56 skills · sorted by relevance
Create threat detection rules in Sigma, a shared format for security log searches, and convert them for Splunk, Elastic, or Microsoft Sentinel. Validate syntax, test expected matches and false positives, and map coverage to MITRE ATT&CK.
Detect attacks that misuse legitimate Windows utilities such as certutil and mshta. Analyze process logs, command arguments, and parent-child relationships with Sigma detection rules, then report suspicious events with severity scores and supporting event details.
Analyze suspected malware through code inspection and behavior observed in an isolated environment. Extract indicators of compromise, such as suspicious domains and file paths, and create YARA file-matching rules or Sigma behavior-detection rules from the findings.
Investigate signs of intrusion through hypothesis-led log searches, then turn findings into detection rules. Supports Sigma, YARA, and SIEM queries, with attention to false positives, data field mapping, and validation against historical logs.
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.
The English summary is being prepared. Showing the original description.
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.
The English summary is being prepared. Showing the original description.
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.
The English summary is being prepared. Showing the original description.
Detect attacks that misuse legitimate Windows tools by examining command arguments, parent and child processes, and network connections. Create Sysmon logging configurations and Sigma detection rules, analyze endpoint logs, and review application controls while accounting for legitimate usage.
Extract durable ktx wiki knowledge from staged Sigma data model specs and workbook summaries. Load for WorkUnits with unitKey sigma-data-models or sigma-workbooks.
The English summary is being prepared. Showing the original description.
Converts hunt findings into portable Sigma detection rules: choosing the right logsource, expressing robust selection/filter logic, setting level and ATT&CK tags, and validating before converting to a SIEM query. Activates for requests to write a Sigma rule, convert a hunt to a detection, or create portable SIEM detection logic.
The English summary is being prepared. Showing the original description.
Comprehensive Lean Six Sigma consulting skill supporting all belt levels (White Belt to Master Black Belt). Use this skill for DMAIC/DMADV project execution, Lean waste elimination (VSM, 8 Wastes/DOWNTIME, 5S), statistical analysis (process capability Cp/Cpk, control charts, hypothesis testing), and Six Sigma training/education. Triggers include "improve process", "reduce defects", "sigma level", "DMAIC project", "value stream mapping", "Kaizen", "process capability", "control chart", "root cause analysis", "5 Whys", "Fishbone diagram", "FMEA", "DOE", or requests involving process improvement methodologies.
The English summary is being prepared. Showing the original description.
Turn cyber threat intelligence reports into a searchable library of attacker behaviors linked to MITRE ATT&CK techniques. Export structured STIX 2.1 data, a threat information exchange format, and create detection rule templates from documented activity.
Use when the user asks for a SIGMA detection rule, "write a SIGMA rule for X", or `/hash-investigation` / `/malware-analysis` surfaces behaviour worth a vendor-agnostic detection. Format spec + writing guide.
The English summary is being prepared. Showing the original description.
Converts a successful threat hunt into a durable detection by extracting the discriminating logic, defining data sources and thresholds, and emitting a Sigma rule plus a test and tuning plan. Activates for requests to operationalize a hunt, turn a finding into a detection rule, or productionize hunt logic as a Sigma detection.
The English summary is being prepared. Showing the original description.
Application of Six Sigma quality methodology to AI agent process improvement and reliability
The English summary is being prepared. Showing the original description.
Investigate malicious code placed inside legitimate Windows processes using memory analysis, event logs, and API monitoring. Identify injection methods, examine extracted code, and produce evidence reports and detection rules for suspicious process behavior.
Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.
Map repeatable business processes by owner and analyze time spent working, waiting, or reworking. Using stage-level timing data, produce a process diagram, ranked bottlenecks, and cycle-time measures to focus improvements on the main constraint.
Problem-solving strategies for sigma algebras in measure theory
The English summary is being prepared. Showing the original description.
Designs and reviews detections from telemetry prerequisites, correlation logic, Sigma metadata, severity, status, and benign cases. Use for detection rules, Sigma review, analytic coverage, or tuning; not generic logging advice or live deployment.
The English summary is being prepared. Showing the original description.
Security log parsing, anomaly detection, SIEM query building, Sigma rule creation, and correlation rule development across Splunk, Elastic, QRadar, and Microsoft Sentinel
The English summary is being prepared. Showing the original description.
Engineer and audit SIEM detection rules — log source coverage, Sigma / KQL / SPL / Elastic query authoring, MITRE ATT&CK mapping, false-positive tuning, and detection-as-code workflows. Use when the user mentions 'SIEM,' 'detection engineering,' 'detection rules,' 'Sigma,' 'KQL,' 'SPL,' 'Splunk,' 'Sentinel,' 'Elastic,' 'Wazuh,' 'Chronicle,' 'detection-as-code,' 'MITRE ATT&CK mapping,' 'log coverage,' 'alert tuning,' 'use case development,' or needs help building or improving security detections.
The English summary is being prepared. Showing the original description.
Use when 用户想以一对一苏格拉底导师的方式系统学习一个课题——开一门新课、推进课题的下一篇、提交学习反馈或说「我读完了」、或整理/查看学习日志。基于 Bloom 2 Sigma 的交互式学习系统。触发词：开个文件夹学X、我想学X、帮我学X、继续、下一篇、我读完了、整理学习、查看学习日志、interactive Socratic tutoring、Bloom 2 sigma learning。
The English summary is being prepared. Showing the original description.
Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.
The English summary is being prepared. Showing the original description.