4,845 件 ・ 関連度順
概要と使いどころ
Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.
日本語の概要は準備中です。原文の説明を表示しています。
Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.
日本語の概要は準備中です。原文の説明を表示しています。
Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons with NTLM where Kerberos is expected, and correlating with credential dumping.
日本語の概要は準備中です。原文の説明を表示しています。
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.
日本語の概要は準備中です。原文の説明を表示しています。
Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.
日本語の概要は準備中です。原文の説明を表示しています。
Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.
日本語の概要は準備中です。原文の説明を表示しています。
Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.
日本語の概要は準備中です。原文の説明を表示しています。
Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed ad hoc. Covers the Engage Matrix (Prepare, Expose, Affect, Elicit, Understand), the 10-Step Operational Process, mapping engagement Activities to the ATT&CK techniques they expose, and defining measurable Goals and Operational Objectives. Use when a team has honeypots, honeytokens, or canary tokens but no coordinating strategy, when leadership asks "should we engage attackers and how", when building a deception/denial program, when writing an adversary engagement operation plan, or when deciding which deception Activities to deploy against a specific threat actor. Keywords: MITRE Engage, adversary engagement, cyber deception strategy, denial and deception, Engage Matrix, EAC, EGO, Expose Affect Elicit, deception program, honeypot strategy, engagement operation.
日本語の概要は準備中です。原文の説明を表示しています。
Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them: canary IAM access keys, permission-less decoy users/roles/service principals, honey object-storage buckets, and decoy secrets in Secrets Manager / Key Vault / Secret Manager. Wires detection through CloudTrail + EventBridge, Azure Sentinel honeytoken watchlists + Defender, and GCP Cloud Audit Logs, so any use of a decoy is routed to the SOC with near-zero false positives. Use when protecting cloud accounts and data stores, when an org has only on-prem honeypots and needs cloud coverage, when seeding fake AWS keys to catch credential theft and code-leak exposure, or when detecting cloud reconnaissance and lateral movement. Keywords: cloud deception, canary token AWS, honey S3 bucket, decoy IAM credentials, CloudTrail alert, GuardDuty, Sentinel honeytoken, decoy secret, honey service account, cloud honeypot, breach detection.
日本語の概要は準備中です。原文の説明を表示しています。
Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors, or trusted partners to trick employees into transferring funds, sharing sensitive data,
日本語の概要は準備中です。原文の説明を表示しています。
Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators
日本語の概要は準備中です。原文の説明を表示しています。
Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation vectors, and sensitive data exposure within the corporate network.
日本語の概要は準備中です。原文の説明を表示しています。
Human and accessibility skill for antislop. Contrast, keyboard, focus, and states for real people. Includes the contrast checker.
日本語の概要は準備中です。原文の説明を表示しています。
Draft public Tamanu release notes for a given version. Use when the user wants release notes for a Tamanu release (e.g. "draft release notes for v2.45"). Pulls work from the specs and code that landed in that version's release/X.Y branch, plus the matching issues in the trackers (Linear's Tamanu team and Workhorse's Tamanu workspace), reconciles them, and writes docs/release-notes/vX-YY.md in the canonical v2.44 format for project managers and system administrators, plus a styled HTML rendering at .workhorse/design/designs/vX-YY-release-notes.html. Not for developer changelogs or QA test scoping (use scope-tamanu-release-tests for the latter).
日本語の概要は準備中です。原文の説明を表示しています。
Complete SolanaOS agent skill — install, configure, and operate the autonomous Solana trading runtime with Honcho v3 epistemological memory, multi-venue perp trading (Hyperliquid + Aster), on-chain intelligence with USD pricing, Telegram bot, gateway API, Tailscale mesh, hardware integration, and cross-session recall. Use when asked to install SolanaOS, query Solana blockchain data, manage wallets, run OODA trading loops, configure strategies, control BitAxe mining fleets, pair Seeker devices, or operate any SolanaOS runtime surface.
日本語の概要は準備中です。原文の説明を表示しています。
Control Sonos speakers (discover/status/play/volume/group).
日本語の概要は準備中です。原文の説明を表示しています。
Add a new interactive design tool under /tools (like the color converter or contrast checker) — component, page, navigation, route lists, SEO, and tests. Use when building a new utility tool.
日本語の概要は準備中です。原文の説明を表示しています。
Release cycle on worker tier. Version bump, readme.txt, changelog, build, Plugin Check, zip. Owner must explicitly authorize the version bump.
日本語の概要は準備中です。原文の説明を表示しています。
Full dev cycle. Planning tier for clarify and plan; worker tier after approval for autonomous execution, tiered lint, thread rotation, and feedback fixes. Start every change here.
日本語の概要は準備中です。原文の説明を表示しています。
Standalone security audit on audit tier. Focused review of a feature or file set. Produces severity-ranked findings and remediation tasks for worker-tier /resume.
日本語の概要は準備中です。原文の説明を表示しています。
Track vendor support tickets and RMA cases across multiple vendors. Use when managing support ticket lifecycle, updating ticket status from vendor emails, generating status reports, or identifying tickets needing follow-up.
日本語の概要は準備中です。原文の説明を表示しています。
Track and correlate events across multiple timezones with automatic conversion. Use when analyzing distributed system incidents, coordinating cross-regional operations, or creating time-normalized reports from logs/events spanning PST/CST/EST/JST or other timezones. Handles daylight saving transitions automatically.
日本語の概要は準備中です。原文の説明を表示しています。
Cross-reference project artifacts (WBS, meeting minutes, requirements docs) by date, participant, and action items. Extract commitments from meeting minutes and link to WBS tasks. Generate traceability reports showing which decisions were captured in which documents.
日本語の概要は準備中です。原文の説明を表示しています。
Review audit-related documents (control design documents, bottleneck analyses, requirements definitions, etc.) for quality, scoring them 0-100 with a severity-rated findings list. Use when reviewing audit documents, checking control design quality, or verifying cross-document consistency. Supports documents governed by US GAAP, IFRS, or J-GAAP.
日本語の概要は準備中です。原文の説明を表示しています。