Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dslsdzc/rev-skills --skill re-huntinggit clone --depth 1 https://github.com/dslsdzc/rev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dslsdzc/rev-skills/re-hunting)<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-hunting"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-hunting/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dslsdzc/rev-skills/re-hunting"><img src="https://agentmods.dev/badge/skills/dslsdzc/rev-skills/re-hunting.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.02815 |
| Opus 5 | $0.00032 | $0.01407 |
| Sonnet 5 | $0.00013 | $0.00563 |
| Haiku 4.5 | $0.00006 | $0.00281 |
Grade A, and why
re-hunting scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
威胁狩猎
何时使用 / 何时不用
- 用：主动狩猎请求（「环境里有没有 X 的活动」）、假设驱动的环境排查、威胁情报落地（情报线索转环境内搜索）
- 用：基线驱动的异常发现（无特定情报时先建基线再找偏离）
- 用：事件后扩大排查（一次确认命中 → 同 TTP/同基础设施再查一遍，找漏网）
- 用：告警驱动追溯（一次告警 → 反向狩猎同类未告警行为，找漏网）
- 不用：纯合规巡检（无假设的定期报表是运营不是狩猎，两者流程不同）
- 不用：已知样本分析（[[re-behavior]]）；IOC 查询（[[re-ti]]）；单点证据深挖（各域技能）
- 不用：应急响应单点处置（狩猎是主动面，应急是被动触发，结论可互哺但流程不同）
- 不用：无遥测来源时（数据源缺失无法支撑假设验证，先补齐采集再狩猎，见 [[gotchas]]）
- 不用：设备/主机级单点排查（那是各域技能的事，狩猎面向环境整体）
工具准备
日志分析工具（通用）
- 多平台: jq / grep / awk（各发行版自带或
apt install jq/brew install jq） - 验证:
jq --version - python3（基线统计/聚类脚本）：安装见 [[re-python]] 工具准备
- 快速频次统计：
grep -E+sort | uniq -c（基线初版可用）
遥测查询（按环境）
- SIEM/EDR 查询接口（按部署环境给查询指引，工具不绑定）
- 本地日志:
journalctl（Linux，结构化过滤：journalctl -o json --since "24 hours ago" | jq ...）；PowerShellGet-WinEvent（Windows，如Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 100） - 网络遥测: 流量/防火墙日志（深挖见 [[re-netcap]]）
- Windows 常用事件 ID（按环境实际启用情况核对）：4624/4625 登录成功/失败、4688 进程创建、Sysmon 1 进程创建、Sysmon 11 文件创建
ATT&CK 导航（假设对齐参考）
- 网页工具（公开访问）；本地可下载 Navigator 层文件；规则匹配格式可参考 Sigma（公开规则格式，按环境适配）
- 覆盖对照：结束后用 Navigator 层标记已覆盖技术，产出覆盖率声明（与盲区对照）
操作步骤
按顺序执行；假设明确再动手（坑 5）。每步产物存档（路径 + sha256，见 [[re-triage]]）。
-
狩猎假设生成：
- 输入：威胁情报（[[re-ti]]）、已知攻击模式（[[re-behavior]] 经验）、环境特征（暴露面/业务/历史事件）、红队/演练报告（已知成功路径优先查）
- 假设句式：「攻击者可能通过 X 技术在环境内做了 Y」——X 对齐 ATT&CK 技术，Y 是可观测的遥测痕迹
- 可证伪性检查：每个假设写得出「若为假应看到什么」（反证形态），写不出的不查
- 情报可检测性映射：情报的每条 IOC/TTP 都要回答「在环境里对应哪个遥测痕迹」；对不上的列为盲区假设
- 优先级：影响 × 可能性 × 可检测性（三者都低的不值得查）
- 假设数量控制：单轮 3-5 个高优先级假设（过多则无法深入验证）
- 假设卡片：编号/句式/来源情报/遥测痕迹/反证形态/优先级
- 产出：假设列表（每个假设 = 可证伪的搜索目标；按技术族覆盖多假设，避免单点）
-
遥测源选择：
-
按假设选数据源：进程行为 → EDR/进程日志（Windows 4688/Sysmon 1）；网络 → 流量/防火墙日志；登录 → 认证日志（4624/4625）；文件 → 文件系统监控（Sysmon 11）
-
数据源缺失 → 标注盲区（结论的有效性边界，见 [[gotchas]] 盲区坑）
-
同一假设有多个数据源时先查覆盖最全的，再交叉验证
-
先验证遥测管道健康（收一条已知测试事件），再信「无告警」
-
时间归一：各数据源时间戳统一为 UTC 与同格式（ISO8601），跨源比较前先做
-
数据源映射示例（按环境核对实际事件 ID）：
假设侧重 数据源 事件/日志 缺失时 进程/执行 EDR、进程日志 4688、Sysmon 1 无法验证执行链 网络外联 流量/防火墙/代理 连接日志/NetFlow 无法验证外联行为 登录/凭据 认证日志 4624/4625 无法验证撞库/横向 文件落地 文件系统审计 Sysmon 11 无法验证投放
-
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 120 lines · 63 tokens per session scan A 89b5b8cf2003
re-hunting is a skill published in the GitHub repository dslsdzc/rev-skills (52 stars, last pushed 13d ago), licensed Apache-2.0. It adds 63 tokens to every session and 2,815 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
Reverse Engineering & Binary Analysis
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
reverse-engineering-binaries-with-ghidra
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
reverse-engineering-shellcode
Analyzes position-independent shellcode: disassembling raw bytes at the right architecture, recognizing PEB-walk API resolution and egg hunters, and emulating execution to recover behavior and payloads. Activates for requests to analyze shellcode, disassemble raw position-independent code, or emulate a shellcode blob.