Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/briiirussell/cybersecurity-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/briiirussell/cybersecurity-skills/threat-hunting)<a href="https://agentmods.dev/rules/briiirussell/cybersecurity-skills/threat-hunting"><img src="https://agentmods.dev/badge/rules/briiirussell/cybersecurity-skills/threat-hunting/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/briiirussell/cybersecurity-skills/threat-hunting"><img src="https://agentmods.dev/badge/rules/briiirussell/cybersecurity-skills/threat-hunting.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00123 | $0.02758 |
| Opus 5 | $0.00062 | $0.01379 |
| Sonnet 5 | $0.00025 | $0.00552 |
| Haiku 4.5 | $0.00012 | $0.00276 |
Grade C, and why
threat-hunting scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Cloud metadata endpointhighServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
- **IMDS access from unusual processes / containers** — anything reaching `169.254.169.254` that isn't the cloud SDK How it starts
The opening of the file, as written. The whole thing — 226 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Threat Hunting — Proactive Adversary Detection
Hunt for adversaries who are already inside but haven't tripped an alert. Distinct from incident-triage (reactive, alert is firing) and from siem-detection (engineer rules so future alerts fire). This skill is the proactive layer — assume something has slipped through, look for it.
Hunting is hypothesis-driven, not browse-driven. "Let's look around the SIEM" is not hunting; "let's check for the specific pattern of T1059.001 (PowerShell) being launched by Office processes" is.
Cross-references: siem-detection (queries you write here often graduate to detection rules), incident-triage (what to do if a hunt confirms a finding), breach-patterns (a rich source of hunt hypotheses), disk-forensics (deeper analysis on confirmed hits).
Methodology — PEAK framework
The PEAK (Prepare, Execute, Act, Knowledge) framework from Splunk SURGe — the most actionable hunting methodology I've seen.
Step 1: Prepare
Form the hypothesis. Strong hypotheses share three properties:
- Specific — names a technique, log source, and expected artifact
- Testable — describes what evidence would confirm or deny
- Bounded — has a defined time window and scope
Bad hypothesis: "Look for anomalies in the SIEM"
Good hypothesis: "Within the last 30 days, no service account should have run interactive PowerShell with -encodedCommand flag (T1059.001 + T1027). Search Sysmon event 1 for parent process = service-account-launched scheduled task, child = powershell.exe, command line contains -enc or -encodedcommand."
Hunt hypothesis sources, ranked by yield:
| Source | Yield | Effort |
|---|---|---|
| Recent incident (yours or peer's) | High | Low — pattern is concrete |
breach-patterns skill catalog |
High | Low — generalizes from public breaches |
| MITRE ATT&CK technique you don't have a detection for | Medium | Medium — read the technique, design the hunt |
| Threat intel report (CrowdStrike, Mandiant, vendor reports) | Medium | Medium — current patterns |
| Anomaly: "this number went up — why" | Low | Low — often FP, occasionally gold |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 226 lines · 123 tokens per session scan C 1f975dea9832
threat-hunting is a cursor rule published in the GitHub repository briiirussell/cybersecurity-skills (387 stars, last pushed 3mo ago), licensed MIT. It adds 123 tokens to every session and 2,758 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it C with 1 finding (cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
control-plane-descriptors
Control plane descriptor and instance implementation patterns.