detection-engineer

Name: detection-engineer
Author: gl0bal01

43stars3forks

How to install detection-engineer?

gl0bal01/malware-analysis-claude-skills/detection-engineer

$npx -y skills add gl0bal01/malware-analysis-claude-skills --skill detection-engineer

Installs into the current project.

Summary

Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SIEM, Suricata rules for network IDS, defang IOCs for safe sharing, or convert analysis findings into actionable detection content for SOC teams and threat hunter

Files · 1

View on GitHub

SKILL.md

1	# Detection Engineer
2
3	Transform malware analysis findings into production-ready detection rules, hunting queries, and operationalized IOCs.
4
5	> Note: YARA rules are authored in the `malware-report-writer` skill, not here. This skill covers Sigma rules, Suricata/Snort rules, and hunting queries.
6
7	## When to Use This Skill
8
9	Use this skill when you need to:
10	- Write Sigma rules for SIEM detection (Splunk, Elastic, QRadar)
11	- Create Suricata/Snort rules for network IDS/IPS
12	- Generate hunting queries for EDR platforms
13	- Defang IOCs for safe documentation and sharing
14	- Convert IOCs to standard formats (STIX, OpenIOC, CSV)
15	- Assess IOC confidence levels and volatility
16	- Create detection logic from behavioral analysis
17	- Write threat hunting hypotheses
18
19	## IOC Management & Defanging
20
21	### Why Defang IOCs?
22
23	Problem: Live IOCs in reports can be:
24	- Accidentally clicked (execute malware)
25	- Automatically crawled by bots
26	- Trigger security tools (email filters, DLP)
27
28	Solution: Defang (neutralize) IOCs for safe sharing.
29
30	### Defanging Patterns
31
32	```bash
33	# URLs
34	http://malicious.com/payload.exe
35	→ hxxp://malicious[.]com/payload[.]exe
36
37	https://evil.tk/login
38	→ hxxps://evil[.]tk/login
39
40	# Domains
41	malicious.com
42	→ malicious[.]com
43
44	c2-server.example.org
45	→ c2-server[.]example[.]org
46
47	# IPs
48	192.168.1.100
49	→ 192[.]168[.]1[.]100
50
51	10.0.0.50
52	→ 10[.]0[.]0[.]50
53
54	# Email addresses
55	attacker@evil.com
56	→ attacker[@]evil[.]com
57
58	phishing@malware.tk
59	→ phishing[@]malware[.]tk
60
61	# File paths (optional)
62	C:\Windows\System32\malware.exe
63	→ C:\Windows\System32\malware[.]exe
64	```
65
66	### Automated Defanging
67
68	Tool: ioc-fanger (Python)
69	```bash
70	# Install
71	pip install ioc-fanger
72
73	# Defang
74	echo "http://malicious.com" \| fanger --defang
75	# Output: hxxp://malicious[.]com
76
77	# Refang (restore for testing)
78	echo "hxxp://malicious[.]com" \| fanger --fang
79	# Output: http://malicious.com
80	```
81
82	Manual sed/awk:
83	```bash
84	# Defang URLs and domains
85	echo "http://malicious.com/payload.exe" \| sed 's/http:/hxxp:/g; s/\./[.]/g'
86
87	# Defang IPs
88	echo "192.168.1.100" \| sed 's/\./[.]/g'
89
90	# Defang emails
91	echo "attacker@evil.com" \| sed 's/@/[@]/g; s/\./[.]/g'
92	```
93
94	### IOC Confidence & Volatility Assessment
95
96	\| IOC Type \| Confidence \| Volatility \| Reasoning \|
97	\|----------\|------------\|------------\|-----------\|
98	\| File Hash (SHA256) \| High \| Static \| Unique to sample, won't change \|
99	\| Mutex Name \| High \| Static \| Hardcoded in malware \|
100	\| PDB Path \| High \| Static \| Compilation artifact \|
101	\| Registry Key \| High \| Static \| Persistence mechanism \|
102	\| Certificate Hash \| High \| Static \| Code signing certificate \|
103	\| IP Address \| Medium \| Dynamic \| Can change (DGA, fast-flux, hosting) \|
104	\| Domain (C2) \| Medium \| Dynamic \| May rotate frequently \|
105	\| URL Path \| Low-Medium \| Dynamic \| Often dynamic or timestamped \|
106	\| User-Agent \| Low \| Dynamic \| Common strings, high FP rate \|
107	\| File Path \| Medium \| Static \| May vary by environment \|
108	\| Process Name \| Low \| Dynamic \| Easily changed by attacker \|
109
110	Label IOCs appropriately:
111	```markdown
112	### Network Indicators (Medium Confidence - Dynamic)
113	- Domain: malicious[.]com (C2 server - may rotate)
114	- IP: 192[.]168[.]1[.]100 (C2 IP - may change)
115
116	### Host Indicators (High Confidence - Static)
117	- Mutex: Global\UniqueMalwareMutex
118	- Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Malware
119	- File Hash: abc123... (SHA256)
120	```
121
122	---
123
124	## Sigma Rule Creation (SIEM Detection)
125
126	### What is Sigma?
127
128	Sigma is a generic signature format for SIEM systems. Write once, convert to Splunk/Elastic/QRadar/ArcSight queries.
129
130	Official Repo: https://github.com/SigmaHQ/sigma
131
132	### Sigma Rule Structure
133
134	```yaml
135	title: Short Descriptive Title
136	id: unique-uuid-for-this-rule
137	status: experimental \| test \| stable
138	description: Detailed description of what this detects
139	references:
140	- https://attack.mitre.org/techniques/T1059/001/
141	author: Your Name
142	date: 2025-10-26
143	tags:
144	- attack.execution
145	- attack.t1059.001
146	logsource:
147	category: process_creation # or network_connection, file_event, etc.
148	product: windows
149	detection:
150	selection:
151	Image\|endswith: '\powershell.exe'
152	CommandLine\|contains\|all:
153	- 'DownloadString'
154	- 'Invoke-Expression'
155	condition: selection
156	falsepositives:
157	- Legitimate administrative scripts
158	level: high # informational, low, medium, high, critical
159	```
160
161	### Common Sigma Logsources
162
163	\| Category \| Product \| Event Source \| Use Case \|
164	\|----------\|---------\|--------------\|----------\|
165	\| `process_creation` \| windows \| Sysmon Event ID 1, Security 4688 \| Process execution \|
166	\| `network_connection` \| windows \| Sysmon Event ID

People who liked this also viewed

6 picks

Type

detection-engineer

43stars3forks

View on GitHub

How to install detection-engineer?

gl0bal01/malware-analysis-claude-skills/detection-engineer

$npx -y skills add gl0bal01/malware-analysis-claude-skills --skill detection-engineer

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Detection Engineer
2
3	Transform malware analysis findings into production-ready detection rules, hunting queries, and operationalized IOCs.
4
5	> Note: YARA rules are authored in the `malware-report-writer` skill, not here. This skill covers Sigma rules, Suricata/Snort rules, and hunting queries.
6
7	## When to Use This Skill
8
9	Use this skill when you need to:
10	- Write Sigma rules for SIEM detection (Splunk, Elastic, QRadar)
11	- Create Suricata/Snort rules for network IDS/IPS
12	- Generate hunting queries for EDR platforms
13	- Defang IOCs for safe documentation and sharing
14	- Convert IOCs to standard formats (STIX, OpenIOC, CSV)
15	- Assess IOC confidence levels and volatility
16	- Create detection logic from behavioral analysis
17	- Write threat hunting hypotheses
18
19	## IOC Management & Defanging
20
21	### Why Defang IOCs?
22
23	Problem: Live IOCs in reports can be:
24	- Accidentally clicked (execute malware)
25	- Automatically crawled by bots
26	- Trigger security tools (email filters, DLP)
27
28	Solution: Defang (neutralize) IOCs for safe sharing.
29
30	### Defanging Patterns
31
32	```bash
33	# URLs
34	http://malicious.com/payload.exe
35	→ hxxp://malicious[.]com/payload[.]exe
36
37	https://evil.tk/login
38	→ hxxps://evil[.]tk/login
39
40	# Domains
41	malicious.com
42	→ malicious[.]com
43
44	c2-server.example.org
45	→ c2-server[.]example[.]org
46
47	# IPs
48	192.168.1.100
49	→ 192[.]168[.]1[.]100
50
51	10.0.0.50
52	→ 10[.]0[.]0[.]50
53
54	# Email addresses
55	attacker@evil.com
56	→ attacker[@]evil[.]com
57
58	phishing@malware.tk
59	→ phishing[@]malware[.]tk
60
61	# File paths (optional)
62	C:\Windows\System32\malware.exe
63	→ C:\Windows\System32\malware[.]exe
64	```
65
66	### Automated Defanging
67
68	Tool: ioc-fanger (Python)
69	```bash
70	# Install
71	pip install ioc-fanger
72
73	# Defang
74	echo "http://malicious.com" \| fanger --defang
75	# Output: hxxp://malicious[.]com
76
77	# Refang (restore for testing)
78	echo "hxxp://malicious[.]com" \| fanger --fang
79	# Output: http://malicious.com
80	```
81
82	Manual sed/awk:
83	```bash
84	# Defang URLs and domains
85	echo "http://malicious.com/payload.exe" \| sed 's/http:/hxxp:/g; s/\./[.]/g'
86
87	# Defang IPs
88	echo "192.168.1.100" \| sed 's/\./[.]/g'
89
90	# Defang emails
91	echo "attacker@evil.com" \| sed 's/@/[@]/g; s/\./[.]/g'
92	```
93
94	### IOC Confidence & Volatility Assessment
95
96	\| IOC Type \| Confidence \| Volatility \| Reasoning \|
97	\|----------\|------------\|------------\|-----------\|
98	\| File Hash (SHA256) \| High \| Static \| Unique to sample, won't change \|
99	\| Mutex Name \| High \| Static \| Hardcoded in malware \|
100	\| PDB Path \| High \| Static \| Compilation artifact \|
101	\| Registry Key \| High \| Static \| Persistence mechanism \|
102	\| Certificate Hash \| High \| Static \| Code signing certificate \|
103	\| IP Address \| Medium \| Dynamic \| Can change (DGA, fast-flux, hosting) \|
104	\| Domain (C2) \| Medium \| Dynamic \| May rotate frequently \|
105	\| URL Path \| Low-Medium \| Dynamic \| Often dynamic or timestamped \|
106	\| User-Agent \| Low \| Dynamic \| Common strings, high FP rate \|
107	\| File Path \| Medium \| Static \| May vary by environment \|
108	\| Process Name \| Low \| Dynamic \| Easily changed by attacker \|
109
110	Label IOCs appropriately:
111	```markdown
112	### Network Indicators (Medium Confidence - Dynamic)
113	- Domain: malicious[.]com (C2 server - may rotate)
114	- IP: 192[.]168[.]1[.]100 (C2 IP - may change)
115
116	### Host Indicators (High Confidence - Static)
117	- Mutex: Global\UniqueMalwareMutex
118	- Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Malware
119	- File Hash: abc123... (SHA256)
120	```
121
122	---
123
124	## Sigma Rule Creation (SIEM Detection)
125
126	### What is Sigma?
127
128	Sigma is a generic signature format for SIEM systems. Write once, convert to Splunk/Elastic/QRadar/ArcSight queries.
129
130	Official Repo: https://github.com/SigmaHQ/sigma
131
132	### Sigma Rule Structure
133
134	```yaml
135	title: Short Descriptive Title
136	id: unique-uuid-for-this-rule
137	status: experimental \| test \| stable
138	description: Detailed description of what this detects
139	references:
140	- https://attack.mitre.org/techniques/T1059/001/
141	author: Your Name
142	date: 2025-10-26
143	tags:
144	- attack.execution
145	- attack.t1059.001
146	logsource:
147	category: process_creation # or network_connection, file_event, etc.
148	product: windows
149	detection:
150	selection:
151	Image\|endswith: '\powershell.exe'
152	CommandLine\|contains\|all:
153	- 'DownloadString'
154	- 'Invoke-Expression'
155	condition: selection
156	falsepositives:
157	- Legitimate administrative scripts
158	level: high # informational, low, medium, high, critical
159	```
160
161	### Common Sigma Logsources
162
163	\| Category \| Product \| Event Source \| Use Case \|
164	\|----------\|---------\|--------------\|----------\|
165	\| `process_creation` \| windows \| Sysmon Event ID 1, Security 4688 \| Process execution \|
166	\| `network_connection` \| windows \| Sysmon Event ID

People who liked this also viewed

6 picks

Type