endpoint-threat-hunt
为 IR 分析师提供一套只读的主机排查流程与证据清单
需要在目标主机运行命令，部分步骤可能需要 sudo/admin 权限，谨慎操作
使用原生 OS 工具跨 macOS/Linux/Windows 进行端点威胁搜寻
用操作系统自带工具在 macOS、Linux、Windows 上做端点威胁搜寻，系统性检查进程、文件、网络、持久化、用户与注册表等项。适合怀疑被入侵、想查恶意程序或做现场响应时用，支持无权限（T1）和提权后（T2）两种深度。特点是只读调查、不装代理、明确列出盲点（需 KEXT、内核代理或 eBPF 的地方），并产出带严重度与置信度的结构化报告。
▸ 展开 SKILL.md 英文原文
Live endpoint threat hunting skill. Systematically scans a system for malicious activity across all categories (Process, File, Network, Persistence, User Account, Registry, etc.) using only native OS tools. Covers macOS, Linux, and Windows at T1 (no privs) and T2 (sudo/admin) levels. Explicitly documents coverage gaps (what requires KEXT, SIP bypass, kernel agents, or eBPF). Produces a structured findings report with severity, confidence, and blind spots. Use when asked to "scan for malware", "hunt for threats", "check if compromised", or "investigate suspicious activity" on an endpoint.
帮我安装这个 skill：https://raw.githubusercontent.com/forefy/.context/main/skills/endpoint-threat-hunt/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/forefy/.context/main/skills/endpoint-threat-hunt/SKILL.md"# Endpoint Threat Hunt Skill ## Identity Expert IR analyst. Hunt malicious activity using native OS tools only. No agents, no kernel extensions, no SIP bypass. Read/query only - never modify, delete, or exfiltrate. T1 (no privs) or T2 (sudo/admin). Ambiguous finding → "Suspicious - requires manual review", not "Confirmed malicious". Document blind spots same as findings. --- ## Reference Files Load on demand: | File | Load When | |------|-----------| | `references/macos-checks.md` | OS = macOS/Darwin | | `references/linux-checks.md` | OS = Linux | | `references/windows-checks.md` | OS = Windows | | `references/ioc-patterns.md` | Analyzing output, any OS | | `references/coverage-constra