Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gensecaihq/Wazuh-Autopilot --skill threat-huntinggit clone --depth 1 https://github.com/gensecaihq/Wazuh-AutopilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/threat-hunting)<a href="https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/threat-hunting"><img src="https://agentmods.dev/badge/skills/gensecaihq/wazuh-autopilot/threat-hunting/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/threat-hunting"><img src="https://agentmods.dev/badge/skills/gensecaihq/wazuh-autopilot/threat-hunting.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01164 |
| Opus 5.5 | $0.00022 | $0.00466 |
| Sonnet 5 | $0.00011 | $0.00233 |
| Haiku 4.5 | $0.00005 | $0.00116 |
Grade A, and why
threat-hunting scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Threat Hunting
Hunting assumes the attacker got past existing detections. NIST CSF 2.0 DE.CM / DE.AE — continuous monitoring and analysis beyond alert-driven work.
PEAK framework (Prepare → Execute → Act with Knowledge)
Three hunt types:
- Hypothesis-driven — test a specific idea about attacker behaviour.
- Baseline — characterize normal, then examine outliers (e.g. rare processes, rare parent-child pairs, rare outbound destinations).
- Model-assisted — use analytics/aggregation (
analyze_alert_patterns,get_alerts_aggregated) to surface anomalies for human-style review.
TaHiTI (Targeted Hunting integrating Threat Intelligence) adds: start hunts from current threat intel, and feed results back into intel and detection.
Hypothesis template
Hypothesis: <actor behaviour> is occurring on <scope> and would appear as <observable> in <data source>.
ATT&CK: <technique id>
Data: <Wazuh rule groups / fields>
Time range: <e.g. 14d>
Success criteria: <what confirms / refutes>
Example: "An attacker has established persistence via cron on Linux servers; this would appear as FIM or audit events on /etc/cron* or /var/spool/cron outside change windows (T1053.003), last 14 days."
Hunt catalog (starting points)
| Hunt | Technique | Query idea |
|---|---|---|
| Cron/systemd persistence | T1053.003, T1543.002 | FIM events (rule_groups=["syscheck"], rules 550, 554) on cron/systemd paths, aggregated by host |
| New local accounts | T1136.001 | rule 5902 (useradd) and rule 60109 (Event ID 4720) outside provisioning systems |
| Log clearing | T1070.001/.002 | Event ID 1102 / Event ID 104; FIM rule 553 or size drops on /var/log files |
| Encoded PowerShell | T1059.001, T1027 | Sysmon Event ID 1 / Event ID 4688 command lines containing -enc (rule_groups=["sysmon_eid1_detections"]); load wazuh-windows-sysmon |
| Rare outbound destinations | T1071 | aggregate firewall/proxy destinations, look at count = 1–2 |
| SSH key additions | T1098.004 | FIM (rules 550, 554) on authorized_keys, only if monitored; see wazuh-fim-investigation |
| Web shells | T1505.003 | FIM adds of script files in web roots |
| Password spraying (low and slow) | T1110.003 | auth failures (rules 5710, 5716, 60122) by source across ≥ 10 users over 7d; composite rules may never fire |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 84 lines · 54 tokens per session scan A 84fe81135d1c
threat-hunting is a skill published in the GitHub repository gensecaihq/Wazuh-Autopilot (57 stars, last pushed 2d ago), licensed MIT. It adds 54 tokens to every session and 1,164 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.
Other skills, from other repositories
agent-crdt-synchronizer
Agent skill for crdt-synchronizer - invoke with $agent-crdt-synchronizer.
agent-topology-optimizer
Agent skill for topology-optimizer - invoke with $agent-topology-optimizer.
agent-benchmark-suite
Agent skill for benchmark-suite - invoke with $agent-benchmark-suite.
agent-performance-monitor
Agent skill for performance-monitor - invoke with $agent-performance-monitor.
agent-resource-allocator
Agent skill for resource-allocator - invoke with $agent-resource-allocator.
agentic-jujutsu
Quantum-resistant, self-learning version control for AI agents with ReasoningBank intelligence and multi-agent coordination.