templates.mdhunt-base-protocol.mdhunt-companies.mdhunt-spawn-templates.mdnaive-spawn-templates.mdreference.mdreferences/dashboard-template.mdreferences/ingestion-patterns.mdreferences/mini-findings-schema.mdreferences/past-hunts.mdreferences/query-patterns.mdreferences/vt-api-patterns.mdschemas/detection-rule.schema.jsonschemas/detection-task.schema.jsonschemas/hunt-finding.schema.jsonschemas/hunt-goal.schema.jsonschemas/hunt-report.schema.jsonschemas/hunt-task.schema.jsonIndex skill for systematic threat hunting. Detailed knowledge lives in focused sub-skills.
Skill root: ${CLAUDE_PLUGIN_ROOT}/skills/threat-hunt/
Read config from ~/.claude/.env: VT_API_KEY, ES_URL (default http://localhost:9200), ES_INDEX_PREFIX.
| Format | Script | Index Suffix |
|---|---|---|
| Windows EVTX | scripts/ingest_evtx.py | -winevt |
| Linux syslog | scripts/ingest_syslog.py | -syslog |
| Connection logs | scripts/ingest_connections.py | -connections |
| Bash history | scripts/ingest_bash_history.py | -bash-history |
| Windows Registry | scripts/ingest_registry.py | -registry |
| Linux Full Visibility | ../linux-threat-hunt/scripts/ingest_linux_full_visibility.py | linux-evidence-* |
| Windows Full Visibility | ../windows-threat-hunt/scripts/ingest_windows_full_visibility.py | windows-evidence-* |
Prerequisites: Elasticsearch 9.x, evtx_dump (Rust), Python 3.10+ with uv.
Hunt queries by MITRE ATT&CK: C2 (TA0011), Lateral Movement (TA0008), Persistence (TA0003), Defense Evasion (TA0005), Credential Access (TA0006), Exfiltration (TA0010), Registry (TA0003/TA0005).
Pre-built CLI: uv run ${CLAUDE_PLUGIN_ROOT}/skills/threat-hunt/scripts/hunt.py --list
Uses vt-py SDK. Batch IOCs with 2s intervals. Assess as MALICIOUS / SUSPICIOUS / CLEAN / UNKNOWN.
| Resource | Purpose |
|---|---|
es-evidence-ingest | Forensic evidence ingestion into ES |
linux-threat-hunt | Linux full-visibility ingest + 5-layer validation |
windows-threat-hunt | Windows full-visibility ingest + 5-layer validation |
elk-stack-queries | EQL, ES|QL, KQL, DSL reference |
gti-virustotal-api | Complete vt-py SDK reference |
hunt-report | Report generation, delegation, template |
Evidence (5-layer validated):
powershell.exe → svchost.exe with
access mask 0x1FFFFF (PROCESS_ALL_ACCESS) from process id 4827.powershell.exe created thread in
svchost.exe (pid 812); start address does not match loaded module.NtMapViewOfSection call from powershell.exe to svchost.exe
with PAGE_EXECUTE_READWRITE protection (classic shellcode injection).svchost.exe (pid 812) beacons to
185.243.115.84:443 every 60s ± 5s jitter — C2 signature consistent
with Cobalt Strike default Malleable C2 profile.185.243.115.84 → malicious (48/90 engines),
tagged Cobalt Strike, APT by threat-intel feeds.MITRE mapping: T1055.012 (Process Hollowing-adjacent), T1071.001 (Web C2).
Suggested detection: Sigma rule matching Sysmon eid 10 + eid 8 + outbound 443 to non-whitelisted IPs within 30s of CreateRemoteThread.
Recommendation: isolate SRV-DC01, preserve memory image for Volatility analysis, hunt for same C2 IP across all endpoints.
See reference.md for: ingestion commands and process, index conventions, MITRE hunt query details, ES query examples, VT API code, agent delegation patterns, composable report sections, finding verbosity standard, threat intel store, and additional resources.
npx claudepluginhub pmatheus/mas-hunt --plugin mas-huntProvides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.