Hunting For Spearphishing Indicators
FreeProactively detect spearphishing threats in your environment.
Free · Opens the source repo
What Hunting For Spearphishing Indicators does
The Hunting For Spearphishing Indicators skill is designed for cybersecurity professionals tasked with identifying and mitigating spearphishing attacks. This skill enables users to hunt for indicators of compromise (IOCs) across various data sources, including email logs, endpoint telemetry, and network data. By leveraging threat intelligence and established frameworks like MITRE ATT&CK, users can formulate hypotheses about potential spearphishing campaigns and validate them through targeted queries and analysis.
The workflow begins with the formulation of a hypothesis based on threat intelligence or a gap analysis of existing defenses. Users then identify the necessary data sources, execute queries against their SIEM and EDR platforms, and analyze the results for anomalies. This process not only helps in detecting spearphishing attempts but also aids in understanding the broader context of the attack through correlation with known tactics, techniques, and procedures (TTPs) used by threat actors.
This skill is particularly useful during proactive threat hunting, incident response, and security assessments. It is designed for organizations that have established EDR and SIEM solutions, as well as those that maintain comprehensive logging and telemetry capabilities. By employing this skill, security teams can enhance their ability to detect and respond to sophisticated email-based threats, ultimately improving their overall security posture.
However, the effectiveness of this skill is contingent upon the quality of the data sources and threat intelligence feeds available to the user. Therefore, organizations should ensure that they have the requisite tools and configurations in place to fully leverage the capabilities of this skill.
When to use it
Use this skill when actively hunting for spearphishing indicators, especially after receiving threat intelligence about ongoing campaigns.
When not to use it
This skill is not suitable for environments lacking EDR or SIEM capabilities, or where comprehensive logging is not implemented.
What you can build with it
Proactive Threat Hunting
Utilize the skill to identify spearphishing indicators before they lead to security incidents.
Incident Response Scoping
Apply the skill during incident response to assess the impact of detected spearphishing attempts.
Security Assessments
Incorporate the skill into periodic security assessments to evaluate the effectiveness of existing defenses against spearphishing.
How to install Hunting For Spearphishing Indicators
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-spearphishing-indicators --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting For Spearphishing Indicators
When to Use
- When proactively hunting for indicators of hunting for spearphishing indicators in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1566.001 | Spearphishing Attachment |
| T1566.002 | Spearphishing Link |
| T1566.003 | Spearphishing via Service |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: Macro-enabled Excel executing PowerShell downloader
- Scenario 2: HTML smuggling delivering ISO with LNK payload
- Scenario 3: Credential harvesting link as SharePoint notification
- Scenario 4: QR code phishing in PDF attachment
Output Format
Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1566.001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Hunting For Spearphishing Indicators
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.