Skill UI

This skill guides SOC analysts and detection engineers on how to correlate complex, multi-stage attacks within the IBM QRadar SIEM platform. It covers advanced usage of AQL (Ariel Query Language) for deep event investigation, building custom correlation rules (Building Blocks and Offenses), and cross-source data correlation (e.g., auth failures with network flows). It is essential for reducing false positives and improving threat detection accuracy.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).

A comprehensive skill for detecting early-stage ransomware indicators before data encryption occurs. It utilizes advanced network detection tools such as Zeek and Suricata, combined with SIEM correlation rules and threat intelligence feeds. This method monitors the entire pre-encryption kill chain, identifying precursor behaviors like initial access broker activity, Cobalt Strike C2 beaconing, credential harvesting (e.g., Mimikatz signatures), and data staging attempts, enabling timely incident response and containment.

A comprehensive guide and set of detection rules for identifying OS credential dumping techniques (MITRE T1003). It leverages EDR telemetry, Sysmon process access monitoring, and Windows security event correlation to detect attacks targeting LSASS memory, SAM databases, and NTDS.dit files. Essential for proactive threat hunting and incident response.

This guide provides a structured methodology for proactively hunting adversaries who establish persistence using Windows Scheduled Tasks (T1053). It outlines the necessary prerequisites (EDR, SIEM, Sysmon) and a comprehensive workflow—from hypothesis formulation to threat correlation—for detecting suspicious task creation, unusual scheduling patterns, and attacker TTPs during incident response or red teaming.

This guide outlines systematic methodologies for reducing false positives in Security Information and Event Management (SIEM) systems. It covers advanced techniques including threshold tuning, multi-signal correlation enhancement, behavioral baseline integration, and threat intelligence filtering. Used by SOC analysts and detection engineers to combat alert fatigue and improve true positive detection rates.

This skill provides comprehensive guidance on detecting post-exploitation credential dumping activities, such as LSASS memory access, SAM registry hive extraction, and NTDS.dit theft. It utilizes advanced log sources, including Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and SIEM correlation rules, to identify suspicious process behaviors and malicious tool usage, mapping these detections to MITRE ATT&CK techniques.

A comprehensive set of reusable patterns for structured incident triage in AWS environments. Includes pre-built Logs Insights queries for detecting errors, latency spikes, cold starts, and OOM events. Also provides systematic correlation methods linking CloudWatch alarms to deployment events, and a decision tree to narrow the blast radius scope from account to resource.