Threat Hunting & Detection Engineering

When to Use

• Proactively hunting for adversary activity in telemetry.
• Writing or validating detection rules mapped to ATT&CK techniques.

适用场景

• 威胁狩猎（hypothesis-driven）
• Sigma / YARA 检测工程
• 告警调优、误报分析
• 与 malware-analysis/：样本侧 IOC → 本 skill 落地检测
• 与 digital-forensics/：案件伪影 → 横向狩猎

工作流

1. 建假说