npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When proactively hunting for indicators of hunting for spearphishing indicators in the environment
Hunt spearphishing indicators (T1566) across email logs, endpoint telemetry, and network data using EDR, SIEM, Sysmon for threat detection and response.
Hunts spearphishing indicators (MITRE T1566) across email logs, endpoint telemetry, and network data using SIEM and EDR queries. Useful for threat hunting, incident response, and proactive detection.
Hunts for Advanced Persistent Threats (APTs) in enterprise environments using hypothesis-driven searches on endpoint telemetry, network logs, and memory artifacts. For threat hunting cycles, UEBA investigations, and TTP validation.
Share bugs, ideas, or general feedback.
| Concept | Description |
|---|---|
| T1566.001 | Spearphishing Attachment |
| T1566.002 | Spearphishing Link |
| T1566.003 | Spearphishing via Service |
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1566.001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]