hunt gen

hunt-gen.md

argument-hint	<threat report URL>
allowed-tools	Bash Read Write WebFetch

Threat-Informed Hunt Generator

Ingest a threat report, extract TTPs, check what data sources are actually available in Splunk, and generate executable hunt queries scoped to your environment. Techniques with no matching data are flagged as blind spots.

Input

$ARGUMENTS contains the URL to the threat report.

If no URL is provided, ask the user for one.

Configuration

SPLUNK_URL   — from $SPLUNK_URL
SPLUNK_TOKEN — from $SPLUNK_TOKEN
ATTACK_JSON  — /home/anton/Desktop/claudeforblueteam/enterprise-attack.json
VAULT        — Obsidian Vault

Verify $SPLUNK_URL and $SPLUNK_TOKEN exist. If token auth fails, fall back to -u condef:Temp1234!!.

Workflow

Step 1 — Fetch and parse threat report

Extract the article content:

defuddle "<URL>" 2>/dev/null || echo "DEFUDDLE_FAILED"

If defuddle fails, use WebFetch to get the content.

Read the full article text. Extract:

• Report title
• Threat actor / campaign name (if mentioned)
• All MITRE ATT&CK technique IDs referenced (T1xxx, T1xxx.xxx format)
• If no technique IDs are explicit, infer them from described behaviors (e.g., "dumped LSASS" → T1003.001, "scheduled task for persistence" → T1053.005)

List all extracted techniques with their ATT&CK names.

Step 2 — Get data components for each technique

For each technique ID, query enterprise-attack.json for its data sources:

jq -r --arg tid "T1003.001" '
  .objects[]
  | select(.type=="attack-pattern")
  | select(.external_references[]?.external_id==$tid)
  | .x_mitre_data_sources[]?
' /home/anton/Desktop/claudeforblueteam/enterprise-attack.json

This returns strings like "Process: Process Access", "Process: OS API Execution". Collect all data components per technique.

Step 3 — Discover available Splunk data sources

Run these queries in parallel to build the picture of what data is actually in Splunk:

3a. Sourcetype and index inventory

curl -s -k \
  -H "Authorization: Bearer $SPLUNK_TOKEN" \
  -d "search=search index=* earliest=-7d latest=now | stats count by index sourcetype | sort -count" \
  -d "output_mode=json" \
  -d "exec_mode=oneshot" \
  -d "count=0" \
  "$SPLUNK_URL/services/search/jobs/export" > /tmp/hunt_sourcetypes.json

3b. Available EventCodes (Windows/Sysmon)

curl -s -k \
  -H "Authorization: Bearer $SPLUNK_TOKEN" \
  -d "search=search index=sysmon OR index=winlogs earliest=-7d latest=now | stats count by index source EventCode | sort -count" \
  -d "output_mode=json" \
  -d "exec_mode=oneshot" \
  -d "count=0" \
  "$SPLUNK_URL/services/search/jobs/export" > /tmp/hunt_eventcodes.json

3c. Accelerated data models

curl -s -k \
  -H "Authorization: Bearer $SPLUNK_TOKEN" \
  -d "search=| rest /servicesNS/-/-/data/models | where acceleration=1 | table title" \
  -d "output_mode=json" \
  -d "exec_mode=oneshot" \
  "$SPLUNK_URL/services/search/jobs/export" > /tmp/hunt_datamodels.json

Parse all three result files. Build a summary:

• List of indexes and sourcetypes with event counts
• List of EventCodes present (by index)
• List of accelerated data models

Step 4 — Map techniques to available data

For each technique, use this mapping to determine if the required data components have matching EventCodes in Splunk:

Data Component → EventCode mapping:

Data Component	Sysmon EID	Windows Security EID	Notes
Process: Process Creation	1	4688	Requires command line logging for 4688
Process: Process Access	10	—	LSASS access, injection detection
Process: Process Termination	5	4689
Process: OS API Execution	—	—	Requires ETW, rarely available
Network Traffic: Network Connection Creation	3	5156
Network Traffic: Network Traffic Flow	3	5156
File: File Creation	11	—
File: File Modification	2	—
File: File Deletion	23, 26	—	Sysmon 23=FileDelete, 26=FileDeleteDetected
Windows Registry: Registry Key Modification	13	4657
Windows Registry: Registry Key Creation	12	—
Command: Command Execution	1	4688, 4104	Script Block Logging for PS
Module: Module Load	7	—	DLL loading
Named Pipe: Pipe Creation	17	—
Named Pipe: Pipe Connection	18	—
WMI: WMI Creation	19, 20, 21	—
DNS: DNS Query	22	—
Driver: Driver Load	6	—
Image: Image Load	7	—	Same as Module Load
Logon Session: Logon Session Creation	—	4624
User Account: User Account Authentication	—	4625, 4776	Failed auth
User Account: User Account Modification	—	4738
Active Directory: Active Directory Object Modification	—	5136, 5137
Scheduled Task: Scheduled Task Creation	—	4698
Service: Service Creation	—	7045
Firewall: Firewall Rule Modification	—	4946, 4947

For each technique, classify:

• HUNTABLE — at least one primary data component has matching EventCodes in Splunk
• PARTIAL — some data components available, others missing
• BLIND — no matching data sources found in Splunk

Step 5 — Generate hunt queries

For each HUNTABLE or PARTIAL technique, generate an SPL query. Follow these rules:

1. Use the correct index and EventCode from the Step 3 discovery (don't guess — use what was actually found)
2. Include technique-specific filters based on your knowledge of the technique's behavior:
   • T1003.001 → TargetImage contains lsass.exe, suspicious GrantedAccess values
   • T1053.005 → schtasks.exe or at.exe in CommandLine
   • T1059.001 → PowerShell indicators in ScriptBlockText or CommandLine
   • T1021.002 → SMB lateral movement indicators
   • etc.
3. Exclude known-good baseline where possible (e.g., exclude common system processes accessing LSASS)
4. Use tstats if an accelerated data model covers the technique (check Step 3c results). Use the CIM field names with rename:

   | tstats count from datamodel=Authentication.Authentication where Authentication.action="failure" by Authentication.user Authentication.src
   | rename Authentication.user as user Authentication.src as src
   

5. Include a comment header with the technique ID, name, and data source being used
6. End with stats to aggregate results for analyst review (stats count by key fields)

Step 6 — Run hunt queries

For each generated query, run it against Splunk and collect results:

curl -s -k \
  -H "Authorization: Bearer $SPLUNK_TOKEN" \
  -d "search=search <QUERY>" \
  -d "output_mode=json" \
  -d "exec_mode=oneshot" \
  -d "earliest_time=-7d" \
  -d "latest_time=now" \
  -d "count=50" \
  "$SPLUNK_URL/services/search/jobs/export" > /tmp/hunt_<TID>.json

Parse the NDJSON results. For each query, record:

• Number of results
• Key findings (top values, suspicious entries)
• Whether anything warrants further investigation

If a query returns zero results, that's a valid finding — "no evidence of this technique in the last 7 days."

Step 7 — Write hunt plan to Obsidian

Build the Obsidian note with all findings:

obsidian create vault="Obsidian Vault" name="Hunt Plan — <REPORT_TITLE> — $(date +%Y-%m-%d)" overwrite content="..."

Note structure:

---
threat_report: "<URL>"
report_title: "<title>"
threat_actor: "<actor or Unknown>"
scan_date: YYYY-MM-DD
techniques_extracted: N
huntable: N
partial: N
blind: N
findings: N
tags:
  - hunt
  - threat-intel
  - <actor-tag>
---

# Threat-Informed Hunt Plan — <REPORT_TITLE>

> [!info] Source: <report title>
> Extracted N ATT&CK techniques. N huntable with current SIEM data, N partial coverage, N blind spots.
> Hunt window: last 7 days. Splunk indexes: <list indexes with data>.

## Available Data Summary

| Index | Sourcetype | Events (7d) |
|-------|-----------|------------|
| sysmon | XmlWinEventLog:Microsoft-Windows-Sysmon/Operational | N |
| winlogs | XmlWinEventLog:Security | N |
...

Accelerated data models: <list>

## Hunt Results

### T1003.001 — OS Credential Dumping: LSASS Memory
**Status:** HUNTABLE
**Data:** Sysmon EID 10 (ProcessAccess) — N events in last 7d
**Confidence:** High

\`\`\`spl
<generated query>
\`\`\`

> [!success] No suspicious LSASS access found
OR
> [!warning] N suspicious events found — review below

<results table if any>

---

### T1059.001 — PowerShell
**Status:** PARTIAL
**Available:** Script Block Logging (EID 4104)
**Missing:** Module Logging (EID 4103)

\`\`\`spl
<generated query>
\`\`\`

> [!success] No suspicious PowerShell activity
OR
> [!warning] N events with suspicious indicators

---

## Coverage Gaps

> [!danger] Cannot hunt for these techniques with current data

| Technique | Required Data | Missing | Remediation |
|-----------|--------------|---------|-------------|
| T1055.001 | Process: OS API Execution | No ETW/API tracing | Enable Sysmon EID 8 (CreateRemoteThread) as partial coverage |
| T1070.004 | File: File Deletion | Sysmon EID 23 not present | Add FileDelete to Sysmon config |

## Summary

- **Techniques extracted:** N from "<report title>"
- **Huntable:** N — queries generated and executed
- **Partial:** N — queries generated with noted gaps
- **Blind spots:** N — cannot detect with current data
- **Findings requiring review:** N

Step 8 — Summary

Report to the user:

1. Report title and actor
2. Techniques extracted count
3. Huntable / partial / blind breakdown
4. Any findings that need attention (non-zero results)
5. Top coverage gaps with remediation suggestions
6. Confirm Obsidian note written