threat-detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers hypothesis-driven threat hunting, IOC sweep generation, z-score anomaly detection, and MITRE ATT&CK-mapped signal prioritization.
Profile →npx skills add alirezarezvani/claude-skills --skill threat-detection --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Threat Detection Threat detection skill for proactive discovery of attacker activity through hypothesis-driven hunting, IOC analysis, and behavioral anomaly detection. This is NOT incident response (see incident-response) or red team operations (see red-team) — this is about finding threats that have evaded automated controls. --- ## Table of Contents - [Overview](#overview) - [Threat Signal Analyzer](#threat-signal-analyzer) - [Threat Hunting Methodology](#threat-hunting-methodology) - [IOC Analysis](#ioc-analysis) - [Anomaly Detection](#anomaly-detection) - [MITRE ATT&CK Signal Prioritization](#mitre-attck-signal-prioritization) - [Deception and Honeypot Integration](#deception-and-honeypot-integration) - [Workflows](#workflows) - [Anti-Patterns](#anti-patterns) - [Cross-References](#cross-references) --- ## Overview ### What This Skill Does This skill provides the methodology and tooling for **proactive threat detection** — finding attacker activity through structured hunting hypotheses, IOC analysis, and statistical anomaly detection before alerts fire. ### Distinction from Other Security Skills | Skill | Focus | Approach | |-------|-------|----------| | **threat-detection**
- Table of Contents
- Overview
- What This Skill Does
- Distinction from Other Security Skills
- Prerequisites
- Threat Signal Analyzer
- IOC file format
- Telemetry events file format
- Exit codes
- Threat Hunting Methodology
- Hypothesis Scoring
- High-Value Hunt Hypotheses by Tactic
- IOC Analysis
- IOC Types and Sweep Priority
Hunt mode: score a hypothesis against MITRE ATT&CK coverage
python3 scripts/threat_signal_analyzer.py --mode hunt \
IOC mode: generate sweep targets from an IOC feed file
python3 scripts/threat_signal_analyzer.py --mode ioc \
Anomaly mode: detect statistical outliers in telemetry events
python3 scripts/threat_signal_analyzer.py --mode anomaly \
List all supported MITRE ATT&CK techniques
python3 scripts/threat_signal_analyzer.py --list-techniques
echo '{"ips": ["1.2.3.4"], "domains": ["malicious.tld"], "hashes": []}' > iocs.json
python3 scripts/threat_signal_analyzer.py --mode ioc --ioc-file iocs.json --jsonWhat does the threat-detection skill do?
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers hypothesis-driven threat hunting, IOC sweep generation, z-score anomaly detection, and MITRE ATT&CK-mapped signal prioritization.
How do I install it?
Run `npx skills add alirezarezvani/claude-skills --skill threat-detection --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From alirezarezvani/claude-skills, a repository with 23,791 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.