Results for “detection-rules”

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.

Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs coverage gap analysis, and runs detection validation loops to measure blue team visibility.

Scan installed skills to extract cross-cutting principles and distill them into rules files.

Detect abuse of legitimate Windows binaries (LOLBins) like certutil, regsvr32, mshta, and rundll32 using process telemetry, Sigma rules, and parent-child process analysis.

Skill for the Observability area of paddock. 105 symbols across 26 files.

Pattern-Based Diagnosis

Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.

Design and deploy Salesforce restriction rules to subtract record access from users, covering eligibility, criteria syntax, metadata shape, and documented enforcement gaps.

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns with proper testing and validation.

Ports existing Semgrep rules to new target languages with applicability analysis and test-driven validation.

Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.

Coordinates purple team exercises by running MITRE ATT&CK-mapped attack scenarios with real-time detection testing and collaborative gap remediation.

Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.

Provides guidelines and best practices for aggregates and aggregate roots, referencing detailed documentation.

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

Centralized JSON validation for AGENT_SUCCESS_CRITERIA with defensive parsing and injection attack prevention (CVSS 8.2)

Detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts using Splunk SPL and Sigma rule format.

Optimizes React and Next.js performance with 69 prioritized rules covering waterfalls, bundle size, server-side rendering, and re-rendering patterns.

Creates safety alert decks with hazard stripes, tiered cards, and policy code blocks for incident reviews and risk communication.

融合潜能蒸馏与规则抽象能力，从规则维度提取和转化潜能，构建基于规则的潜能发展框架。

HYDRA v2.0 — Squeeze Detector. Finds crowded trades about to unwind. Funding extreme + SM positioned against the crowd + price starting to move. Goes opposite to the funding crowd. Only liquid assets ($20M+ volume). DSL exit managed by plugin runtime via runtime.yaml.

JS Proxy Pattern

[object Object]

SynthText: Synthetic Data for Text Detection

Reproduces failures, gathers evidence, tests hypotheses, fixes root causes, and adds regression coverage.

Explains MariaDB-specific SET TRANSACTION behavior, including scope rules, isolation levels, and innodb_snapshot_isolation conflict detection, to help write correct transaction statements and retry logic.

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.

Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins using statistical analysis on Splunk or raw log data.

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Provides detection rules for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware.