Results for “detection-engineering”
14 skills
google detection-engineering-coverage-evaluation
Automates detection engineering workflows in Google SecOps by extracting threat intelligence, generating detection opportunities, simulating attacker behavior with synthetic events, evaluating rule coverage, and creating new YARA-L 2.0 rules to close gaps.
14.4k
zhaoxuya520 threat-hunting
Guides blue-team threat hunting and detection engineering with hypothesis-driven workflows, Sigma/YARA rule creation, SIEM query design, and validation using Atomic Red Team in authorized environments.
12.8k · bundle
mukul975 implementing-siem-use-cases-for-detection
Design, implement, test, and maintain SIEM detection rules mapped to MITRE ATT&CK across Splunk, Elastic, and Sentinel platforms.
24.6k · bundle
mukul975 implementing-alert-fatigue-reduction
Reduces SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness.
24.6k · bundle
More results
mukul975 implementing-security-chaos-engineering
Deliberately disables or degrades security controls to verify detection and response capabilities, including WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess.
24.6k · bundle
mukul975 hunting-for-command-and-control-beaconing
Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.
24.6k · bundle
mukul975 detecting-evasion-techniques-in-endpoint-logs
Detects defense evasion techniques in endpoint logs, including log tampering, timestomping, process injection, and security tool disabling, using Sysmon, EDR telemetry, and SIEM queries.
24.6k · bundle
mukul975 building-threat-hunt-hypothesis-framework
Transform threat intelligence and attack patterns into testable hunting hypotheses for proactive threat detection.
24.6k · bundle
mukul975 hunting-advanced-persistent-threats
Proactively hunts for Advanced Persistent Threat activity using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts.
24.6k · bundle
mukul975 designing-adversary-engagement-with-mitre-engage
Plan, run, and measure adversary engagement operations using the MITRE Engage framework, covering the Engage Matrix, 10-Step Operational Process, and mapping Activities to ATT&CK techniques.
24.6k · bundle
mukul975 analyzing-command-and-control-communication
Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure for detection development and threat intelligence.
24.6k · bundle
mukul975 analyzing-apt-group-with-mitre-navigator
Query MITRE ATT&CK data programmatically, map APT group TTPs to Navigator layers, create multi-layer overlays for gap analysis, and generate actionable intelligence reports for detection engineering teams.
24.6k · bundle
mukul975 detecting-business-email-compromise
Detect business email compromise (BEC) attacks using email gateway rules, behavioral analytics, and financial process controls.
24.6k · bundle
mukul975 performing-firmware-malware-analysis
Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications targeting routers, IoT devices, UEFI/BIOS, and embedded systems. Covers firmware extraction, filesystem analysis, binary reverse engineering, and bootkit detection.
24.6k · bundle