Plugins
3 plugins@trailofbits
Static Analysis
Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection
3 skills · plugin
@fradser
Office
Office productivity skills for patent applications, PRD generation, video generation, Remotion programmatic video authoring, and AI writing trope detection
5 skills · plugin
@dotnet
Dotnet Test
Skills for running, generating, analyzing, and improving .NET tests: test execution, filtering, platform detection, coverage, testability, and MSTest workflows.
20 skills · plugin
Results for “detection”
97 skills
mukul975 building-detection-rules-with-sigma
Creates vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel.
24.6k · bundle
mukul975 implementing-mitre-attack-coverage-mapping
Map MITRE ATT&CK coverage to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.
24.6k · bundle
mukul975 configuring-host-based-intrusion-detection
Deploys and configures host-based intrusion detection systems (Wazuh, OSSEC, AIDE) to monitor file integrity, system calls, and configuration changes across endpoints. Includes FIM policies, rootkit detection, custom alert rules, active response, and SIEM integration.
24.6k · bundle
mukul975 performing-yara-rule-development-for-detection
Develop precise YARA rules for malware detection by identifying unique byte patterns, strings, and behavioral indicators in executable files while minimizing false positives.
24.6k · bundle
mukul975 detecting-stuxnet-style-attacks
Detect sophisticated cyber-physical attacks that modify PLC logic while spoofing sensor readings, covering PLC integrity monitoring, process anomaly detection, and multi-stage attack chain detection.
24.6k · bundle
zhaoxuya520 threat-hunting
Guides blue-team threat hunting and detection engineering with hypothesis-driven workflows, Sigma/YARA rule creation, SIEM query design, and validation using Atomic Red Team in authorized environments.
12.8k · bundle
More results
mukul975 implementing-endpoint-detection-with-wazuh
Deploy and configure Wazuh SIEM/XDR for endpoint detection including agent management, custom decoder and rule XML creation, alert querying via the Wazuh REST API, and automated response actions.
24.6k · bundle
mukul975 configuring-snort-ids-for-intrusion-detection
Installs, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments.
24.6k · bundle
mukul975 detecting-network-anomalies-with-zeek
Deploys and configures Zeek network security monitor to passively analyze traffic, generate structured logs, detect anomalous behavior, and create custom detection scripts for threat hunting and incident response.
24.6k · bundle
mukul975 implementing-file-integrity-monitoring-with-aide
Configure AIDE for file integrity monitoring, including baseline creation, scheduled integrity checks, change detection, and alerting.
24.6k · bundle
agentskillexchange semgrep-rule-engine
Runs Semgrep static analysis with custom YAML rules, supporting taint tracking, metavariable comparisons, and pattern-not-inside exclusions for precise vulnerability detection.
28
mukul975 implementing-siem-use-case-tuning
Reduce SIEM alert fatigue by systematically tuning detection rules in Splunk and Elastic, using statistical baselines, whitelists, and precision/recall metrics.
24.6k · bundle
mukul975 analyzing-linux-audit-logs-for-intrusion
Detect intrusion attempts, unauthorized access, and privilege escalation on Linux hosts using the auditd framework with ausearch and aureport utilities.
24.6k · bundle
trailofbits semgrep
Run Semgrep static analysis scans with automatic language detection, parallel subagent execution, and merged SARIF output. Supports full ruleset coverage or high-confidence security vulnerability filtering.
6k · bundle
mukul975 performing-network-traffic-analysis-with-zeek
Deploy Zeek network security monitor to capture, parse, and analyze network traffic metadata for threat detection, anomaly identification, and forensic investigation.
24.6k · bundle
mukul975 building-devsecops-pipeline-with-gitlab-ci
Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.
24.6k · bundle
mukul975 implementing-threat-modeling-with-mitre-attack
Map adversary TTPs against organizational assets using the MITRE ATT&CK framework, assess detection coverage gaps, and prioritize defensive investments.
24.6k · bundle
trailofbits yara-rule-authoring
Write high-quality YARA-X detection rules for malware identification, covering naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction.
6k · bundle
mukul975 analyzing-network-packets-with-scapy
Craft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and traffic anomaly detection in authorized security testing.
24.6k · bundle
mukul975 detecting-mimikatz-execution-patterns
Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.
24.6k · bundle
mukul975 performing-threat-hunting-with-elastic-siem
Proactively search for threats in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection.
24.6k · bundle
mukul975 mapping-mitre-attack-techniques
Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization.
24.6k · bundle
mukul975 detecting-data-and-model-poisoning
Detect poisoned training data and backdoored models across the ML pipeline using statistical analysis, activation clustering, and spectral signatures.
24.6k · bundle
mukul975 hunting-for-beaconing-with-frequency-analysis
Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.
24.6k · bundle
mukul975 detecting-lateral-movement-in-network
Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.
24.6k · bundle
mukul975 detecting-ransomware-precursors-in-network
Detects early-stage ransomware indicators in network traffic before encryption begins, using Zeek, Suricata, Arkime, SIEM correlation rules, and threat intelligence feeds to identify Cobalt Strike beacons, Mimikatz signatures, and RDP brute-force attempts.
24.6k · bundle
mukul975 detecting-ai-model-prompt-injection-attacks
Detects prompt injection attacks targeting LLM-based applications using regex pattern matching, heuristic scoring, and DeBERTa transformer classification.
24.6k · bundle
mukul975 detecting-arp-poisoning-in-network-traffic
Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom Python monitoring scripts to protect against man-in-the-middle interception.
24.6k · bundle
mukul975 detecting-evasion-techniques-in-endpoint-logs
Detects defense evasion techniques in endpoint logs, including log tampering, timestomping, process injection, and security tool disabling, using Sysmon, EDR telemetry, and SIEM queries.
24.6k · bundle
mukul975 detecting-attacks-on-scada-systems
Detects cyber attacks targeting SCADA systems, including man-in-the-middle, command injection, HMI compromise, historian manipulation, and DoS, using OT-specific intrusion detection and protocol anomaly analysis.
24.6k · bundle
mukul975 performing-dns-tunneling-detection
Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality using scapy for packet capture analysis.
24.6k · bundle
mukul975 analyzing-cobaltstrike-malleable-c2-profiles
Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate network detection signatures.
24.6k · bundle
mukul975 implementing-email-sandboxing-with-proofpoint
Configure Proofpoint Targeted Attack Protection (TAP) to detonate suspicious attachments and URLs in isolated sandboxes, integrate with email flow, analyze reports, and tune detection policies.
24.6k · bundle
mukul975 detecting-network-scanning-with-ids-signatures
Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.
24.6k · bundle
mukul975 detecting-anomalies-in-industrial-control-systems
Deploys anomaly detection for industrial control environments using machine learning models trained on OT network baselines, physics-based process models, and behavioral analysis of industrial protocol communications.
24.6k · bundle
mukul975 analyzing-web-server-logs-for-intrusion
Parse Apache and Nginx access logs to detect SQL injection, LFI, XSS, scanner fingerprints, and brute-force patterns using regex-based detection, GeoIP enrichment, and statistical anomaly analysis.
24.6k · bundle