A security utility to map known malicious SHA256 hashes to active processes and network connections on endpoints.
Install
mkdir -p .claude/skills/hunt-hashes && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/19554" && unzip -o skill.zip -d .claude/skills/hunt-hashes && rm skill.zipInstalls to .claude/skills/hunt-hashes
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
hunt-hashes — an agent skill by op7ic.Key capabilities
- →Correlate SHA256 hashes with process command-line arguments
- →Identify network connections associated with specific file hashes
- →Export hunt results to CSV format
- →Combine multiple hash sets for broader hunting
- →Detect LOLBIN abuse and hacking tool execution
How it works
The skill uses Python scripts to map SHA256 hashes against process execution data and network connection logs to identify suspicious activity.
Inputs & outputs
When to use hunt-hashes
- →Identify hacking tool execution
- →Detect LOLBIN abuse
- →Trace network connections from suspicious files
- →Export hunt results to CSV
- →Check for Mimikatz activity
About this skill
Hunt: Hash-Based IOC Hunting
Description
Search for known malicious or suspicious file hashes across all endpoints. Maps SHA256 hashes to process executions with command-line arguments and network connections. Use when you have specific IOC hashes or want to detect known offensive tools.
Scripts
- hash2processarg.py - Find processes matching SHA256 hashes + their command-line arguments
- hash2connection.py - Find network connections associated with specific file hashes
Usage
Hunt by Process Arguments
# Hunt for a specific tool's hashes
python3 hash2processarg.py -c config.txt hashset/hacking-tools/mimikatz.txt
# Hunt for LOLBIN abuse (e.g., certutil used for downloads)
python3 hash2processarg.py -c config.txt hashset/windows-binaries/certutil.exe.txt
# Export to CSV
python3 hash2processarg.py -c config.txt hashset/windows-binaries/cmd.exe.txt --csv cmd_activity.csv
Hunt by Network Connections
# Find network connections from known hacking tools
python3 hash2connection.py -c config.txt hashset/hacking-tools/mimikatz.txt
# Check if PsExec made network connections
python3 hash2connection.py -c config.txt hashset/psexec/psexec.exe.txt --csv psexec_net.csv
Available Hash Sets
Hacking Tools (hashset/hacking-tools/)
BeRoot, EchoMirage, GhostPack, LaZagne, LaZagneForensic, PoshC2, PowerSCCM, PowerSploit, SharpCollection, burp, fget.exe, impacket, l0pht, metasploit (C/C++, class, DLL/EXE/PS1), netcat, npf.sys, responder, and more.
Windows LOLBINS (hashset/windows-binaries/)
81 binaries including: at.exe, bitsadmin.exe, certutil.exe, cmd.exe, cmstp.exe, csc.exe, cscript.exe, msbuild.exe, mshta.exe, powershell.exe, psexec.exe, reg.exe, regsvr32.exe, rundll32.exe, schtasks.exe, wmic.exe, wscript.exe, and more.
Other Categories
- hashset/exploits/ - Windows/Linux kernel exploits, Exploit-DB
- hashset/psexec/ - PsExec variants (psexec.exe, psexec64.exe, psexesvc.exe)
- hashset/windows-dll/ - 11 DLLs commonly abused
- hashset/sysinternals/ - Sysinternals suite
- hashset/putty_plink/ - SSH/tunneling tools
- hashset/teamviewer/ - Remote access
- hashset/msoffice/ - Office binaries
Combining Hash Sets
# Combine multiple sets for broader hunting
cat hashset/hacking-tools/mimikatz.txt hashset/hacking-tools/LaZagne.txt > combined_cred_tools.txt
python3 hash2processarg.py -c config.txt combined_cred_tools.txt --csv cred_hunt.csv
When to Use
- Hunting for known malware/tool execution
- Detecting LOLBIN abuse
- Searching for specific IOC hashes from threat intel
- Investigating tool deployment across environment
Follow-Up Skills
- If process args reveal encoded commands ->
hunt-keywordswith decoded content - If network connections found ->
hunt-networkfor broader analysis - If credential tools detected ->
hunt-credentialsfor focused hunt
Prerequisites
Limitations
- →Requires specific IOC hashes or hash sets
- →Limited to the provided hash set categories
How it compares
This approach automates the correlation of IOC hashes with system-level process and network data, which would otherwise require manual cross-referencing.
Compared to similar skills
hunt-hashes side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| hunt-hashes (this skill) | 0 | 3mo | Review | Intermediate |
| senior-security | 31 | 7mo | Review | Advanced |
| security-header-generator | 5 | 8mo | Caution | Intermediate |
| backend-security-coder | 24 | 3mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
senior-security
davila7
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
security-header-generator
Dexploarer
Generates security HTTP headers (CSP, HSTS, CORS, etc.) for web applications to prevent common attacks. Use when user asks to "add security headers", "setup CSP", "configure CORS", "secure headers", or "HSTS setup".
backend-security-coder
sickn33
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
security-audit
ruvnet
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement. Use when: authentication implementation, authorization logic, payment processing, user data handling, API endpoint creation, file upload handling, database queries, external API integration. Skip when: read-only operations on public data, internal development tooling, static documentation, styling changes.
security-best-practices
openai
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
pcap-analysis
benchflow-ai
Guidance for analyzing network packet captures (PCAP files) and computing network statistics using Python, with tested utility functions.