Results for “detection-rule”

Analyze suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior detection.

Deploys Datadog Cloud SIEM, CSM, and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure.

Explains MariaDB-specific SET TRANSACTION behavior, including scope rules, isolation levels, and innodb_snapshot_isolation conflict detection, to help write correct transaction statements and retry logic.

Deliberately disables or degrades security controls to verify detection and response capabilities, including WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess.

Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack payloads past WAF detection rules.

Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.

Automatically organizes files in a directory into a clean structure based on configurable rules — by file type, date, project, or priority — with support for duplicate detection, naming conventions, and archival strategies. Use when the user requests file organization or provides relevant inputs for this workflow.

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.

Crafts and injects custom network packets using Scapy, hping3, and Nemesis during authorized security assessments to test firewall rules, IDS detection, protocol handling, and network stack resilience against malformed and spoofed traffic.

Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins using statistical analysis on Splunk or raw log data.

Detects early-stage ransomware indicators in network traffic before encryption begins, using Zeek, Suricata, Arkime, SIEM correlation rules, and threat intelligence feeds to identify Cobalt Strike beacons, Mimikatz signatures, and RDP brute-force attempts.

Use to design or audit complaint identification and classification in customer support, especially in regulated sectors. Trigger for "are we identifying complaints correctly", "complaint detection", regulatory complaint definition, FCA or CFPB complaint handling, vulnerable customer identification, root cause categorisation for complaints, or building an AI classifier for complaints.

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Provides detection rules for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware.

Use to find duplicate or repeated support conversations and produce a reviewable merge plan. Trigger for "find duplicate tickets", "customers contacting us twice about the same thing", deduplicating a helpdesk, cleaning up ticket volume, or measuring how much of your contact volume is the same issue submitted more than once.

Use to identify signals of customer vulnerability in support conversations and audit whether they were recognised and acted on. Trigger for "identify vulnerable customers", "did we spot the vulnerability signals", "customers in financial difficulty", bereavement or health disclosures in support, vulnerable customer handling audits, or designing vulnerability recognition for a support team.

Use to surface fraud, scam and financial-crime signals that customers describe to support before detection systems see them, and to check whether agents recognised and routed them. Trigger for "are customers reporting scams", "new scam pattern targeting our customers", "did we spot the fraud signals", authorised push payment scams, "customer was coached by someone on the phone", or fraud reports arriving through support.

Drive mex (`mex-agent`), persistent project memory and code graphs for AI coding agents. One command scaffolds a living wiki, builds a deterministic code graph, and installs a project anchor file (CLAUDE.md, root AGENTS.md, .cursorrules, .windsurfrules, copilot-instructions.md, or .opencode/opencode.json) that your agent auto-loads as a standing rule document. Use when the user wants to `mex setup` a new project, build a symbol-grounded wiki, keep knowledge connected to implementation, route relevant context to agents, or run drift detection (`mex check`, `mex sync`). Triggers on: "mex setup", "project memory", "code graphs", "codebase documentation", "drift detection", "agent memory", "structured scaffolds", "architectural context", "living wiki", "project anchor file".

Detect and humanize AI-generated Chinese text. 20+ rule detection categories plus statistical features (sentence-length CV, short-sentence fraction, comma density, perplexity, GLTR, DivEye) plus scene-aware LR fusion (rule × 0.2 + LR × 0.8) trained on three scenes: general / academic / longform 长文本 (≥1500 字)。Unified CLI: ./humanize {detect,rewrite,academic,style,compare}. 8 style transforms (casual/zhihu/xiaohongshu/wechat/academic/literary/weibo/novel)。 Multi-paragraph rewriting (paragraph length CV、跨段 trigram 重复) plus best-of-N humanize (默认 N=10 取最低 LR)。165 replacement patterns + CiLin 同义词词林 38873 with collision blacklist。 Academic paper AIGC reduction for CNKI/VIP/Wanfang (知网/维普/万方 AIGC 检测降重)。 Pure Python, no dependencies, offline。v5.0.0 — HC3 fused 准确率 95%、学术 hero 100→35 (-65)、 工作汇报 96→13 (-83)、长篇博客 96→41 (-55)。 Use when user says: "去AI味", "降AIGC", "人性化文本", "humanize chinese", "AI检测", "AIGC降重", "去除AI痕迹", "文本改写", "论文降重", "知网检测", "维普检测", "AI写作检测", "让文字更自然", "detect AI text", "humanize text", "reduce AIGC sc