Results for “detection-rules”
9 skills
mukul975 implementing-siem-use-cases-for-detection
Design, implement, test, and maintain SIEM detection rules mapped to MITRE ATT&CK across Splunk, Elastic, and Sentinel platforms.
24.6k · bundle
mukul975 implementing-siem-use-case-tuning
Reduce SIEM alert fatigue by systematically tuning detection rules in Splunk and Elastic, using statistical baselines, whitelists, and precision/recall metrics.
24.6k · bundle
trailofbits yara-rule-authoring
Write high-quality YARA-X detection rules for malware identification, covering naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction.
6k · bundle
More results
mukul975 implementing-alert-fatigue-reduction
Reduces SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness.
24.6k · bundle
mukul975 performing-malware-triage-with-yara
Rapidly classify malware samples against known family signatures using YARA rules, covering rule writing, scanning, and integration with analysis pipelines.
24.6k · bundle
mukul975 implementing-siem-correlation-rules-for-apt
Detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts using Splunk SPL and Sigma rule format.
24.6k · bundle
mariadb-corporation mariadb-set-transaction
Explains MariaDB-specific SET TRANSACTION behavior, including scope rules, isolation levels, and innodb_snapshot_isolation conflict detection, to help write correct transaction statements and retry logic.
0
mukul975 performing-web-application-firewall-bypass
Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack payloads past WAF detection rules.
24.6k · bundle
mukul975 hunting-credential-stuffing-attacks
Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins using statistical analysis on Splunk or raw log data.
24.6k · bundle