Results for “detection”

Develop precise YARA rules for malware detection by identifying unique byte patterns, strings, and behavioral indicators in executable files while minimizing false positives.

Detect sophisticated cyber-physical attacks that modify PLC logic while spoofing sensor readings, covering PLC integrity monitoring, process anomaly detection, and multi-stage attack chain detection.

Installs, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments.

Clusters raw detection tickets into reusable edge concepts with thesis, invalidation signals, and strategy playbooks before strategy design.

Analyzes codebases to generate comprehensive architectural documentation, including technology stack detection, visual diagrams, and implementation patterns.

Performance regression detection using the browse daemon. (gstack)

Configure AIDE for file integrity monitoring, including baseline creation, scheduled integrity checks, change detection, and alerting.

Implements layered security for Flutter apps: code obfuscation, certificate pinning, secure storage, encryption, biometric authentication, and root/jailbreak detection.

Monitor dividend portfolios for risk triggers and route anomalies into a human review queue without auto-selling.

Runs Semgrep static analysis with custom YAML rules, supporting taint tracking, metavariable comparisons, and pattern-not-inside exclusions for precise vulnerability detection.

N+1 Query Detection and Resolution

Reduce SIEM alert fatigue by systematically tuning detection rules in Splunk and Elastic, using statistical baselines, whitelists, and precision/recall metrics.

Perform time series machine learning tasks including classification, regression, clustering, forecasting, anomaly detection, segmentation, and similarity search using a scikit-learn compatible Python toolkit.

Detects the test platform (VSTest vs Microsoft.Testing.Platform) and test framework (MSTest, xUnit, NUnit, TUnit) from .NET project files.

Implements a continual learning loop for AI coding agents using hooks, two-tier memory (global and local), and automatic pattern detection to persist and apply learnings across sessions.

Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

Skill for the Observability area of paddock. 105 symbols across 26 files.

Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates.

Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.

Detect container escape attempts using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.

Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.

Detects drift between declared reality (docs, manifests, inventories, ADRs) and actual reality (filesystem, git state, dependencies, hooks) on session start, reporting findings with severity and evidence.

Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom Python monitoring scripts to protect against man-in-the-middle interception.

Diagnose failures from runtime evidence before editing code.

Weekly churn risk detection across active client accounts. Scans for signals like decreased engagement, missed meetings, delayed payments, and competitor mentions. Scores risk 1-10 and outputs prioritized alert list.

[object Object]

Pattern-Based Diagnosis