[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71KD2Z2ZWQWWYEVV3G2VM3W":3,"skill-same:01M71KD2Z2ZWQWWYEVV3G2VM3W":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":55,"ownerHtmlUrl":56,"ownerBlogUrl":57,"ownerDescription":58,"updatedAt":59,"install":60,"resources":72},"01M71KD2Z2ZWQWWYEVV3G2VM3W","threat-hunting",null,"Use for blue-team threat hunting, detection engineering with Sigma\u002FYARA, SIEM query design, and incident detection validation.","coco-research\u002Fcoco","coco-research","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F68911604?v=4","01M71JRE9C4NM4NSZM4JD0BJTB","Coco Research","01M71JREA0ZMR0PMH3CKA99SN1",631,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Fthreat-hunting\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"threat hunting","hunting","threat","team","blue","for","true","with","incident","query","use","design","blue-team","detection","sigma","yara","engineering","validation","query design","siem","2026-11-10 10:12:30",false,"---\nname: threat-hunting\ndescription: Use for blue-team threat hunting, detection engineering with Sigma\u002FYARA, SIEM query design, and incident detection validation.\nuser-invocable: true\n---\n\n# Threat Hunting & Detection Engineering\n\n## 适用场景\n\n- 威胁狩猎（hypothesis-driven）\n- Sigma \u002F YARA 检测工程\n- 告警调优、误报分析\n- 与 `malware-analysis\u002F`：样本侧 IOC → 本 skill 落地检测\n- 与 `digital-forensics\u002F`：案件伪影 → 横向狩猎\n\n## 工作流\n\n### 1. 建假说\n\n```text\n例：攻击者用 living-off-the-land 做横向\n→ 数据源：Sysmon 1\u002F3\u002F10、Windows Security 4624\u002F4648\n→ 成功标准：发现异常父进程或罕见账户日志源\n```\n\n### 2. 查询与堆叠\n\n```text\n□ 基线：正常管理员行为时段与主机\n□ 异常：新服务、编码 PowerShell、异常出站\n□ 关联：同账号多主机短时登录\n```\n\n### 3. 规则化\n\n```yaml\n# Sigma 骨架见 malware-analysis；本 skill 强调：\n# - 误报面\n# - 数据源字段映射\n# - 响应 playbook 链接\n```\n\n### 4. 验证\n\n```text\n□ 原子测试（Atomic Red Team）仅在授权实验室\n□ 回放历史日志验证召回\n```\n\n## 工具链\n\n| 工具 | 用途 |\n|------|------|\n| Sigma CLI \u002F sigmac | 规则转换 |\n| YARA | 文件\u002F内存 |\n| SIEM（ELK\u002FSplunk 等） | 查询 |\n| osquery | 端点狩猎 |\n| Atomic Red Team | 检测验证（实验室） |\n\n## 参考\n\n- `references\u002Fhunting-loop.md`\n- `..\u002Fmalware-analysis\u002Freferences\u002Fyara-sigma-rules.md`\n- `..\u002Fdigital-forensics\u002F`\n","# Threat Hunting & Detection Engineering\n\n## 适用场景\n\n- 威胁狩猎（hypothesis-driven）\n- Sigma \u002F YARA 检测工程\n- 告警调优、误报分析\n- 与 `malware-analysis\u002F`：样本侧 IOC → 本 skill 落地检测\n- 与 `digital-forensics\u002F`：案件伪影 → 横向狩猎\n\n## 工作流\n\n### 1. 建假说\n\n```text\n例：攻击者用 living-off-the-land 做横向\n→ 数据源：Sysmon 1\u002F3\u002F10、Windows Security 4624\u002F4648\n→ 成功标准：发现异常父进程或罕见账户日志源\n```\n\n### 2. 查询与堆叠\n\n```text\n□ 基线：正常管理员行为时段与主机\n□ 异常：新服务、编码 PowerShell、异常出站\n□ 关联：同账号多主机短时登录\n```\n\n### 3. 规则化\n\n```yaml\n# Sigma 骨架见 malware-analysis；本 skill 强调：\n# - 误报面\n# - 数据源字段映射\n# - 响应 playbook 链接\n```\n\n### 4. 验证\n\n```text\n□ 原子测试（Atomic Red Team）仅在授权实验室\n□ 回放历史日志验证召回\n```\n\n## 工具链\n\n| 工具 | 用途 |\n|------|------|\n| Sigma CLI \u002F sigmac | 规则转换 |\n| YARA | 文件\u002F内存 |\n| SIEM（ELK\u002FSplunk 等） | 查询 |\n| osquery | 端点狩猎 |\n| Atomic Red Team | 检测验证（实验室） |\n\n## 参考\n\n- `references\u002Fhunting-loop.md`\n- `..\u002Fmalware-analysis\u002Freferences\u002Fyara-sigma-rules.md`\n- `..\u002Fdigital-forensics\u002F`\n",{"name":5,"description":7,"user-invocable":49},true,"main","cd89f013b617f7eea982a9bbc60e992974fda2aa","systems\u002Freverse-skill\u002Fskills\u002Fthreat-hunting",15,"https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco","https:\u002F\u002Fcocoresearch.org\u002Fcoco\u002F","https:\u002F\u002Fgithub.com\u002Fcoco-research","https:\u002F\u002Fcocoresearch.org","Local-first, open-source tools for people who work with AI agents: governed memory, agents that check their own work, and data that stays on your machine.","2026-11-11 12:18:13",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":49},[62,65,68],{"tool":63,"command":64},"npx","npx skills add coco-research\u002Fcoco --skill threat-hunting",{"tool":66,"command":67},"bunx","bunx skills add coco-research\u002Fcoco --skill threat-hunting",{"tool":69,"command":70},"pnpm","pnpm dlx skills add coco-research\u002Fcoco --skill threat-hunting","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Fthreat-hunting\u002FSKILL.md",[73],{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fhunting-loop.md","REFERENCE","参考文档",181,"https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Fthreat-hunting\u002Freferences\u002Fhunting-loop.md",[80,104,114,132,166,185],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":87,"publishedAt":44},"01M71KEJXF9KMT0BWCMRSRFA4M","trading-super-intelligence","Trading Super Intelligence Team. Named real-world personas across 8 cells. Built local-first (LM Studio) and validator-gated. Illustrative composites; see DISCLAIMER.md.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Ftrading\u002FSKILL.md",[86],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[88,89,90,91,92,93,94,95,96,27,97,98,99,100,101,102,103],"super","trading super intelligence","intelligence","trading","validator","personas","local","composites","studio","across","world","first","gated","2026","lm studio","local-first",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":111,"publishedAt":44},"01M71KEFWS3CMAP7DF1P0FWTDE","strategy-super-intelligence","Strategy Super Intelligence Team. Named real-world personas across 7 cells. Built local-first (LM Studio) and validator-gated. Illustrative composites; see DISCLAIMER.md.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Fstrategy\u002FSKILL.md",[110],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[112,88,113,90,92,93,94,95,96,27,97,98,99,100,101,102,103],"strategy","strategy super intelligence",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":126,"publishedAt":44},"01M71KED56ZEPK2QE84QSQPMT0","risk-compliance-super-intelligence","Risk & Compliance (GRC) Super Intelligence Team. Named real-world personas across 7 cells. Built local-first (LM Studio) and validator-gated. Illustrative composites; see DISCLAIMER.md.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Frisk-compliance\u002FSKILL.md",[120,121],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":124,"taxonomyTypeDesc":125},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[127,88,128,129,130,90,92,93,94,95,131,96,27,97,98,99,100,101,102,103],"risk","risk compliance super intelligence","compliance","risk compliance","grc",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":151,"publishedAt":44},"01M71KE9A2FWSC74VA96W1EZSN","product-design-super-intelligence","Your product + design brain trust and decision partner. Named personas across 8 cells spanning product strategy, discovery\u002Fresearch, growth\u002Fmetrics, design foundations\u002Fusability, design leadership\u002Fcraft, UX\u002Fcontent, design systems, and a…","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Fproduct-design\u002FSKILL.md",[138,141,144,145,148],{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":142,"categoryName":143,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":146,"categoryName":147,"taxonomyType":124,"taxonomyTypeDesc":125},"01JBSEEDCAT000000000000031","产品经理",{"categoryNo":149,"categoryName":150,"taxonomyType":124,"taxonomyTypeDesc":125},"01JBSEEDCAT000000000000032","设计师",[35,152,90,153,88,154,155,156,157,158,159,27,97,160,161,101,162,163,164,165],"product","product design","product design super intelligence","foundations","product-design","decision","design systems","usability","leadership","ux","brain","craft","metrics","trust",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":174,"publishedAt":44},"01M71KE6H9FPSD9TECYFBPXZ8Y","legal-ip-super-intelligence","Your legal, IP, and regulatory brain trust. 31 named personas across 7 cells covering patent strategy, tech licensing, regulatory litigation, AI governance, open-source compliance, privacy law, and antitrust.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Flegal-ip\u002FSKILL.md",[172,173],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":124,"taxonomyTypeDesc":125},[175,88,176,90,177,178,165,179,93,180,181,182,112,27,97,183,129,184,101,162],"ip","legal ip super intelligence","legal","sep","tech","litigation","ai governance","open","open-source","governance",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":192,"publishedAt":44},"01M71KE36QRY610V6YVB9JWRND","healthcare-life-sciences-super-intelligence","Your healthcare and life sciences brain trust. 25 named personas across 7 cells covering drug discovery, medtech, biotech strategy, health policy, genomics, clinical trials, and healthcare economics.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Fhealthcare-life-sciences\u002FSKILL.md",[191],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[193,88,194,195,90,178,165,196,197,93,198,199,112,27,97,200,201,202,203,101],"healthcare","healthcare life sciences super intelligence","life","economics","discovery","policy","clinical","clinical trials","health","trials","genomics"]