Results for “skew-analysis”

Detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement by analyzing Windows Security, System, and Sysmon event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.

Analyzes Zeek conn.log connection intervals using statistical methods to detect C2 beaconing patterns, flagging periodic connections with low jitter.

Analyze Zeek network logs to detect lateral movement techniques including SMB admin share access, DCE/RPC remote service creation, NTLM account spray, Kerberos anomalies, and large internal data transfers.

Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes in API designs, configuration schemas, and cryptographic library ergonomics.

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.

Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.

Reduce SIEM alert fatigue by systematically tuning detection rules in Splunk and Elastic, using statistical baselines, whitelists, and precision/recall metrics.

Security Craft

Patent prior-art and landscape intelligence skill — not generic patent help. Commits to one of five sub-use-cases via forcing intake (novelty search / freedom-to-operate / competitive landscape / acquisition diligence / litigation prior-art) before any search runs. Searches Google Patents, Espacenet, USPTO, and optionally Lens.org for citation-graph signals. Output is an editable Word document (.docx) with verdict, ranked closest art (claim-text extracted), CPC-class-aware landscape, family-resolved hits, geographic coverage, FTO flags where applicable, strategy recommendations, and full audit log. Use when the user asks for patent searching or analysis (e.g., 'prior art search for [invention]', 'freedom to operate analysis for [product]'). Produces search signal, not legal advice — always recommends consulting a patent attorney before filing or licensing decisions. Trademark, copyright, and trade-secret questions are out of scope.

Drafts a federally-defensible SOW or PWS the prime issues to a subcontractor / teaming partner — same FAR 37.102(d) / 37.602 / 16.601(c)(2) / 16.306(d) discipline a contracting officer applies, opposite seat. USE WHEN the user asks to "write a SOW for our sub", "draft a PWS for [Partner]", "build the teaming-partner statement of work", "convert this SOO into a sub SOW", "we need a SOW the sub will sign", or any variant of authoring a downstream work statement. Walks the upstream 3-phase tree (acquisition intake → 6 scope blocks → 14-section assembly), pulls scope from the active Theseus KG (requirements, deliverables, work_scope_items, performance_standards), enforces FAR 37.102(d) "no FTEs in body", emits a chat-only staffing handoff for the prime's cost build, writes Markdown for `renderers` → .docx. DO NOT USE FOR prime proposal prose (`proposal-generator`), reverse-engineering an RFP (`rfp-reverse-engineer`), pricing the sub (`price-to-win`), or clause audit (`compliance-auditor`).