Results for “detection-rule”

Execution discipline with agency, instinct detection, critical safety rules, trust layer, and error resilience. v2.7 adds timeout handling, checkpointing, and decision logging.

Reduces SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness.

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.

Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs coverage gap analysis, and runs detection validation loops to measure blue team visibility.

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

融合潜能蒸馏与规则抽象能力，从规则维度提取和转化潜能，构建基于规则的潜能发展框架。

HYDRA v2.0 — Squeeze Detector. Finds crowded trades about to unwind. Funding extreme + SM positioned against the crowd + price starting to move. Goes opposite to the funding crowd. Only liquid assets ($20M+ volume). DSL exit managed by plugin runtime via runtime.yaml.

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns with proper testing and validation.

Detect abuse of legitimate Windows binaries (LOLBins) like certutil, regsvr32, mshta, and rundll32 using process telemetry, Sigma rules, and parent-child process analysis.

Scan installed skills to extract cross-cutting principles and distill them into rules files.

Rule (afak-rule)

Detects drift between declared reality (docs, manifests, inventories, ADRs) and actual reality (filesystem, git state, dependencies, hooks) on session start, reporting findings with severity and evidence.

Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.

融合分类系统与规则抽象能力，构建基于规则的分类体系，支持规则驱动的分类需求和规则执行。

Detects Follow-Through Day (FTD) signals for market bottom confirmation using William O'Neil's methodology, with dual-index tracking and a state machine for rally attempt, FTD qualification, and post-FTD health monitoring.

First-principles assumption auditor. Classifies each hidden assumption (fact / convention / belief / interest-driven), ranks by fragility × impact, and rebuilds conclusions from verified premises. Bilingual: auto-detects Chinese or English.

Skill for the Observability area of paddock. 105 symbols across 26 files.

Detects and ranks trending market themes by analyzing cross-sector momentum, volume, and breadth signals with lifecycle maturity assessment.

First-principles assumption auditor. Classifies each hidden assumption (fact / convention / belief / interest-driven), ranks by fragility × impact, and rebuilds conclusions from verified premises. Bilingual: auto-detects Chinese or English.

Rule (adak-rule)

Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says "diagnose this" / "debug this", reports a bug, says something is broken/throwing/failing, or describes a performance regression.

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

First-principles assumption auditor. Classifies each hidden assumption (fact / convention / belief / interest-driven), ranks by fragility × impact, and rebuilds conclusions from verified premises. Bilingual: auto-detects Chinese or English.

Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.

v4.1.0 reward function redesign to fix overtrading and DSR dominance

Rule (ahak-rule)

Explains MariaDB-specific SET TRANSACTION behavior, including scope rules, isolation levels, and innodb_snapshot_isolation conflict detection, to help write correct transaction statements and retry logic.

Design and deploy Salesforce restriction rules to subtract record access from users, covering eligibility, criteria syntax, metadata shape, and documented enforcement gaps.

JS Proxy Pattern

Rule (aeak-rule)