Results for “sybil-detection”

Skill for the Observability area of paddock. 105 symbols across 26 files.

Detect abuse of legitimate Windows binaries (LOLBins) like certutil, regsvr32, mshta, and rundll32 using process telemetry, Sigma rules, and parent-child process analysis.

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.

Generating, updating, auditing, and sync-repairing project-specific Claude Code skills from the repo stack and conventions. Use when authoring project-local skills (Micro or Full).

Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks by monitoring process creation, command-line arguments, and parent-child relationships.

PASS/FAIL eval rubrics and alignment loops for Sid Orchestra (global). Use when the user says sid evals, @sid-evals, grade this, eval gate, alignment score, or wants to stop AI slop. Works in any workspace; bootstraps EVALS.md from ~/.cursor/skills/sid-orchestra/templates if missing.

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts using Splunk SPL and Sigma rule format.

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.

Analyze and manage Bazel workspaces, including BUILD file inspection, target querying, dependency graphs, remote execution, caching configuration, and build performance profiling.

Use when invoking the top-level `easel` dispatcher to discover or run Easel sequence-analysis subcommands from the HMMER toolchain.

Detect IBD-style Distribution Days for QQQ/SPY, track 25-session expiration and 5% invalidation, count d5/d15/d25 clusters, classify market risk, and emit TQQQ/QQQ exposure recommendations.

Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.

Detect container escape attempts using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.

BALD EAGLE v3.0 — XYZ Alpha Hunter (Hardened). Focused on 6 high-liquidity XYZ assets: CL, BRENTOIL, GOLD, SILVER, SP500, XYZ100. Conviction-scaled leverage (5-10x based on score). Wider DSL for macro assets. Maker-only execution. Scanner calls create_position internally. v3.0: focused assets, conviction-scaled leverage, XYZ-tuned DSL, no thesis exit.

Hunt for web shell deployments on internet-facing servers by analyzing file creation in web directories, suspicious process spawning from web servers, and anomalous HTTP patterns.

Applies four disciplined mindsets—audit, debt, help, review—to cut complexity, track deferrals, surface reference, and catch over-engineering in codebases.

Automatically detects project state and runs an 8-phase pipeline to plan, build, test, lint, fix bugs, and document code across multiple AI coding agents.

Clusters raw detection tickets into reusable edge concepts with thesis, invalidation signals, and strategy playbooks before strategy design.

HYDRA v2.0 — Squeeze Detector. Finds crowded trades about to unwind. Funding extreme + SM positioned against the crowd + price starting to move. Goes opposite to the funding crowd. Only liquid assets ($20M+ volume). DSL exit managed by plugin runtime via runtime.yaml.

PASS/FAIL eval rubrics and alignment loops for Sid Orchestra. Use when the user says sid evals, @sid-evals, grade this, eval gate, alignment score, or wants to stop AI slop with evaluation gates.