「threat」の検索結果

Hunts for Windows persistence across autostart locations: Run keys, services, scheduled tasks, WMI event subscriptions, and startup folders, baselining them to surface anomalous or recently added entries. Activates for requests to hunt persistence, audit autostart extensibility points, or find malware autoruns on Windows.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for Linux persistence by inspecting cron, systemd units, shell rc files, SSH authorized_keys, and common autostart locations for attacker-added entries. Activates for requests to hunt Linux persistence, audit cron/systemd for backdoors, or find unauthorized autostart and authorized_keys entries.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for ransomware precursor behavior that precedes encryption — shadow-copy and backup deletion, recovery disabling, security-tool tampering, and mass file modification — so the attack can be stopped before payload detonation. Activates for requests to hunt ransomware precursors, detect shadow-copy deletion, or find pre-encryption recovery sabotage.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for malicious scheduled task persistence by analyzing task registration events (4698) and schtasks process creation for suspicious actions, triggers, and hidden tasks. Activates for requests to hunt scheduled task abuse, detect malicious schtasks usage, or find persistence via the Task Scheduler.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for pre-exfiltration data staging and archiving by detecting archive-tool execution (rar, 7z, zip, tar), large compressed files written to staging directories, and collection into a single location before transfer. Activates for requests to hunt data staging, detect pre-exfil archiving, or find collection and compression before exfiltration.

日本語の概要は準備中です。原文の説明を表示しています。

Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for the native subsystem, identifying DriverEntry/IRP dispatch and IOCTL handlers, and flagging BYOVD and kernel-callback abuse. Activates for requests to analyze a Windows driver, examine a .sys sample, or assess a BYOVD/kernel driver threat.

日本語の概要は準備中です。原文の説明を表示しています。

Cybersecurity partner skill for acting as a practical security collaborator across architecture review, threat modeling, secure design, risk prioritization, defensive planning, vulnerability remediation, incident readiness, security roadmaps, and technical decision support. Use when the user wants an ongoing security advisor, reviewer, or second set of eyes.

日本語の概要は準備中です。原文の説明を表示しています。

Security Operations Center skill for alert triage, detection engineering, incident response, log analysis, threat hunting, SIEM queries, EDR investigation, timeline building, IOC handling, escalation notes, containment recommendations, and analyst-ready reporting. Use for blue-team operations, suspicious event analysis, and defensive cybersecurity workflows.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a task needs the judgment of an Application Security Engineer — checking whether an endpoint verifies object-level authorization (not just authentication), running threat modeling at design time rather than deferring security review to the end, triaging a dependency vulnerability by actual reachability rather than CVSS score alone, combining SAST/DAST/SCA tooling to cover their distinct blind spots, or applying context-specific output encoding to untrusted input. Distinct from an information security analyst — this role works inside the SDLC to prevent vulnerabilities before they ship, not detect and respond to intrusions in production.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a task needs the judgment of an Area, Ethnic, or Cultural Studies Professor — designing a joint-appointment course load across two departments, prepping a tenure or mid-tenure review file for interdisciplinary scholarship, deciding whether a course survives an enrollment or political-pressure threat, evaluating community-engaged research for a merit case, or writing a Title VI/FLAS-adjacent grant narrative.

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive security audit covering OWASP Top 10, secrets detection, supply chain security, threat modeling, and language-specific vulnerability patterns. Investigates actual code paths rather than grep-matching keywords. Generates a scored SECURITY_AUDIT.md with prioritized remediation. Use when assessing application security, preparing for a security review, or onboarding to a codebase with security concerns.

日本語の概要は準備中です。原文の説明を表示しています。

Deploy and operate endpoint detection and response — policy tuning, behavioral detections, threat hunting, and response actions.

日本語の概要は準備中です。原文の説明を表示しています。

Audit risk simulation and decision support systems for Monte Carlo modeling quality, wargaming analysis, threat assessment, mission planning support, and course-of-action decision analysis..

日本語の概要は準備中です。原文の説明を表示しています。

De-escalate a customer crisis using a structured acknowledge-triage-DRI-cadence-resolution framework. Use when user says "customer escalation", "angry customer", "exec escalation", "customer threatening to leave", "fire drill", "critical customer issue", "customer is livid", "customer complaint escalated", or "how do I handle this" about a tense situation - even if they don't say "escalation" explicitly. Applies to CSMs and CS managers managing high-stakes customer crises.

日本語の概要は準備中です。原文の説明を表示しています。

Expert guidance for security alert triage in Google SecOps. Use when investigating and triaging security alerts, determining false positives vs. true positives, assessing entity risk, adjusting alert severity or priority, and closing or escalating alerts and cases. Don't use for deep multi-hop incident investigations across host timelines (use secops-investigate), proactive threat hunting or retroactive IoC sweeps (use secops-hunt), or authoring new detection rules (use secops-detection-engineering).

日本語の概要は準備中です。原文の説明を表示しています。

Investigates Google Cloud networking issues by analyzing logs, metrics, and diagnostics. Use when investigating VPC Flow Logs (including cost estimation), NAT, firewall, or threat logs, querying latency and throughput metrics, or running Connectivity Tests for path diagnostics. Don't use for generic VM management or non-observability tasks.

日本語の概要は準備中です。原文の説明を表示しています。

Investigates Google Cloud networking issues by analyzing logs, metrics, and diagnostics. Use when investigating VPC Flow Logs, NAT, firewall, or threat logs, querying latency and throughput metrics, or running Connectivity Tests for path diagnostics.

日本語の概要は準備中です。原文の説明を表示しています。

Blockchain security API for AI agents. Scan tokens, simulate transactions, check addresses for threats.

日本語の概要は準備中です。原文の説明を表示しています。

Error Message Style Guide for Validation Errors

日本語の概要は準備中です。原文の説明を表示しています。

How to fetch the latest github/gh-aw release binary — either as the gh CLI extension (gh aw ...) or as a raw platform binary downloaded from GitHub Releases — including how to resolve the latest tag, pick the right asset, and verify its checksum.

日本語の概要は準備中です。原文の説明を表示しています。

Instructions for using the struct tag-based console rendering system in Go

日本語の概要は準備中です。原文の説明を表示しています。

How to manually regenerate the compiled agentic workflow .lock.yml files when the gh-aw Version Check workflow reports version drift. All workflows track the newest github/gh-aw release or prerelease.

日本語の概要は準備中です。原文の説明を表示しています。

Use lane in this repository when the user asks to create or work in an isolated worktree.

日本語の概要は準備中です。原文の説明を表示しています。

Vulnerability analysis: OWASP Top 10, current threat landscape, supply chain security, attack surface mapping, risk prioritization. Use for security audits. NOT for STRIDE/CSO infra audits (mk:cso).

日本語の概要は準備中です。原文の説明を表示しています。