「based」の検索結果

株式・債券・金などの資産配分を、リスクや相関、売買コストの観点から検討し、5種類の最適化手法の選択、設定、配分を戻すルールまで整理するスキル。

• 株式・債券・金の配分比較
• 収益予測と相関に応じた最適化手法の選択
• config.json用の配分設定作成

diffusersへの変更をPR提出前に点検し、修正が必要な問題とレビューで相談する事項を整理します。未使用コードも調べ、重要度別の報告にまとめるスキルです。

• diffusersへの変更を提出前に確認したいとき
• 変更内の未使用コードを調べたいとき
• 修正後の再確認とレビュー用メモの準備

人物やテーマの資料を調べ、思考モデルや判断基準、表現の特徴をまとめたSKILL.mdを作るスキル。対象が決まっていない場合も、悩みに合う候補の提案から進めます。

• 特定人物の思考相談役を作りたいとき
• 悩みに合う視点を選びたいとき
• 自分の文章や判断記録のスキル化

Detects sophisticated cyber-physical attacks that follow the Stuxnet pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation, using PLC logic integrity monitoring (Claroty xDome, Nozomi Guardian) and physics-based process anomaly detection. Use when hunting for IT-to-OT lateral movement or discrepancies between PLC program state and physical process behavior in ICS/SCADA environments.

日本語の概要は準備中です。原文の説明を表示しています。

Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation, cross-referenced against root\subscription namespace contents and Sysinternals Autoruns. Use when hunting WMI-based persistence, triaging a Sysmon alert on these event IDs, or during incident response and purple-team validation of WMI defenses.

日本語の概要は準備中です。原文の説明を表示しています。

Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis with Sysmon endpoint data. Use when hunting for adversaries abusing built-in Windows binaries to download, execute, or proxy malicious code while evading traditional executable-based detection.

日本語の概要は準備中です。原文の説明を表示しています。

Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.

日本語の概要は準備中です。原文の説明を表示しています。

SuricataやSnortでポートスキャンやネットワーク探索を検知するルールを整えます。通信の特徴と接続回数を使う判定、通知量の調整、送信元別のログ集計を支援します。

• NmapやMasscanの検知ルール作成
• 社内ネットワークの探索を監視したいとき
• 正規スキャナーの通知調整

ランサムウェアによる暗号化前の不審な通信を捉えるため、ネットワーク検知ルールと複数ログの関連付けを設計し、調査・隔離の判断手順を整えるスキル。

• 暗号化前の不審な通信の検知ルール作成
• ログイン失敗・探索・共有アクセスの関連分析
• 社内ネットワークの異常通信調査

Detect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic using deep packet inspection and machine learning approaches. Use when securing energy-sector or other OT/ICS networks, investigating suspicious DNP3 master/outstation activity, or building an anomaly-based IDS for industrial control traffic.

日本語の概要は準備中です。原文の説明を表示しています。

Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, looking for Kerberos TGT anomalies such as mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures. Use when hunting for Kerberos ticket forgery or krbtgt-based persistence (MITRE T1558.001) in AD environments.

日本語の概要は準備中です。原文の説明を表示しています。

Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains, oversized TXT/NULL records, and anomalous query volume or patterns. Use when investigating suspected DNS tunneling, covert C2 over DNS, or data exfiltration hidden in DNS queries against network traffic captured by Zeek.

日本語の概要は準備中です。原文の説明を表示しています。

Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One and nRF52840 sniffers for packet capture, the bleak Python library for GATT service enumeration, and crackle for BLE encryption cracking. Use when assessing IoT device BLE security, monitoring for BLE-based attacks on wireless infrastructure, or performing authorized BLE penetration testing. Activates for requests involving BLE security assessment, Ubertooth sniffing, GATT enumeration, or BLE replay detection.

日本語の概要は準備中です。原文の説明を表示しています。

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.

日本語の概要は準備中です。原文の説明を表示しています。

社内LANのARP通信を監視・解析し、IPとMACアドレスの対応変更や重複、大量送信を手掛かりに、通信の盗聴につながるなりすましの兆候を調べるスキル。

• LAN内の盗聴が疑われるときの調査
• IPとMACアドレスの対応変更の監視
• IP重複やゲートウェイ偽装の確認

Detect command-and-control (C2) traffic tunneled over DNS from tools like Iodine, dnscat2, dns2tcp, and Cobalt Strike DNS beacon, using Shannon entropy analysis of query subdomains, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signatures. Use when investigating suspected DNS tunneling, classifying DGA domains, detecting DNS beaconing, or building DNS anomaly rules for a SOC/SIEM.

日本語の概要は準備中です。原文の説明を表示しています。

Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single domains, TXT/CNAME/NULL record abuse, and oversized response payloads using passive DNS monitoring and statistical/ML methods. Use when hunting for covert DNS-based data exfiltration or building a passive DNS anomaly detection capability.

日本語の概要は準備中です。原文の説明を表示しています。

Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.

日本語の概要は準備中です。原文の説明を表示しています。

Deploys anomaly detection for OT/ICS environments using machine learning on OT network baselines, physics-based process models, and Modbus/DNP3/OPC UA traffic analysis to flag deviations, rogue devices, and mismatches against historian data. Use for continuous OT monitoring, baselining deterministic SCADA polling, or investigating alerts from Nozomi Guardian/Dragos needing deeper protocol analysis.

日本語の概要は準備中です。原文の説明を表示しています。

Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring identity- and device-posture-based access policies, and integrating with IdPs. Use when replacing VPN concentrators with ZTNA or providing remote users secure access to internal applications without network-level connectivity.

日本語の概要は準備中です。原文の説明を表示しています。

Deploys and configures Tailscale (or self-hosted Headscale) as a WireGuard-based zero trust mesh VPN, setting up identity-aware ACLs, exit nodes, subnet routers, and MagicDNS for encrypted peer-to-peer connectivity. Use when replacing traditional VPN servers with an identity-authenticated mesh network or enforcing granular per-device access control lists.

日本語の概要は準備中です。原文の説明を表示しています。

Deploys a Software-Defined Perimeter per the CSA v2.0 specification, configuring Single Packet Authorization, mutual TLS, and SDP controller/gateway components to enforce zero trust network access. Use when building or hardening zero trust network architecture, implementing SPA-based "invisible" infrastructure that cloaks services from unauthenticated scanning, or meeting compliance requirements for zero trust network access.

日本語の概要は準備中です。原文の説明を表示しています。

Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic inspection (HTTP, TLS, DNS, SMB) and SIEM integration. Use when running Suricata in IDS or inline IPS mode to detect or block malicious traffic, or when combining signature-based and protocol anomaly detection with file extraction.

日本語の概要は準備中です。原文の説明を表示しています。

Configures Hardware Security Modules for cryptographic key storage using the PKCS#11 standard interface, covering key generation, signing, encryption, and key management on physical HSMs and SoftHSM2 for development. Use when protecting cryptographic keys so they never leave a hardened device boundary, or when building and testing PKCS#11-based key management workflows.

日本語の概要は準備中です。原文の説明を表示しています。