How do I install the D3fend Detect skill?

Run npx skillmds@latest add daemon-blockint-tech/d3fend-detect in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is D3fend Detect safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with D3fend Detect?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is D3fend Detect free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published D3fend Detect?

daemon-blockint-tech (@daemon-blockint-tech) published this skill. Their other Agent Skills are listed on their SkillMD profile.

D3fend Detect by daemon-blockint-tech

Name: D3fend Detect
Author: daemon-blockint-tech

D3fend Detect

Guides cybersecurity detection engineering using MITRE D3FEND—file analysis, identifier reputation, network traffic analysis, physical access monitoring, and platform monitoring. Covers dynamic/emulated analysis, traffic signature detection, behavior analytics, and integrity monitoring. Use when building detection rules, analyzing malware, monitoring networks, or designing SOC workflows—not for hardening (d3fend-harden), isolation (d3fend-isolate), or deception (d3fend-deceive).

File contents

D3FEND — Detect

When to Use

Building file analysis pipelines (static, dynamic, emulated)
Implementing identifier reputation checks (IP, domain, file hash, URL)
Designing network traffic analysis and anomaly detection
Monitoring platform health (OS, firmware, applications)
Setting up physical access controls and surveillance
Creating file integrity and behavioral monitoring

When NOT to Use

System hardening or secure configuration → d3fend-harden
Network segmentation or access mediation → d3fend-isolate
Honeypots or decoy operations → d3fend-deceive
Threat hunting playbooks → defensive-security-analyst
SIEM/SOAR engineering → cybersecurity

Core Workflows

1. File Analysis

Method	What It Finds	Tools
Static analysis	File structure, hashes, strings, imports	YARA, ssdeep, ExifTool
Dynamic analysis	Runtime behavior, API calls, network	Cuckoo, ANY.RUN
Emulated analysis	Sandboxed execution, evasion detection	Speakeasy, Unicorn
Content rules	Signature matching, entropy analysis	ClamAV, custom YARA

See references/file_analysis.md

2. Identifier & Reputation Analysis

IP reputation (blocklists, geo, ASN)
Domain reputation (age, DGA, homoglyphs)
File hash reputation (VT, local DB)
URL analysis (phishing, redirect chains)
Sender/MTP reputation (SPF, DKIM, DMARC)

See references/identifier_reputation.md

3. Network Traffic Analysis

Protocol command analysis (DNS, HTTP, RPC, IPC)
Payload profiling and byte sequence emulation
Certificate analysis (active/passive)
Connection attempt and session volume analysis
Community deviation and signature matching

See references/network_traffic.md

4. Platform & Physical Monitoring

File integrity monitoring (FIM)
Firmware behavior analysis and verification
OS and application performance/exception monitoring
Scheduled job and system daemon monitoring
Physical: electronic locks, motion, video, proximity

See references/platform_monitoring.md

When to load references

File analysis → references/file_analysis.md
Identifier reputation → references/identifier_reputation.md
Network traffic → references/network_traffic.md
Platform monitoring → references/platform_monitoring.md

---name: d3fend-detectdescription: Guides cybersecurity detection engineering using MITRE D3FEND—file analysis, identifier reputation, network traffic analysis, physical access monitoring, and platform monitoring. Covers dynamic/emulated analysis, traffic signature detection, behavior analytics, and integrity monitoring. Use when building detection rules, analyzing malware, monitoring networks, or designing SOC workflows—not for hardening (d3fend-harden), isolation (d3fend-isolate), or deception (d3fend-deceive).---# D3FEND — Detect## When to Use- Building file analysis pipelines (static, dynamic, emulated)- Implementing identifier reputation checks (IP, domain, file hash, URL)- Designing network traffic analysis and anomaly detection- Monitoring platform health (OS, firmware, applications)- Setting up physical access controls and surveillance- Creating file integrity and behavioral monitoring## When NOT to Use- System hardening or secure configuration → `d3fend-harden`- Network segmentation or access mediation → `d3fend-isolate`- Honeypots or decoy operations → `d3fend-deceive`- Threat hunting playbooks → `defensive-security-analyst`- SIEM/SOAR engineering → `cybersecurity`## Core Workflows### 1. File Analysis| Method | What It Finds | Tools ||---|---|---|| Static analysis | File structure, hashes, strings, imports | YARA, ssdeep, ExifTool || Dynamic analysis | Runtime behavior, API calls, network | Cuckoo, ANY.RUN || Emulated analysis | Sandboxed execution, evasion detection | Speakeasy, Unicorn || Content rules | Signature matching, entropy analysis | ClamAV, custom YARA |**See `references/file_analysis.md`**### 2. Identifier & Reputation Analysis- IP reputation (blocklists, geo, ASN)- Domain reputation (age, DGA, homoglyphs)- File hash reputation (VT, local DB)- URL analysis (phishing, redirect chains)- Sender/MTP reputation (SPF, DKIM, DMARC)**See `references/identifier_reputation.md`**### 3. Network Traffic Analysis- Protocol command analysis (DNS, HTTP, RPC, IPC)- Payload profiling and byte sequence emulation- Certificate analysis (active/passive)- Connection attempt and session volume analysis- Community deviation and signature matching**See `references/network_traffic.md`**### 4. Platform & Physical Monitoring- File integrity monitoring (FIM)- Firmware behavior analysis and verification- OS and application performance/exception monitoring- Scheduled job and system daemon monitoring- Physical: electronic locks, motion, video, proximity**See `references/platform_monitoring.md`**## When to load references- **File analysis** → `references/file_analysis.md`- **Identifier reputation** → `references/identifier_reputation.md`- **Network traffic** → `references/network_traffic.md`- **Platform monitoring** → `references/platform_monitoring.md`

Frequently asked questions