Results for “detection”

Expert in temporal event detection, spatio-temporal clustering (ST-DBSCAN), and photo context understanding. Use for detecting photo events, clustering by time/location, shareability prediction, place recognition, event significance scoring, and life event detection. Activate on 'event detection', 'temporal clustering', 'ST-DBSCAN', 'spatio-temporal', 'shareability prediction', 'place recognition', 'life events', 'photo events', 'temporal diversity'. NOT for individual photo aesthetic quality (use photo-composition-critic), color palette analysis (use color-theory-palette-harmony-expert), face recognition implementation (use photo-content-recognition-curation-expert), or basic EXIF timestamp extraction.

The English summary is being prepared. Showing the original description.

Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation. Use when enabling audit policies for logon events, process creation, privilege use, and object access to feed SIEM detection rules. Activates for requests involving Windows audit policy, event log configuration, security logging, or detection-oriented logging.

The English summary is being prepared. Showing the original description.

Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection.

The English summary is being prepared. Showing the original description.

Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.

The English summary is being prepared. Showing the original description.

Prepare market history for pattern detection and comparison. Import opening, high, low, and closing prices plus volume, validate and normalize the values, then store them by symbol and date for later retrieval. It does not place orders.

• Loading price and volume history for a symbol
• Preparing market data for pattern detection
• Normalizing data before comparing price movements

Investigate signs of intrusion through hypothesis-led log searches, then turn findings into detection rules. Supports Sigma, YARA, and SIEM queries, with attention to false positives, data field mapping, and validation against historical logs.

• Hunting for intrusion signs in security logs
• Turning findings into Sigma or YARA rules
• Investigating false positives and tuning alerts

Detect attacks that misuse legitimate Windows utilities such as certutil and mshta. Analyze process logs, command arguments, and parent-child relationships with Sigma detection rules, then report suspicious events with severity scores and supporting event details.

• Investigating suspicious use of built-in Windows utilities
• Creating Sigma rules for unusual command arguments
• Finding Office apps that launch unexpected system utilities

Investigate signs of Mimikatz credential theft using command lines, access to Windows authentication memory, file indicators, and known modules in memory. Correlate endpoint and security logs to assess suspicious alerts, document evidence, and recommend response actions.

• Investigating alerts about Windows authentication memory access
• Hunting for signs of credential theft
• Assessing compromise scope during incident response

Investigate stolen Kerberos tickets, authentication credentials that can be reused without a password, by correlating Windows security events. Build Splunk or Elastic detection rules for cross-host reuse, weaker encryption, and unusual request volumes, and report risk-scored findings.

• Investigating suspected reuse of stolen Kerberos tickets
• Building Splunk or Elastic detection rules
• Finding unusual ticket request volumes

Investigate compromised credentials across AWS, Azure, and GCP by correlating security alerts and audit logs. Examines unusual API activity and suspicious sign-ins, helps assess the affected scope, and guides containment actions such as disabling keys and revoking sessions.

• Investigate cloud API activity from unfamiliar locations
• Assess exposure after a credential leak notification
• Correlate suspicious sign-ins across cloud providers

Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.

• Investigating suspicious additions of application credentials
• Reviewing privileged roles assigned to application identities
• Building detection rules for Entra ID identity abuse

Create and tune Falco rules to detect possible container escapes, where a container gains access to its host. Define detection conditions, alert priorities, and output fields, then refine exceptions to reduce false positives.

• Writing rules for suspicious host filesystem access
• Investigating noisy container escape alerts
• Reusing detection conditions through macros and lists

Analyze DNS logs to find signs of hidden data transfers. Use query length, character randomness, traffic volume, and response sizes to identify suspicious domains and support monitoring rules with Python, Suricata, and Splunk examples.

• Investigating possible data theft through DNS traffic
• Ranking suspicious domains found in DNS logs
• Creating DNS tunneling detection rules

Deploy decoy credentials, documents, and URLs with Canarytokens to detect suspicious access. Guides token generation, placement, alert testing, and inventory tracking, with email or webhook notifications when someone interacts with a planted token.

• Add intrusion alerts to shared folders
• Detect use of decoy cloud credentials
• Monitor decoy documents for signs of data theft

Conduct authorized WiFi security assessments covering authentication, encryption, rogue access points, and network separation. Test WPA2/WPA3 configurations and client behavior, then document weaknesses, evidence, business impact, and recommended fixes.

• Assessing corporate, guest, and IoT WiFi security
• Evaluating WPA3 migration and transition mode
• Testing rogue access point detection

Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.

• Detecting use of leaked cloud credentials
• Monitoring suspicious access to decoy storage and secrets
• Extending on-premises deception coverage to cloud environments

Set up decoy files on endpoints and shared folders to detect possible ransomware activity. Monitor modifications, deletions, and renaming with file monitoring tools, connect events to alerts, and test whether the detection and response process works.

• Adding ransomware warning files to shared folders
• Supplementing endpoint protection with decoy file monitoring
• Testing alerts triggered by decoy file changes

Map attacker behaviors and indicators of compromise, or traces of an intrusion, to MITRE ATT&CK techniques. Build coverage heatmaps, compare threat groups, and identify monitoring gaps to guide detection improvements and threat intelligence reporting.

• Mapping attacker behaviors and intrusion traces to ATT&CK techniques
• Visualizing detection coverage with ATT&CK Navigator
• Identifying attack techniques missing from monitoring

Review Cuckoo or AnyRun behavior reports for signs that malware is avoiding an analysis environment. Identify timing checks, virtual machine detection, and user activity checks, then produce a JSON report with evidence, technique mappings, and an evasion sophistication score.

• Investigating malware that stays inactive in a sandbox
• Reviewing behavior reports for analysis evasion
• Developing detections for anti-analysis behavior

Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.

• Triage suspicious APK files without running them
• Inspect dangerous permission combinations and suspicious API calls
• Extract network indicators for malware detection rules

Analyze malware network captures to investigate command-and-control traffic, data theft, and downloaded files. Use packet analysis tools to identify suspicious destinations and recurring connections, extract artifacts, and create detection rules from observed patterns.

• Analyzing malware sandbox network captures
• Investigating command-and-control traffic
• Tracing data theft and file downloads

Analyze access logs from AWS S3, GCS, and Azure Blob Storage to spot unusual downloads, unfamiliar IP addresses, and request spikes. Compare activity with normal patterns and prioritize findings for suspected data theft investigations.

• Investigating suspected data theft from cloud storage
• Finding bulk downloads outside normal working hours
• Checking unfamiliar IP addresses and sudden request spikes

Examine writing for familiar AI patterns, statistical features, Pangram detection scores, and hidden character signatures. Compare drafts against known human writing to interpret the evidence, with explanations and limitations rather than a definitive authorship claim.

• Check a post for common AI writing patterns
• Compare AI detection scores across drafts
• Compare a revision with known human writing

Smart triggered RF capture on NI USRP radios with Wireless Testbench — record only when a signal of interest appears, not continuously (triggered spectrum sensing). Use energy detection to capture when signal power rises above the noise floor, or preamble detection to cross-correlate against a known sequence (WLAN L-LTF, 5G NR PSS/SSS, LTE PSS, Zadoff-Chu, custom protocols) and capture only when that protocol's preamble is detected. Use when implementing triggered (wake-on-signal) capture or spectrum sensing, capturing protocol-based signals via cross-correlation, calibrating detection thresholds (plotDetectionSignals / plotThreshold), scanning frequency bands for activity, or building transmit-then-detect workflows.

The English summary is being prepared. Showing the original description.